Search

Atualmente, existem diversos dispositivos que coletam dados e prestam serviços na Internet. Alguns desses dispositivos colaboram para trocar informacões e usá-las para tomar decisões mais inteligentes em um ambiente chamado Internet das Coisas (IoT). Recentemente, a tecnologia blockchain surgiu como uma possível solução para superar problemas de segurança em IoT. Apesar disso, blockchains tradicionais (como Bitcoin ou Ethereum) nao são adequados para a natureza de capacidade/recursos limitados dos dispositivos IoT. Alem disso, as propostas atuais carecem de uma discussão sobre o comportamento do usuario em diferentes contextos e como ele pode ser adaptado para diferentes algoritmos de consenso. Para superar esses problemas, apresentamos na tese um conjunto de etapas para criar um mecanismo de consenso multinível para diferentes contextos usando uma estrutura blockchain leve chamada appendable-block blockchain. Essa abordagem fornece uma solução que permite usar diferentes configurações ou consensos, de acordo com os requisitos de cada contexto no ambiente IoT. Por fim, a tese mostra que um consenso multinível pode produzir uma alta taxa de transferencia e baixa latência para inserir novas transações em appendable-block blockchains.

Após a introdução do Bitcoin, a tecnologia de \textit{blockchain} evoluiu como uma solução para fornecer integridade, não repúdio e disponibilidade de dados para diferentes sistemas. Cenários sensíveis a dados, como Health Care, também podem se beneficiar dessas propriedades da blockchain. Assim, diferentes propostas, tanto da Academia quanto da Indústria, foram implantadas para permitir a adoção de blockchain em aplicativos de assistência médica. No entanto, existem poucas discussões sobre métodos de incentivo para ajudar a motivar novos usuários a adotar sistemas de saúde. Além disso, pouco se discute sobre o desempenho para executar códigos em blockchains públicos e privados. Para resolver esses problemas, este trabalho apresenta uma avaliação do TokenHealth, um aplicativo para monitoramento colaborativo de práticas de saúde com gamificação e incentivos baseados em tokens, em diferentes redes da Ethereum. A solução proposta é implementada por meio de smart contracts usando a linguagem Solidity e executada em máquinas virtuais da Ethereum (EVM). Avaliamos o desempenho da rede de teste Ropsten e de uma instância privada da Ethereum. Os resultados preliminares mostram que a execução de smart contracts leva menos de um minuto para um ciclo completo de diferentes smart contracts. Além disso, apresentamos uma discussão sobre os custos do uso de uma instância privada e da rede principal pública do Ethereum.

We propose Switch(De)Composer, a solution for enabling network developers to leverage the One Big Switch abstraction to write modular switch code that can be deployed across a programmable forwarding plane while promoting reusability, maintainability, and efficient resource usage in switches.

Blockchain has emerged as a technology that can change the way people and systems interact, providing mechanisms that ensure integrity and ownership of the data produced without reliance on a trusted third-party. Appendable-block blockchain is a novel instantiation that suits for solutions that require a high transaction throughput. Appendable-block blockchains focus on data produced by nodes instead of a relation (transaction) between two entities. This new kind of blockchain can improve how data are stored and managed in distributed systems. This chapter introduces the notion of appendable-block blockchain and exemplifies its applicability in multiple practical domains. Additionally, the authors provide a discussion on the security aspects of this new blockchain. Finally, the chapter presents current issues and possible future directions for appendable-block blockchains.

Blockchain technology has been applied to various applications (e.g., smart buildings and smart cities) that typically run in an environment of smart devices, known as Internet-of-Things (IoT). To support these applications, different blockchain architectures, data structures and consensus algorithms have been proposed, tailored to IoT. One such proposal, appendable-block blockchain, is a promising blockchain framework for use in IoT environments. It provides a scalable data structure that allows parallel insertions between independent nodes. However, it has some limitations, in particular related to the possible eclipse attack by malicious gateways and the lack of consensus for transactions insertion. To solve these issues, we propose a new consensus mechanism for appendable-block blockchains, called context-based consensus. Using context-based consensus, information can be inserted in parallel across devices (called context) while ensuring that light-weight consensus is performed to guarantee that a transaction is well-formed and it is placed in the correct order. We implemented context-based consensus and show that using multiple contexts reduces latency and increases the throughput of transaction insertions when compared to consensus without contexts or using single transaction consensus.

In the last few years, different researchers presented proposals for using blockchain in the Internet of Things (IoT) environments. These proposals consider that IoT environments can be benefited from different blockchain characteristics, such as: resilience, distributed processing, integrity and non-repudiation of produced information. However, researchers faced some challenges to use blockchain in IoT, e.g., latency, hardware and energy constraints, and performance requirements. One of the prominent solutions is the appendable-block blockchain, which uses a hierarchical peer-to-peer (p2p) gateway-based architecture. Additionally, current proposals present simplified evaluation scenarios, usually performed in controlled environments, which do not include important network features, for example, latency. Consequently, a model to evaluate a geographically distributed environment, for example, in a situation in which health data have to be collected from different countries in a pandemic situation, can help to understand the behavior and possible flaws of blockchains. In order to evaluate appendable-block blockchains in a realistic scenario, this paper presents an analysis of different consensus algorithms in geographically distributed hosts, in which latency can impact the performance of main operations in a blockchain, such as block and transaction insertion.

Currently, blockchain proposals are being adopted to solve security issues, such as data integrity, resilience, and non-repudiation. To improve certain aspects, e.g., energy consumption and latency, of traditional blockchains, different architectures, algorithms, and data management methods have been recently proposed. For example, appendable-block blockchain uses a different data structure designed to reduce latency in block and transaction insertion. It is especially applicable in domains such as Internet of Things (IoT), where both latency and energy are key concerns. However, the lack of some features available to other blockchains, such as Smart Contracts, limits the application of this model. To solve this, in this work, we propose the use of Smart Contracts in appendable-block blockchain through a new model called context-based appendable-block blockchain. This model also allows the execution of multiple smart contracts in parallel, featuring high performance in parallel computing scenarios. Furthermore, we present an implementation for the context-based appendable-block blockchain using an Ethereum Virtual Machine (EVM). Finally, we execute this implementation in four different testbed. The results demonstrated a performance improvement for parallel processing of smart contracts when using the proposed model.

Mobile applications are used to handle different types of data. Commonly, there is a set of personal identifiable information present in the data stored, shared and used by these applications. From that, attackers can try to exploit the mobile application in order to obtain or to cause private data leakage. Therefore, performing security assessments is an important practice to find vulnerabilities in the applications and systems before the application is deployed, or even during their use. Regarding security assessments, Penetration Test (Pentest) is one of the security test types that can be used to detect vulnerabilities through simulated attacks. Additionally, Pentest can be performed using different methodologies and best practices, through several frameworks to: organize the test execution, execute tools, provide estimations, provide reports and document a Pentest. One such framework is Tramonto, which aims to assist a cybersecurity expert during the Pentest execution by providing organization, standardization and flexibility to the whole Pentest process. This paper presents a Pentest case study applied to a Brazilian university Mobile App using the Tramonto framework. The main goal of this case study is to present how Tramonto can be applied during a Pentest execution, assisting cybersecurity experts in the tasks included in the Pentest process. Our results show details on how to perform a Pentest using Tramonto and the found vulnerabilities in the Mobile App. Besides that, there is a discussion about the main contributions obtained from our results, and we were able to verify that Tramonto managed, organized and optimized the whole Pentest process., ICITST 2019

The Internet of Things (IoT) is transforming our physical world into a complex and dynamic system of connected devices on an unprecedented scale. Connecting everyday physical objects is creating new business models, improving processes and reducing costs and risks. Recently, blockchain technology has received a lot of attention from the community as a possible solution to overcome security issues in IoT. However, traditional blockchains (such as the ones used in Bitcoin and Ethereum) are not well suited to the resource-constrained nature of IoT devices and also with the large volume of information that is expected to be generated from typical IoT deployments. To overcome these issues, several researchers have presented lightweight instances of blockchains tailored for IoT. For example, proposing novel data structures based on blocks with decoupled and appendable data. However, these researchers did not discuss how the consensus algorithm would impact their solutions, i.e., the decision of which consensus algorithm would be better suited was left as an open issue. In this paper, we improved an appendable-block blockchain framework to support different consensus algorithms through a modular design. We evaluated the performance of this improved version in different emulated scenarios and studied the impact of varying the number of devices and transactions and employing different consensus algorithms. Even adopting different consensus algorithms, results indicate that the latency to append a new block is less than 161ms (in the more demanding scenario) and the delay for processing a new transaction is less than 7ms, suggesting that our improved version of the appendable-block blockchain is efficient and scalable, and thus well suited for IoT scenarios.

The exponential increase in connected devices with built-in sensing, processing, and communication capabilities has fuelled the development of IoT applications, which creates new ecosystems for device-to-device interactions, supports smart environments, and leads to new business models. Empowered by these capabilities, IoT devices interact with each other and their environments to collect, process, and share data. Security, privacy, and reliability of data are major concerns that need to be addressed for the development of IoT applications. Recently, blockchain technology has attracted significant interest from researchers and industry leaders due to its potential for enhancing security, privacy, and reliability of the data. Blockchain offers distributed and immutable ledgers for IoT communications in the form of tamper-proof records, built-in cryptocurrency support for transactions between devices and other entities, and smart contracts to execute automated programs when certain conditions are met. Although there are potential benefits of the integration of blockchain technology to IoT, the integration introduces new challenges, such as scalability, in the design of blockchains suited for IoT applications. In this chapter, we explore key benefits and design challenges for blockchain technologies, and potential applications of blockchain technologies for IoT.

A tecnologia de blockchain surgiu como uma solução para integridade, não-repúdio e disponibilidade de dados para os diferentes setores da indústria. Cenários sensíveis a dados, como a área da saúde, podem se beneficiar dessas propriedades de blockchains. Consequentemente, diferentes pesquisas propuseram a adoção de blockchain em aplicações de saúde. No entanto, poucos são discutidos sobre métodos de incentivo para serem atraentes para um novo usuário. Além disso, poucos são discutidos sobre o desempenho durante a execução de códigos em blockchains. A fim de abordar essas questões, este trabalho apresenta a avaliação preliminar do TokenHealth, um aplicativo para saúde colaborativa com incentivos baseados em gamificação e baseados em token. A solução proposta é implementada usando o blockchain Ethereum com linguagem de desenvolvimento de smart contracts Solidity.

Atualmente, o número e a diversidade de dispositivos conectados à internet continua aumentando. Consequentemente, o gerenciamento de segurança se tornou um grande desafio. Desta forma, o Gerenciamento de Eventos e Segurança da Informação (SIEM) pode ajudar a coletar e analisar eventos gerados por diferentes ferramentas de gerenciamento. No entanto, muitas vezes, estas ferramentas, dependem de uma força-tarefa humana especializada para analisar cada evento e fornecer uma decisão de acordo com o incidente. Além disso, o gerenciamento de alertas gerado geralmente não é eficiente nas soluções atuais. A fim de ajudar a lidar com essas questões, este artigo apresenta uma abordagem para gerenciar incidentes através de tickets relacionados a eventos crítico de segurança, seguindo o processo de Gerenciamento de Incidentes da Information Technology Infrastructure Library (ITIL).

In the last few years, novel approaches for using blockchain to solve Internet of Things (IoT) security and dependability issues have been proposed. Currently, different solutions were applied to Smart Homes, Smart Cities, Smart Grids, Supply Chains, Industry, and Vehicular Networks scenarios. Despite of that, the main advantages on the adoption of different architectures, models and algorithms proposed in the state of art of blockchain in IoT scenarios are not yet clear. This paper presents some discussion about the usage of blockchain technology in IoT environments and proposes a layer model of blockchains for IoT. In addition, we present an overview of the latest research regarding network architectures, consensus algorithms, data management, and applications. Finally, this paper presents open issues and future trends about blockchain in IoT.

There is increased interest in smart vehicles acting as both data consumers and producers in smart cities. Vehicles can use smart city data for decision-making, such as dynamic routing based on traffic conditions. Moreover, the multitude of embedded sensors in vehicles can collectively produce a rich data set of the urban landscape that can be used to provide a range of services. Key to the success of this vision is a scalable and private architecture for trusted data sharing. This paper proposes a framework called SpeedyChain, that leverages blockchain technology to allow smart vehicles to share their data while maintaining privacy, integrity, resilience and non-repudiation in a decentralized, and tamper-resistant manner. Differently from traditional blockchain usage (e.g., Bitcoin and Ethereum), the proposed framework uses a blockchain design that decouples the data stored in the transactions from the block header, thus allowing for fast addition of data to the blocks. Furthermore, an expiration time for each block to avoid large sized blocks is proposed. This paper also presents an evaluation of the proposed framework in a network emulator to demonstrate its benefits., 10 pages

Security has been one of the major concerns for the computer network community due to resource abuse and malicious flows intrusion. Before a network or a system is attacked, a port scan is typically performed to discover vulnerabilities, like open ports, which may be used to access and control them. Several studies have addressed Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) methods for detecting malicious activities, based on received flows or packet data analysis. However, those methods lead to an increase in switching latency, due to the need to analyze flows or packets before routing them. This may also increase network overhead when flows or packets are duplicated to be parsed by an external IDS. On the one hand, an IDS/IPS may be a bottleneck on the network and may not be useful. On the other hand, the new paradigm called Software Defined Networking (SDN) and the OpenFlow protocol provide some statistical information about the network that may be used for detecting malicious activities. Hence, this work presents a new port scan IPS for SDN based on the OpenFlow switch counters data. A non-intrusive and lightweight method was developed and implemented, with low network overhead, and low memory and processing power consumption. The results showed that our method is effective on detecting and preventing port scan attacks.

Due to increased number of attacks on the Internet of Things (IoT) devices, the security of IoT networks became critical. Some recent researches proposed the adoption of blockchain in IoT networks without a thorough discussion on the impact of the solution on the devices performance. Furthermore, blockchain employment in the context of IoT can be challenging due to the devices hardware limitations. To fill this gap, this paper proposes an IoT ledger-based architecture to ensure access control on heterogeneous scenarios. This research applies conventional devices used on IoT networks, such as Arduino, Raspberry and Orange Pi boards. Finally, we perform performance evaluation focused on access control of IoT devices and on information propagation through peers on a private IoT network scenario.

Services provided by modern organizations are usually designed, deployed, and supported by large-scale IT infrastructures. In order to obtain the best performance out of these services, it is essential that organizations enforce rational practices for the management of the resources that compose their infrastructures. A common point in most guides and libraries of best practices for IT management - such as ITIL or COBIT - is the explicit concern with the risks related to IT activities. Proactively dealing with adverse and favorable events that may arise during everyday operations might prevent, for example: delay on deployment of services, cost overrun in activities, predictable failures of handled resources, and, consequently, waste of money. Although important, risk management in practice usually lacks in automation and standardization in IT environments. Therefore, in this article, we introduce a framework to support the automation of some key steps of risk management. Our goal is to organize risk information related to IT activities providing support for decision making thus turning risk response planning simpler, faster, and more accurate. The proposed framework is targeted to workflow-based IT management systems. The fundamental approach is to learn from problems reported in the history of previously conducted workflows in order to estimate risks for future executions. We evaluated the applicability of the framework in two case studies both in IT related areas, namely: IT change management and IT project management. The results show how the framework is not only useful to speed up the risk assessment process, but also to assist the decision making of project managers and IT operators by organizing risk detailed information in a comprehensive way.

In the context of Information Technology (IT) project management, it is commonly accepted that the costs associated with support actions are strongly influenced by the effort spent during their development and test phases. Despite the importance of systematically characterizing and understanding this relationship, little has been done in this realm mainly due to the lack of proper mechanisms for both sharing information between IT project phases and learning from past experiences. To tackle this issue, we present a Bayesian model to perform support cost predictions based on data from software development and test phases. In addition, we present a qualitative and quantitative analysis of the model, in order to demonstrate its effectiveness and efficiency, and also discuss its potentialities and limitations.

Information Technology (IT) products and services provided by modern organizations are designed in projects that often involve large amount of resources (e.g., humans, hardware, and software). It is essential that organizations enforce rational practices for project management, in order to successfully conclude projects and avoid waste of substantial resources. In this context, Risk Management is fundamental to guarantee the accomplishment of project's objectives by dealing with adverse and favorable events. Although important, risk assessment in IT projects is usually performed by stakeholders in interviews and brainstorms which may be a very time/resource-consuming task. Therefore, in this paper, we introduce a solution to automate the risk assessment process, based on the history of previously conducted projects. Furthermore, comprehensive and interactive risk reports are proposed in order to ease the analysis of automatically generated reports. The results show that our solution is not only useful to speed the risk assessment process, but also to assist the decision making of project managers by organizing risk information according to the project structure.

Planning is a fundamental sub-process of the overarching Information Technology (IT) change management process, proposed by the Information Technology Infrastructure Library to help organizations to deploy and maintain IT services in an effective and efficient way. A major issue behind IT change planning and of special importance for the alignment of changes with business objectives/constraints - the adequate projection of which human resources to assign to change activities - has not been properly addressed in previous investigations. To fill this gap, in this paper we propose and analyze novel strategies for planning the assignment of human resources to change activities. These strategies explore different ways to prioritize humans to activities (i.e., from the most to the less efficient or proficient humans), and to rank/cluster the activities that should be analyzed first. The novel strategies have been experimentally evaluated through ChangeAdvisor, a prototypical implementation of a decision support system that helps IT administrators in the task of understanding the trade-offs between alternative change designs.

In order to deal with failures in the deployment of IT changes and to always leave IT infrastructures into consistent states, we proposed in a previous work, a solution to automate the generation of rollback plans in IT change management systems. The solution was based on a mechanism that treats Requests for Change (RFC) (or parts of them) as a single atomic transaction. In this work, we extend our previous investigation and present more flexible and fine grained treatment of failures. The paper first presents extensions to our conceptual model in order (i) to give IT operators some flexibility in defining rollback actions, for example, by allowing the rollback plan to not only be a reversed change plan; and (ii) to execute different recovery activities depending on the cause and location of a problem. The paper then focuses on a refined manner to handle and treat failures in change deployments. We follow the ITIL version 3 best practises which suggest that, depending on the RFC context, the human operator can classify activities as reversible or irreversible. Such classification allows change management systems to automatically generate more accurate remediation plans. The proposal takes into account not only a precise way to define how rollback plans will be generated, but also an intuitive method enabling the operator to define compensation activities in order to complete the RFC successfully, even with the occurrence of failures. To prove the concept and technical feasibility, we have materialized our solution in the CHANGELEDGE prototype that, using elements of the Business Process Execution Language (BPEL), is able to generate correct remediation plans to handle and treat failures in IT change management systems.

The main goal of change management is to ensure that standardized methods and procedures are used for the efficient and prompt handling of changes in IT systems, in order to minimize change-related incidents and service-delivery disruption. To meet this goal, it is of paramount importance reusing the experience acquired from previous changes in the design of subsequent ones. Two distinct approaches may be usefully combined to this end. In a top-down approach, IT operators may manually design change templates based on the knowledge owned/acquired in the past. Considering a reverse, bottom-up perspective, these templates could be discovered from past execution traces gathered from IT provisioning tools. While the former has been satisfactorily explored in previous investigations, the latter - despite its undeniable potential to result in accurate templates in a reduced time scale - has not been subject of research, as far as the authors are aware of, by the service operations and management community. To fill in this gap, this paper proposes a solution, inspired on process mining techniques, to discover change templates from past changes. The solution is analyzed through a prototypical implementation of a change template miner subsystem called CHANGEMINER, and a set of experiments based on a real-life scenario.