Search

International audience; Several end-to-end encryption technologies for emails such as PGP and S/MIME exist since decades. However, end-to-end encryption is barely applied. To understand why users hesitate to secure their email communication and which usability issues they face with PGP, S/MIME as well as with pEp (Pretty Easy Privacy), a fairly new technology, we conducted an online survey and user testing. We found that more than 60% of e-mail users are unaware of the existence of such encryption technologies and never tried to use one. We observed that above all, users are overwhelmed with the management of public keys and struggle with the setup of encryption technology in their mail software. Even though users struggle to put email encryption into practice, we experienced roughly the same number of users being aware of the importance of email encryption. Particularly, we found that users are very concerned about identity theft, as 78% want to make sure that no other person is able to write email in their name.

Recommending similar-interest users' groups in multimedia services is the problem of detecting for each registered user his/her membership to one interest-group of relevant consumers. The consumers in each interest-group share some relevant preferences which guarantee that the interest-group as a whole satisfies some desired properties of similarity. As a result, forming these interest-groups requires the availability of personal data of different consumers. This is a crucial requirement for different recommender systems. With the increasing trend of service providers to collect a large volume of personal data regarding their end-users, presumably to better serve them. However, a significant part of the data that is typically collected is not essential to the service being offered, or to the completion of the services it was presumably released for. Gathering such unnecessary data can be seen as a privacy threat, and storing it exposes the end-users to further unavoidable risks. In this paper, a privacy aware group based recommender system is proposed for the automated discovery of appropriate interest groups in multimedia services. A fog based middleware (FMCP) was introduced that runs at end-users' sides and allows exchanging of their information to facilities recommending and creating interest- groups without disclosing their real preferences to other consumers. The membership of consumers in various interest groups allows receiving highly appropriate and reliable multimedia content- related advices. The system utilizes two protocols to attain this goal. Experiments were performed on real dataset.

Ontology-based applications are becoming more and more popular and are usually domain-specific (e.g., eHealth or domotic). Designing ontologies and semantic-based applications manually is tedious and cumbersome for non-technical expert or semantic web beginners. Internet of Things (IoT) is a new field aiming to connect the physical world surrounded by devices such as sensors to the web to automatically interact with them and build innovative applications. The main challenges are to automate as much as possible the tasks of: (1) reusing the background knowledge previously designed by domain experts, (2) facilitating the tasks of IoT developers willing to integrate semantic web technologies into their applications, and (3) designing interoperable semantic-based IoT applications. Stemming from Linked Open Data and Linked Open Vocabularies, we designed Linked Open Vocabularies for Internet of Things (LOV4IoT), a catalogue of ontologies/datasets/rules relevant for IoT available online. LOV4IoT has been extended with more domains and ontology-based projects, a semantic-based dataset and a bot to enhance automation, and web services. Moreover, we demonstrate several use cases of the LOV4IoT dataset: (1) building Semantic Web of Things applications, (2) extracting frequent terms used in existing ontologies, and (3) stakeholders who can exploit, reuse and combine domain ontologies. Finally, we evaluated this dataset with users who exploit this dataset for their own purposes.

International audience; Access Control (AC) is a well known mechanism that allows access restriction to resources. Nevertheless, it does not provide notification when a resource is retransmitted to an unauthorized third party. To overcome this issue, one can use mechanisms such as Data Loss/Leak Prevention (DLP) or Transmission Control (TC). These mechanisms are based on policies that are defined by security experts. Unfortunately, these policies can contradict existing AC rules, leading to security leakage (i.e. a legitimate user is allowed to send a resource to someone who has no access rights in the AC). In this article, we aim at creating TC policies that are compliant with existing AC policies. To do so, we use a mapping mechanism that generates TC rules directly from existing AC policies. Thanks to the generated rules, our solution can make inferences to improve existing AC and enhance security knowledge between infrastructures.

International audience; The paper advocates for applying Internet of Things (IoT) for personalized healthcare in smart homes. An IoT architecture is presented which enables such healthcare services. Continuous monitoring of physical parameters and processing of the medical data form the basis of smarter, connected and personalized healthcare. The core functionalities of the IoT architecture are exposed using RESTful web services to the consumers. The main contributions of the paper are: (i) providing a unified approach for discovery, management and interaction with physical devices, (ii) utilizing Machine-to-Machine Measurement (M3) framework to generate high level abstraction from wearable sensors, (iii) combining cross-domain sensor data using M3 and (iv) controlling home automation devices based on health sensor information. Prototype implementations and performance evaluations of the architecture components are discussed.

The number of mobile devices connected to the Internet is rapidly growing, inducing security issues that cannot be prevented by common mechanisms such as HTTPS. Indeed, mobile environments require light algorithms that can reduce the power-consumption and extend battery life. Moreover, HTTPS does not offer fine-grained control over the security properties such as integrity, confidentiality or authenticity. This lack of flexibility can be problematic for both power-consumption and security robustness. To overcome these issues, we have proposed in previous works a modular architecture, called LECCSAM, based on security components to secure any communication protocol by adding the required security properties. In the context of HTTP, it provides an alternative version of HTTPS by adding the integrity, confidentiality, and authenticity properties to HTTP separately or in block (i.e. only one property or any combinations of two or more properties), depending on the user needs and usage context. In this paper, we propose to extend this alternative version of HTTPS with the non-repudiation property. Preliminary results of the performance evaluation are encouraging.

The mobility has become a valuable necessity for information technology users. Along with this property, for a smart phone user, the following aspects are also important: the storage space, the energy consumption, the applications complexity and the efficiency. Comparing to standalone mobile applications, mobile cloud applications make use of resource sharing, have richer functionality and reduced costs. On the other hand, mobile cloud applications raise some problems related to data security, data privacy and trust. In this paper, we analyze the need for mobile cloud applications, we propose a scenario for an e-health application and we design a data traceability service.

Today, creation of basic mobile widget mashups is a straightforward task. However, designing mobile mashups that are actually secure to use remains very challenging. In this paper, we discuss the security risks introduced by mobile mashups and then propose a platform independent architecture called SCCM for securing this type of mashups. SCCM has been implemented on an Android platform, and the results of our security evaluations are encouraging.

International audience; We present a security ontology to help non-security expert software designers or developers to: (1) design secure software and, (2) to understand and be aware of main security concepts and issues. Our security ontology defines the main security concepts such as attacks, countermeasures, security properties and their relationships. Countermeasures can be cryptographic concepts (encryption algorithm, key management, digital signature, hash function), security tools or security protocols. The purpose of this ontology is to be reused in numerous domains such as security of web applications, network management or communication networks (sensor, cellular and wireless). The ontology and a user interface (to use the ontology) are available online.

International audience; Numerous communication protocols have been designed offering a set of security properties through the use of cryptographic tools to secure electronic document transfer. However, there is no clear match between the tools used and security properties they offer. To solve this problem, the authors propose to use a component-based approach; more specifically the authors introduce the notion of high-level security component where each component provides an atomic security property. This approach will facilitate the design of new protocols that fulfill any specific set of security properties by assembling the appropriate components. At the same time, users using a protocol designed with these security components will have the assurance that the protocol satisfies the security properties required for the electronic document transfer. The authors validate the approach by showing how the integrity property can be added to the HTTP protocol to design a security property-centric HTTPS and in this case an integrity-only HTTPS.

International audience; Securing a mobile Web connection via HTTPS is a well-known drain on battery life. To solve this problem, we propose a novel, modular approach based on security properties. Our solution enables fine-grained control of the security properties used during mobile Web access, giving users the opportunity to avoid power-hungry security mechanisms when they are not needed. Starting from the well-known security properties integrity, confidentiality, and authentication, we develop modular software components that can be added to the HTTP protocol on an as-needed basis, thereby extending battery life, especially when compared to using monolithic HTTPS-based security. Preliminary measurements indicate that our approach results in a 78% to 99% reduction in resource use.

International audience; Cloud computing is a new paradigm providing software and hardware resources according to the customers' needs. However, it introduces new security risks such as confidentiality of data stored in cloud databases. Actually, this last risk is a crucial issue that must be addressed as ciphering mechanisms are not sufficient to guarantee a strong confidentiality of data. In this paper, we discuss the main cloud computing security risks and focus on the data confidentiality problem in the context of e-commerce clouds. We describe the design of a data concealment component that we propose to resolve this problem. Evaluating this component, we find that it successfully conceal data of legitimate users and protect them against potential attacks.

International audience; Mashups on traditional desktop devices are a well-known source of security risks. In this paper, we examine how these risks translate to mobile mashups and identify new risks caused by mobile-specific characteristics such as access to device features or offline operation. We describe the design of SCCM, a platform independent approach to handle the various mobile mashup security risks in a consistent and systematic manner. Evaluating an SCCM implementation for Android, we find that SCCM successfully protects against common attacks such as inserting a malicious widget from the outside.

International audience; Electronic document transfer is a key operation in many of today's most important applications (workflow, e-commerce, etc.). Each of these applications requires different security properties and constraints. Numerous communication protocols have been designed offering a set of security properties through the use of cryptographic tools. However, there is no clear match between the tools used and security properties they offer. In this paper, we propose to use a component-based approach to secure electronic document transfer. We introduce software components as "high-level security components", where each component provides an atomic security property such as integrity, confidentiality or authenticity. With this approach, a protocol developer is able to easily enhance an existing protocol by adding a specific security component providing a specific security property. Moreover, it will be easy to design new protocols to fulfil any specific set of security properties by assembling the appropriate components. At the same time, a user using a protocol designed with these security components will have the assurance and certification that the protocol satisfies the security properties required for the electronic document transfer at hand. Our approach is validated by showing how an integrity property can be added to the HTTP protocol to design a security property-centric HTTP and in this case an integrity-only HTTP.

Within a mobile environment, communications may necessitate different security properties depending on the sensitivity of the data exchanged. A protocol such as HTTPS that uses the Secure Socket Layer/Transport Layer Security (SSL/TLS) may offer these properties, but it is known that SSL/TLS is high-energy consuming and the properties are provided as a block, which may have an important impact on the battery life of the mobile devices. In this paper, we propose to build security protocols from software security components offering each one a security property. By externalizing the security functionalities and adapting the security level to the users’ needs, we are providing a security management architecture adapted to mobile environments. A proof of concept is provided based on the XMPP protocol.

One of the major problems due to denial of service attacks is the identification of fault packets. To resolve this problem, several IP traceback methods have been defined. In this paper, we propose a traceback solution that is efficient and applicable in the real context of Internet, i.e. taking into account the fact that Internet is constituted of a set of autonomous systems (ASs) operated by different administrative authorities.

In improving security for the networks of today and tomorrow there are two important features that must be considered. The first is the open and distributed nature of today’s enterprise networks. And the second is their dynamic nature, not just in terms of size, but in terms of changing services offered, and the mobility of users. Of particular importance, then is the ability to rapidly apply new security policies in a system. Equally, a system should incorporate as much “intelligence” and reactivity in the system as possible. Many existing security solutions are designed for a static, known network, and are therefore unsuited to the requirements of today’s enterprise networks. In order to provide a system that can readily handle these requirements, recent works have shown that multi-agents systems offer a promising platform. The focus of our work concerns one critical security management issue that is intrusion detection. In this paper, we propose a model of managing security policies in a multi-agents system for intrusion detection.

Multi-agent systems technology can be useful for efficiently designing and maintaining secure networks. Indeed, networks evolve at a rapid pace in terms of the number and type of components and user access queries as well as intrusion possibilities. Features such as autonomy, adaptability and flexibility of the "intelligent" agent paradigm allow the managing of network evolution in a controlled way. The focus of our work concerns one critical security management issue, that is, intrusion detection. We propose a novel approach called IA-NSM (intelligent agents for network security management) for intrusion detection using intelligent agent technology. IA-NSM provides a flexible integration of a multi-agent system in a classical networked environment to enhance its protection level against inherent attacks.

The openness of business toward telecommunication networks in general and Internet in particular is performed at the prize of high security risks. Every professional knows that the only way to secure completely a private network is to make it unreachable. However, even if this solution was undertaken for many years, nowadays it is not possible to close private network especially for business purpose. Thus, security management becomes an important issue that must be considered carefully. The focus of our work concerns one critical security management issue that is intrusion detection. Some drawbacks of existing systems reveal the necessity of designing a new generation of self-adaptive systems. In fact, self-control, flexibility, adaptability, autonomy and distribution are the main features to be addressed in a suitable architecture that fulfils these requirements. The introduction of multi-agents system (MAS) in a network seems so promising to enable network entities to perform adaptive and “intelligent” behavior. “Intelligence” means that network entities provide reasoning capabilities, exhibit behavior autonomy, adaptability, interaction, communication and co-operation in order to reach specified goals. In this context, we propose a new approach for security management using intelligent agent (IA) technology. This approach provides a flexible integration of multi-agent technique in a classical network to enhance its protection level against inherent attacks.