{"title":"A formal security proof for the ZRTP Protocol","authors":"Riccardo Bresciani, A. Butterfield","doi":"10.1109/ICITST.2009.5402595","DOIUrl":"https://doi.org/10.1109/ICITST.2009.5402595","url":null,"abstract":"When some agents want to communicate through a media stream (for example voice or video), the Real Time Protocol (RTP) is used. This protocol does not provide encryption, so it is necessary to use Secure RTP (SRTP) to secure the communication. In order for this to work, the agents need to agree on key material and ZRTP provides them with a procedure to perform this task: it is a key agreement protocol, which relies on a Diffie-Hellman exchange to generate SRTP session parameters, providing confidentiality and protecting against Man-in-the-Middle attacks even without a public key infrastructure or endpoint certificates. This is an analysis of the protocol performed with ProVerif, which tests security properties of ZRTP; in order to perform the analysis, the protocol has been modeled in the applied π-calculus.","PeriodicalId":251169,"journal":{"name":"2009 International Conference for Internet Technology and Secured Transactions, (ICITST)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2009-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130114300","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Information security management in e-learning","authors":"N. M. Alwi, I. Fan","doi":"10.1109/ICITST.2009.5402507","DOIUrl":"https://doi.org/10.1109/ICITST.2009.5402507","url":null,"abstract":"E-learning is a new method of learning and it depends on the Internet in its execution. Internet has become the venue for a new set of illegal activities and E-learning environment is now exposed to the threats. In this paper the benefit and growth of e-learning is elaborated. This paper discusses the security elements needed in e-learning. In addition, explains the situation and existing research on security in e-learning. Information security management is suggested to contribute in preparing the secured e-learning environment.","PeriodicalId":251169,"journal":{"name":"2009 International Conference for Internet Technology and Secured Transactions, (ICITST)","volume":"72 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2009-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122361476","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"A semantic-based conversational agent framework","authors":"K. O'Shea, Z. Bandar, Keeley A. Crockett","doi":"10.1109/ICITST.2009.5402582","DOIUrl":"https://doi.org/10.1109/ICITST.2009.5402582","url":null,"abstract":"This paper focuses on the implementation of a novel semantic-based Conversational Agent (CA) framework. Traditional CA frameworks interpret scripts consisting of structural patterns of sentences. User input is matched against such patterns and an associated response is sent as output. This technique, which takes into account solely surface information, that is, the structural form of a sentence, requires the scripter to anticipate the inordinate ways that a user may send input. This is a tiresome and time-consuming process. As such, a semantic-based CA that interprets scripts consisting of natural language sentences will alleviate such burden. Using a pre-determined, domain-specific scenario, the CA was evaluated by participants indicating promising results.","PeriodicalId":251169,"journal":{"name":"2009 International Conference for Internet Technology and Secured Transactions, (ICITST)","volume":"58 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2009-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130988274","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Finding an effective and secured information system in e-commerce environment","authors":"Mohammad Rahman, K. Rezaul, Aliar Hossain","doi":"10.1109/ICITST.2009.5402521","DOIUrl":"https://doi.org/10.1109/ICITST.2009.5402521","url":null,"abstract":"E-commerce is growing at an exceptional rate as more organizations are offering their goods and services on-line every day. Importantly, this growth is being matched by the number of people gaining access to the Internet in a variety of ways. E-commerce offers opportunities as well as threats. Information is crucial for any organization especially in the e-market. A key negative perception centres on the security involved in internet practice and electronics payments systems. The lack of an effective and trusted payment system that can be used in combination with on-line shopping has been limiting factor in the growth of internet sales. Consumers are hesitant to provide personal information, including credit card details, over the internet because of high perception of risk and concerns with privacy. Negative perceptions are then compounded and reinforced by massive media exposure of Internet security incidents. From a lack of positive experiences and negative perceptions, many consumers still lack the necessary trust in on-line merchants and Internet security procedures and continue to use the web to simply surf. Establishment of Information Security System can minimize the threats and risks. The paper provides an overview of electronic commerce and the impact of risk on on-line shopping environment. Due to the growth and potential of on-line shopping and the lack of academic based research on internet-related consumer behaviour, there is a tremendous need for independent, academic investigation into the behaviour and perceptions of on-line consumers. The present study collected data on the perceptions of risk in relation to information security from a sample size of 624, which include both online and traditional shoppers. The data were then analyzed in order to investigate the current trends of consumer behaviour when making transactions in e-commerce environment.","PeriodicalId":251169,"journal":{"name":"2009 International Conference for Internet Technology and Secured Transactions, (ICITST)","volume":"30 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2009-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126925369","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"RFID lightweight mutual authentication using shrinking generator","authors":"Mouza Ahmad Bani Shemaili, C. Yeun, M. Zemerly","doi":"10.1109/ICITST.2009.5402511","DOIUrl":"https://doi.org/10.1109/ICITST.2009.5402511","url":null,"abstract":"The RFID technology is recently predicted to spread in most of our daily lives. However, it is very much vulnerable as it faces some major security challenges and threats. Thus, RFID technology also provides the solutions for the security threats concerned with security, privacy, and authentication. This paper not only addresses security privacy and authentication but also proposes a lightweight mutual authentication suitable to be implemented for passive RFID tag. The proposed protocol is simple, low cost and low power consumption as well as efficient computation since it uses the simple and low cost Shrinking Generator that can be considered an alternative for the use of the One Time Pad algorithm.","PeriodicalId":251169,"journal":{"name":"2009 International Conference for Internet Technology and Secured Transactions, (ICITST)","volume":"15 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2009-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115610828","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
T. Kirkham, I. Dahn, D. Chadwick, M. Santos, Sandra Winfield
{"title":"Aggregating policies in user centric, real-time and distributed applications","authors":"T. Kirkham, I. Dahn, D. Chadwick, M. Santos, Sandra Winfield","doi":"10.1109/ICITST.2009.5402553","DOIUrl":"https://doi.org/10.1109/ICITST.2009.5402553","url":null,"abstract":"Securing individual data objects using sticky policies in trusted networks is essential in user centric distributing computing applications. However aggregation of data objects presents a challenge in terms of sticky policy integrity for the new object. A possible solution is based on a mathematical merger of sticky polices associated with all aggregated data objects that respects all the individual policy rules in a new sticky policy for the data object. Whilst another approach is an aggregation using the policy enforcement framework of the trusted network to bypass the sticky rules. This process is enabled by the use of meta-polices that are introduced in this paper that explores the application both approaches in a employability demonstrator from the EU Framework 7 project TAS3 (Trusted Architecture for Securely Shared Services).","PeriodicalId":251169,"journal":{"name":"2009 International Conference for Internet Technology and Secured Transactions, (ICITST)","volume":"122 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2009-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122751789","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Vincent Hourdin, J. Tigli, S. Lavirotte, G. Rey, M. Riveill
{"title":"Context-sensitive authorization for asynchronous communications","authors":"Vincent Hourdin, J. Tigli, S. Lavirotte, G. Rey, M. Riveill","doi":"10.1109/ICITST.2009.5402550","DOIUrl":"https://doi.org/10.1109/ICITST.2009.5402550","url":null,"abstract":"Main requirement of recent computing environments, like mobile and then ubiquitous computing, is to adapt applications to context. On the other hand, access control generally trust users once they have authenticated, despite the fact that they may reach unauthorized situations. We analyse how dynamic information can be used to improve security in the authorization process, especially in the case of asynchronous communications, like messaging or eventing. We experiment and validate our approach using context as an authorization factor for eventing in Web service for device (like UPnP or DPWS).","PeriodicalId":251169,"journal":{"name":"2009 International Conference for Internet Technology and Secured Transactions, (ICITST)","volume":"35 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2009-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121854335","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Power games in RFID security","authors":"A. Juels","doi":"10.1109/ICITST.2009.5402509","DOIUrl":"https://doi.org/10.1109/ICITST.2009.5402509","url":null,"abstract":"Power consumption is a key element in the design of secure RFID systems. It is a major resource constraint for cryptographic primitives, a side-channel that can expose sensitive data, and a determinant of read ranges for tags. While protocol design for high-powered, networked computing devices can conveniently disregard power considerations, energy consumption is an unavoidable dimension of RFID-tag security.","PeriodicalId":251169,"journal":{"name":"2009 International Conference for Internet Technology and Secured Transactions, (ICITST)","volume":"39 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2009-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132795486","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"A research on the establishment of enterprise information architecture","authors":"Tsang-Hung Wu, Shyh-Chang Liu","doi":"10.1109/ICITST.2009.5402556","DOIUrl":"https://doi.org/10.1109/ICITST.2009.5402556","url":null,"abstract":"Following the progress of technology in recent years, enterprise is paying more and more attention on the topic of information security. However, the scope covered by information security is extremely broad. In fact it is almost impossible to achieve 100% security. In addition, this will consume extremely large enterprise resource. The most important is to base on the overall operation method of the enterprise to establish more complete information flow and architecture with overall planning vision. This paper will first discuss on ITIL, ISO27001 risk management and commonly seen information protection technology, and how to establish the enterprise information.","PeriodicalId":251169,"journal":{"name":"2009 International Conference for Internet Technology and Secured Transactions, (ICITST)","volume":"12 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2009-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133472137","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Hajer Ben Mahmoud Dammak, R. Ketata, T. Romdhane, S. Ahmed
{"title":"Modeling Quality Management System: A multi-agent approach","authors":"Hajer Ben Mahmoud Dammak, R. Ketata, T. Romdhane, S. Ahmed","doi":"10.1109/ICITST.2009.5402578","DOIUrl":"https://doi.org/10.1109/ICITST.2009.5402578","url":null,"abstract":"In this paper, a multi-agent approach modeled by the UML (Unified Modeling Language) is used to solve the piloting problem of Quality Management System QMS. Indeed, this multi-agent modeling of QMS proposes the use a micro framework via a dynamic diagram and macro through a static diagram for the agents development. From this modeling, an information system can be implemented in order to ensure the QMS conformity and effectiveness to the requirements of the series standards ISO 9000, ISO 9001, ISO 9004. In this context, an industrial company example will be proposed and the improvement prospects will be illustrated there.","PeriodicalId":251169,"journal":{"name":"2009 International Conference for Internet Technology and Secured Transactions, (ICITST)","volume":"11 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2009-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133563328","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}