Journal of Mobile, Embedded and Distributed Systems

Security in Service Oriented Architectures – Volatility-Based Hedging Support System

Cristina Ana Toderoiu — 2015-09-30

The nature of today’s communication pattern has reverberated on all technical aspects, making them distributed in order to satisfy the need for immediate consumption of quality content. This is especially visible in the enterprise world, where latency reflects directly into financial results and, potentially, the survival of specific entities that are in tight competition. As people has discovered that by intertwining their thoughts through the means of social media is beneficial, enterprises have evolved towards a similar direction, of communicating with each other using services. Securing such Service Oriented Architectures presents a series of concerns, which are the main topic of the following paper.

Encryption and Decryption of Messages on Android using NFC Tags

Andrei Dragan — 2015-09-30

Working with NFC technology and mobile devices brings a faster and more secure way of doing things like giving out contact information, automating certain tasks or transmitting data, as easy as touching the two. What this article focuses on is the use of NFC tags on the Android platform to store random generated keys and automate the encryption and decryption of messages.

Location-Based Security for Resource Management

Iulia Grumaz — 2015-09-30

Considering that wireless technology has widespread and mobile devices gain every day even more popularity, security concerns are increasingly shifting to these areas and solutions that take into account the high mobility users have been empowered with, are in demand. Hence, the aim of this paper is to propose a model for securing and controlling access of mobile clients to resources by using reliable location information, which is available by the means of access points already existing in network infrastructure of most organizations. The key part of the architecture, obtaining a reliable location proof and checking its authenticity, is based on a scheme derived from a validated cryptographic protocol, the Diffie-Hellman key-exchange. The software implementation demonstrates how current technology stack (Java, Android and Bluetooth etc.) can be used to create a workable system and a series of conclusions is drawn at the end to highlight the model’s advantages, limitations and possible improvements.

Anonymous Mobile Payment Solution

Alhaj Ali Jalila — 2015-09-30

The evolution and increasing popularity of mobile handheld devices has led to the development of payment applications. The global acceptance of mobile payments is hindered by security and privacy concerns. One of the main problems evoked is the anonymity related with banking transactions. In this paper I propose a new secured architecture for mobile banking. Anonymity and privacy protection are the measures to be enhanced in order to satisfy people’s current needs. The banking platform must provide the highest level of security for messages exchanged between bank and the customer.

Ensuring Privacy in the Android OS by Hooking Methods in Its API

Andrei Stefan Constantinescu — 2015-09-30

The paper presents a mean to ensure security and privacy on Android devices available at the moment by applying a need to know principle for information that the installed applications can access. The presented method requires root access and an Open Source framework that allows hooking functions in the Android system, called Xposed, to be installed.

Security System for Mobile Voting with Biometrics

Laurentiu Marinescu — 2015-09-30

For centuries, voting has been a democratic right and way to choose our politicians. Nowadays, the voting process became a major issue in order to avoid crucial vulnerabilities like multiple voting, missing ballot papers, electoral fraud and miscount votes in an election.

To prevent those leaks in our current voting system and to improve other factors like time-consuming and reducing cost of resources, I decided to implement a secured mobile voting system on android.

In today’s era, the number of people that possess a smart-phone is larger and larger and also the advanced stage of technology can concur to a reliable solution for voting.

The architecture of this system will contain the mobile application that need to be installed on a mobile device, also will contain a server to compute multiple operations (face detection, face recognition and matching the face with the existing ones, matching unique id of the smart-phone with the one stored in database based on user personal identification number) and a server database. Firstly, an introduction about the subject and system is presented. Problem formulation will contain a research about this topic. Solution of the problem is presented in four subsections: architecture of the system, implementation, face recognition verifier and other solutions.

Securing a REST Web Service

Cristina Elena Popa — 2015-06-30

The aim of this paper is to present the key security requirements for Web Services. A set of security principles will be presented, as well as a study on how they can be implemented in order to ensure the service is available and non-compromised at any given time. Conclusions will be formulated at the end of this case study, based on the obtained results.

Analyzing and Specifying Security Requirements in Early Stages of Software Development Life Cycle

Elena Simona Coles — 2015-06-30

As of lately, more and more studies show that, at a global level, one of the most important causes of economic loss is unauthorized access to informatics resources. For example, a CSI/FBI Computer Crime and Security report from 2006 states that, in the top identified causes for economic loss in the USA, unauthorized access to informatics resources takes second place (Gordon et. al., 2006). Without a doubt, given the accelerated growth of software industry in the present, this need of security should be taken into account in Romania as a top priority. At the moment, in the requirements extraction phase from the software development life cycle, importance is given only to functional requirements. Thus appears the problem of identifying adequate solutions for treating non-functional requirements, where security requirements are included.

Reverse Engineering Malicious Applications

Ioan Cristian Iacob — 2015-06-30

Detecting new and unknown malware is a major challenge in today’s software. Security profession. A lot of approaches for the detection of malware using data mining techniques have already been proposed. Majority of the works used static features of malware. However, static detection methods fall short of detecting present day complex malware. Although some researchers proposed dynamic detection methods, the methods did not use all the malware features. In this work, an approach for the detection of new and unknown malware was proposed and implemented. Each sample was reverse engineered for analyzing its effect on the operating environment and to extract the static and behavioral features.

Digital Forensics Capabilities in an Open Source Framework

Cosmin Bubulean — 2015-06-30

This article focus to establish a new perspective about digital forensics and how this technology could be used by more and more people. Nowadays, this term is not so popular between regular computer users. They don’t know what digital forensics is and how could they take advantage of this new technology. The tools available on the market are designated and used especially for legal authorities all over the world. Most of them are a company solution of the problem, premium software, and the development facilities are private, but they offer support and trainings that come with a price. But for a regular user this isn’t very handy, because this software comes with high prices, or couldn’t be used at all, due to the fact that for a few products only the law enforcements units have this right. However, open-source solutions have now a rapid development, and the developer community behind them is a big plus. DDF – Digital Forensics Framework is an open-source framework, having great capabilities that empower a regular user with great investigations features.

Single Page Web Applications Security

Bogdan Beda — 2015-06-30

With the constant spread of internet access, the world of software is constantly transforming product shapes into services delivered via web browsers. Modern next generation web applications change the way browsers and users interact with servers. A lot of word scale services have already been delivered by top companies as Single Page Applications. Moving services online poses a big attention towards data protection and web application security. Single Page Application are exposed to server-side web applications security in a new way. Also, having application logic being executed by untrusted client environment requires close attention on client application security. Single Page Applications are vulnerable to the same security threads as server-side web application thus not making them less secure. Defending techniques can be easily adapted to guard against hacker attacks.

Software Tools for Source Code Analysis

Alexandru Grosu — 2015-06-30

This article aims to look at the risks derived from vulnerabilities introduced by the source-code and present the means to detect them. The software tools that are often used in such situations are called analyzers and can be categorized in static and dynamic analyzers. This article will present the main advantages and disadvantages of each software tool used and subsequently show the results and a comparison between these utilities. Finally, conclusions will be drawn explaining how source code introduced vulnerabilities can be handled and avoided.

Implementing Security in a Vulnerable CRM

Alexandru Valentin Besciu — 2015-03-30

This paper work objective is to scan and analyze a web application developed in early 2013 by the author of this paperwork. The application has been improved constantly since then, but without having a security plan included. Unfortunately the application arrived at a point where the security isn’t optional anymore and it needs to be improved. In order to do this I scanned the web application files with Acunetix Web Vulnerabilities Scanner. After the analysis the results pointed which vulnerabilities the application has and how to fix them. After I had fixed the vulnerabilities I rescanned the application to see if there were any others which appeared because of the new code. After the scanning the results were good, Acunetix WVS showing only notices.

Banking Software Applications Security

Ioan Alexandru Bubu — 2015-03-30

Computer software products are among the most complex artifacts, if not the most complex artifacts mankind has created. Securing those artifacts against intelligent attackers who try to exploit flaws in software design and construct is a great challenge too.

The purpose of this paper is to introduce a secure alternative to banking software applications that are currently in use. This new application aims to cover most of the well-known vulnerabilities that plague the majority of current software.

First we will take a quick look at current security methods that are in use, and a few known vulnerabilities. After this, we will discuss the security measures implemented in my application, and finally, we will the results of implementing them.

Smart Waste Management using Internet of Things Architecture

Alexandru Costin Avram — 2015-03-30

This paper showcases a potential design for an Internet of Things gateway that can be used to provide a framework for a Smart Waste Management System. The advantage that this solution gives to the problem of collecting data, processing it and outputting the result action is provided by the protocols used, adapted from technology that has proven itself mature. Protocols like IPv6, HTTP, SSL are synonymous today with the Internet and adapting them to the nature of the embedded computing in the Internet of Things can build upon previous experience.

Secure Applications Integration with Apache Camel

Sorin Popa — 2015-03-30

Often, applications from a company need to collaborate by exchanging information with each other to support existing business processes. In this paper I present basic concepts about integration applications with Apache Camel and make a demonstration of encrypting messages with Camel components.

Biometric Security - Fingerprint Recognition System

Alexandra Emanuela Vacarus — 2015-03-30

The paper presents an application, FingerTouch that provides a secure method of storing usernames and passwords for different types of accounts by using biometric fingerprint authentication. Recent developments in the smartphone area regarding fingerprint authentication on mobile devices is discussed. The purpose of the application and the technologies that were used in the development are described. The features, architecture and implementation of the application are analyzed.

Securing SharePoint Server with Windows Azure Multi-Factor Authentication

Petru Radu Narita — 2015-03-30

In today’s world, people are used to be able to connect anywhere at any time. Users can access their applications whenever they need, with any device. Stealing, phishing or key logging a password becomes easy doable for professional hackers. Many customers already use multi-factor authentication systems to protect their data and applications. However, carrying around tokens or installing software or certificates, can become a headache for both IT and users. This article talks about Windows Azure Multi-Factor Authentication – a Microsoft solution for adding a second factor of authentication using something that users nowadays already have at hand, their phone – which I checked in a SharePoint Server 2013 on premise test environment.

Risk Assessment Model for Mobile Malware

George Stanescu — 2015-03-30

The mobile technology is considered to be the fastest-developing IT security area. Only in the last year security threats around mobile devices have reached new heights in terms of both quality and quantity. The speed of this development has made possible several types of security attacks that, until recently, were only possible on computers. In terms of the most targeted mobile operating systems, Android continues to be the most vulnerable, although new ways of strengthening its security model were introduced by Google. The aim of this article is to provide a model for assessing the risk of mobile infection with malware, starting from a statistical analysis of the permissions required by each application installed into the mobile system. The software implementation of this model will use the Android operating system and in order to do so, we will start by analyzing its permission-based security architecture. Furthermore, based on statistical data regarding the most dangerous permissions, we build the risk assessment model and, to prove its efficiency, we scan some of the most popular apps and interpret the results. To this end, we offer an overview of the strengths and weaknesses of this permission-based model and we also state a short conclusion regarding model’s efficiency.

Security in Electronic Payment Systems

Roxana Turcu — 2014-12-30

The payment security becomes fundamental in our days. Based on this statement I have decided to deepen this subject and to study the online payment systems and the connection between them. I have observed that this area becomes the hackers’ attraction and I have realized how important the security of the ecommerce is. Also I have done a research of the possible attacks and I have searched for the countermeasures of this attacks. The result of my research is my payment gateway solution presented in the following lines.

Multipurpose Platform for Electronic Currency System

Andreea Magdalena Dae — 2014-12-30

Nowadays, there are multiple solutions for exchanging electronic currencies which will most probably replace physical money. This paper presents a platform for electronic currency system implemented within a Java smart card for accessing different types of products or services. The user interacts with an “electronic currency bank” and with a merchant through a secure protocol.

PayPal Transactions Security

Razvan Toader — 2014-12-30

Recent threads to prominent organizations and companies have greatly increased the need for information security. Many measures have been designed and developed to guard against threats from outsider attacks. Technologies are actively implemented to prohibit such attacks that could actively prohibit rogue connections. In this paper, common vulnerabilities for PayPal transactions identified as well as solutions for defending against them.

Trust based secure information exchange between user and sensor node using authentication method and verified at each gateway node in wireless networks

V.SUNIL KUMAR vemula

Day to day usage of wireless network is increased rapidly. A wireless communication between user and sensor node may not be authenticated may be attacker is reside on gateway node and try to retrieve the confidential data from both parties and after hacking information force attacks. In this paper we proposed a new method of mutual authentication method using temporal credential values to protect from attacks. In our method user and sensor nodes must registered with gateway node before start communication and gateway node issue smart values to both user and sensor node with a period of validity. We have done cryptanalysis on earlier methods and we come to know that still there is a possibility of forcing attacks. At the end we discussed how our method is protecting from different attacks when compared with earlier method.

Survey on Performance and Energy Consumption of Fault Tolerance in Network on Chip

Naresh Kumar Reddy

Network on Chip is a communication subsystem, which has the logic for sending and receiving the data from different sources in a single IC, is adopting the technology of VLSI making it to be as compact as possible. However, the increasing probability of failures in NOC’s has been raising concern among the researchers due to large scale integration of components. In specific the issues of fault-tolerance, increase in length of global wires of NOC has to be addressed for on chip and multi core architectures. This survey presents a perspective on existing NOC Faulttolerant algorithm and a Corresponding distributed fault analysis strategy that encourages in observing the fault status of individual NoC components and their adjacent communication links. The analysis of the Fault-tolerant Network subjected to dynamic workloads for large scale applications is also equally important. This research paper mainly emphasizes on Fault tolerant NOC strategies summarizing over thirty research papers

EPIDEMEOLOGY OF CHEST INJURY IN LONG BONE FRACTURES IN ROAD TRAFFIC ACCIDENT CASES

RAJIB DEBNATH

In modern day trauma centres, chest injury directly accounts for 20-25% of deaths due to trauma; chest injury or its complication are a contributing factor in a further 25% of trauma deaths. Approximately 85% of all chest trauma can be managed without surgical intervention, the mainstay of management are supplemental oxygen, intercostals drainage, good physiotherapy and pain control.

Total 78 patients(62 males and 16 females) who met the inclusion and exclusion criteria between august 2014 and march 2015 were included in this study. History , general and local examination, xray (local injured area and chest), CT SCAN of chest was done. All patients evaluated at the time of presentation. Secondary outcome measured by operative procedure delay, preoperative, intra operative and post operative morbidity.

After analysis, we had 35% patients diagnosed as one or multiple type chest injuries those who have long bone fractures and 79% patients was managed without surgical intervention. The mainstay of treatment was supplement oxygen, intercostals drainage, good physiotherapy and pain control. 7% of all long bone fractures had severe chest injuries which was treated on emergency basis in the casualty. Whereas 13 patients(16%) had chest injuries which increases pre operative, intra operative and post operative complications and also increases hospital stay. Around 9%(7 patients) chest injuries leads to delay in operative procedure.

Proper examination of chest along with local examination of injured part in road traffic accident cases needed to diagnosis neglected or minor chest injuries which increases morbidity of the patient.

A Survey on Middleware Approaches for Distributed Real-Time Systems

Malihe Saghian

Nowadays distributed real-time systems are very common in different areas and have many applications. Increasing need to exchange information among distributed and heterogeneous applications, the need for faster development, simplicity of design and implementation, software reuse and coordination problems are the major factors that lead to the design and implementation of middleware architectures in this field. For this purpose, different Quality of Service parameters such as reliability, extendibility, low latency, etc. must be considered. The current survey shows the state of the art of the various researches in this domain by providing and discussing the architecture and the features of major middlewares for distributed real-time systems.

IoT – Internet of Things Architecture for Context Aware Sensors Data Processing in Waste Management Solution

Cristian Toma — 2014-12-30

Internet of Things (IoT) refers interconnectivity of different devices and its increasing reasons aim Cloud Computing Services development, interconnectivity among personal smart devices and other devices, and significant development of the applications operate with this kind of connections and data provided by such connections. The biggest role is played by the devices with measuring capabilities helping the understanding of the world around by humans analyzing data generated in new points by these instruments. Data are securely stored and processes to be a viable source for real-time decisions. The paper provides an overview of this new data acquisitions paradigm together with short presentations of the communication protocols can be implemented in IoT infrastructure. Also, a possible solution architecture is provided for waste management.

Diabetic non-ketotic hyperglycemia and the hemichorea-hemiballismus syndrome: a case report

banashree gogoi

Diabetic non-ketotic hyperglycemia and the

hemichorea-hemiballismus syndrome: a case report

Authors: BanashreeGogoi, ArunAjith

Department of Radiology, A J Institute Of Medical Sciences, Mangalore.

Abstract

Non-ketotic hyperglycemia induced hemichoreahemiballismus is a rare manifestation seen in diabetic patients. The patients presents with acute onset of involuntary movements. Imaging in these patients shows characteristic findings in the basal ganglia. We present a case of 74 year old male showing classical clinical and imaging features.

Keywords: Hemichorea-Hemisballismus, Non-ketotic hyperglycemia, MRI

CASE REPORT

A 74 year male patient presented with ten-day history of sudden onset abnormal involuntary movements involving upper limbs. Patient was a known case of type 2 diabetes mellitus for the past 10 years on treatment. No history of neurological disorders or other significant illness was elicited. On examination patient had involuntary movements involving the upper limbs more on left side. Other neurological examination was normal. Laboratory investigations showed mean plasma glucose level of 380 mg/dl with HbA1c value 10.5%. The calculated serum osmolality was 306 mosm/l. Urine examination was negative for ketones. Rest of the blood tests was normal with no obvious electrolyte imbalance. CT of the brain was performed to rule out stroke.CT brain showed hyperdensity in right putamen region .Later MRI brain of the patient was performed for further evaluation. MRI showed hyperintensity involving right putamen region on T1w images. This region was isointense on T2w and FLAIR images. No restriction was seen on DW/ADC images. There was no evidence of any blooming seen on SW images. Based on clinical presentation, laboratory investigations and MRI finding diagnosis of Non ketotichyperglycaemichemichorea-hemiballismus syndrome was made. Hyperglycemia was corrected by insulin therapy followed by treatment with oral hypoglycemic agents. Patient improved symptomatically and was later

discharged.

Figure 1: CT image showing hyperdensity in the right putamen

Figure 2 : T1 weighted image showing hyperintensity in the right putamen

Figure 3 :T2 weighted image and FLAIR showing no signal intensity

Figure 4: DWI and ADC images showing no evidence of diffusion restriction

Figure 5: SWI and PHASE images showing no “blooming”

DISCUSSION

Diabetic patients with non-ketotichyperglycaemia can present with a rare clinical syndrome characterized by hemichoreahemiballism¹.Bedwell, in the year 1960, first reported the association of Hemichorea-Hemisballismus with hyperglycemia². The exact mechanism of how non-ketotichyperglycaemiacauses focal neurological symptoms is unknown. One hypothesis is related to depletion of inhibitory neurotransmitter GABA, which is metabolized in the brain as an energy source in non-ketotichyperglycaemia . The deficiency of GABA in basal ganglia may lead to hemichorea – hemiballismus syndrome. Another hypothesis involves transient focal cerebral ischemia caused by hyperglycemia. Cerebral hypoperfusion may result from an increase in cerebrovascular resistance due to the higher brain water content during hyperglycemia or to a loss of flow regulation caused by impaired metabolism³. CT brain in these patients shows e/o striatal hyperdensity.MRI reveals striatum hyperintense on T1w image, hypo/isointenseon T2w image, lack of restriction on diffusion imagesand no abnormality on GRE image⁴. Imaging reveals abnormal signal in the putamen with or without the involvement of the globuspallidus and caudate nucleus. The onset of Hemichorea-Hemisballismus is commonly caused by abnormal signal in the contralateral basal ganglia. However, Couple of cases of Hemichorea-Hemisballismus with involvement of the ipsilateral basal ganglia has been reported⁵. Cause of the signal changes is controversial with calcification⁶and petechial haemorrhage⁷ initially was postulatedto be the cause. However, histopathology studies and follow up imaging do not favor the above-mentioned theories.Histopathological findings by stereotacticbiopsy of striatum have revealed gliotic brain tissue containingabundant gemistocytes. This has suggested that the hyperintensitiesin T1 could be due to the protein hydration layer inside the cytoplasm of the swollen gemistocytes^8,9. The imaging findings are usually reversible, but occasionally the signal changes may persist for years¹⁰. Patients improve immediately once the euglycemic treatment is instituted, however it may persist for a longer duration⁴.

Conclusion

Hemichoreahemiballism occurring in diabetes mellitus owing to non-ketotic hyperglycemia is a rather benign condition with a good prognostic outcome. Recognition of the characteristic clinicoradiological signs will help in prompt diagnosis, correct treatment and resolution of lesion in basal ganglia.

References

1. Sanfield JA, Finkel J, Lewis S, Rosen SG. Alternating choreoathetosis associated with uncontrolled diabetes mellitus and basal ganglia calcification. Diabetes Care 1986; 9(1):100–1.

2. Hawley JS, Weiner WJ. Hemiballismus: current concepts and review. Parkinsonism RelatDisord 2012; 18(2):125–129.

3. Duckrow RB, Beard DC, Brennan RW. Regional Cerebral blood flow decreases during hyperglycemia. Ann Neurol1985;17: 267–72.

4. Shan DE, Ho DM, Chang C, Pan HC, Teng MM. Hemichoreahemiballism: an explanation for MR signal changes. Am J Neuroradiol 1998; 19: 863–70.

5. Postuma RB, Lang AE. Hemiballism: revisiting a classic disorder. Lancet Neurol 2003; 2(11):661–668.

6. Midroni G, Willinsky R. Rapid postanoxic calcification of the basal ganglia. Neurology 1992; 42: 2144-6.

7. Chang MH, Chiang HT, Lai PH, et al. Putaminal petechial haemorrhage as the cause of chorea: a neuroimaging study. J NeurolNeurosurg Psychiatry 1997;63:300–3.

8. Abe K, Hasegawa H, Kobayashi Y, Fujimura H, Yorifuji S, Bitoh S. A gemistocytic astrocytoma demonstrated high intensity on MR images: protein hydration layer. Neuroradiology 1990;32:166–7.

9. Shan DE. Hemichorea-hemiballism associated with hyperintense putamen on T1-weighted MR images: an update and a hypothesis. ActaNeurol Taiwan 2004;13:170–7.

10. Shimomura J, Nozaki Y, Jamura K. Hemichorea-hemiballism associated with nonketotic hyperglycemia and presenting with unilateral hyperintensity of the putamen on MRI T1-weighted images: a case report. No To Shinkei 1995;47:557–61.

A Survey on Middleware Approaches for Distributed Real-Time Systems

Malihe Saghian — 2014-12-30

MODELLING MALWARE RESPONSE IN WIRELESS SENSOR NETWORKS USING STOCHASTIC CELLULAR AUTOMATA

Hassan Chizari — 2014-12-30

A model based on cellular automata to analyze malware propagation is enhanced to simulate malware response using self-propagating software updates. The model maintains the characteristics of wireless sensor networks while adding states and behavior. The simulation tests variable update sources and variable distances between infection and update source. The simulation results confirm that node density influences the propagation speed. In addition, using more updater nodes greatly increases the speed of recovery and significantly reduces death rate. Finally, attacks occurring further away from updater nodes take longer to detect and cause a greater impact.

Autoimmune Cyber Retaliation Supported by Visual Analytics

Mihai Gabriel Ionita — 2014-09-30

As the World Wide Web contains close to 500 exabytes, it is clear that securing it is a very important and difficult task. Security specialists and analysts are faced with challenges regarding the sheer quantity of data which has to be analyzed. As the quantity of data grows, automated analysis within a single piece of equipment is not feasible anymore. This is why security analysts are divided between a dozen of consoles from a dozen of pieces of equipment from different vendors, each with its own standards and rules for representing data. Unfortunately human operators cannot efficiently take decisions based on the output of a dozen consoles, each with a different data representation pattern. This is why the cognitive abilities of a human being to reason analytically have to be used. This can be offered to an operator only with the aid of an interactive visual experience on a single large console.

Reducing Costs between Sequential Backups

Alexandru Filote — 2014-06-30

This paper addresses the problem of costs between two sequential Backups, identifies the main reasons that create costs and the facts that influence these costs. For the problem used in this scenario are used two sequential backups Ti and Ti+1, where Ti and Ti+1 are created with a standard method of "Incremental Backup". In the second part, there are proposed solutions to reduce the costs, it is presented the impact of reduction of the costs and it is proposed a formula based on system configuration and the size of the file.

Cyber Defense Exercises and their Role in Cyber Warfare

Bogdan Alexandru Bratosin — 2014-06-30

The threat of cyber-attacks is increasing with the access to PC’s and Internet of a larger number of people around the world. Although the Internet provides a large number of advantages, it can also be used as a cyber-weapon in order to serve the interests of counties, political and economic groups or individual. The cyber-attacks of today are capable to disable the manufacturing of nuclear bombs of a country. Thus, there is an increasing demand for IT security specialists. Cyber-defense exercises (CDX) are by far the most complex and up to date methods of training the next generation of IT security specialists.

Enabling the Ciphering Indicator on Android

Felician Alecu — 2014-06-30

This paper exemplifies the use of AT commands to retrieve (and eventually override) the ciphering indicator status on Android by directly communicating with the phone modem. Curiously, his indicator is disabled by default both at operating system level and SIM card settings. By turning it on, the mobile handset will inform the user each time the communication becomes unencrypted, so a proper decision could be made just in time.

Policy Control Framework for IP based Online Video Surveillance Communications

Abhishek Mishra

There are around 15 million Surveillance camera installed in US and about 10% of it is IP based. This number of IP based surveillance is constantly growing as it gives an opportunity for smart real time surveillance. When the number of camera increases, it create a challenge to smart surveillance both in in terms of cost and efficiency. Cost- as to monitor so many views, there is a need to have enough people. Efficiency- due to overload of monitoring, there are chances that important tracking is missed. Intelligent surveillance helps in avoiding many such issues, however, there is a constant threat that due to lack of appropriate policy control framework, tracking may be impacted due to inherent network issues or human glitches. The paper presents a novel way, where a Policy control framework can be deployed for IP based Surveillance which will help in efficient monitoring

Rigorous design of moving sequencer atomic broadcast with malicious sequencer

Prateek Srivastava

This article investigates a mechanism to tolerate malicious nature of sequencer in moving sequencer based atomic broadcast at distributed systems. Various mechanisms are already given for moving sequencer based atomic broadcast like RMP [1], DTP [2], Pin Wheel [3] and mechanism proposed by [4]. But none of these mechanisms are efficient to tolerate different failure. Scholarly observation is that, these algorithms can tolerate only crash failure but not capable to tolerate omission or byzantine (malicious) failure. This work is an extension of [4]. In this work we have proposed a mechanism to tolerate byzantine failure (malicious nature) of sequencer in moving sequencer based atomic broadcast. For this we will consider [4] as an abstract model and design refined model that will tolerate malicious nature of sequencer. Since it relies on unicast broadcast hence it will introduce a very less number of messages in comparison to previous mechanisms [5].

We have used B [6] as formal technique for development of our model. B uses set theory as a modeling notation, refinements to represent system at different abstraction level. We have used ProB [7] model checker and animator for constraint based checking, discover errors due to invariant violation and deadlocks, thereby, validating the specifications.

Large user Transmission through Presence Cloud in Mobile Presence Server Architecture

M Harsha Vardhan — 2014-09-30

In present days, Mobile phones are very much attracted & maximum numbers of peoples are used very widely. And also usages of social networks are increased day by day, especially in mobile phones. Presence service of mobile is an important element of a social network application. The most significant action of a mobile presence service is to enable mobile user’s presence updates. Here, presence data means, it consists human’s current standing, user’s position or place (GPS location), Internet Protocol address & also updates of their online friends continuously. Frequent huge number of messages shared by presence servers which may lead to a buddy-list search problem in a large-scale mobile presence service. By this cause, searching operation is slow, communication cost is high and also search latency is high. For, overcome these types of problems, we propose an effective presence server architecture, called “Presence Cloud”, that enables mobile presence services even in large-scale social networks. Presence cloud arranges presence servers into a quorum-based server-to-server architecture, in order to provide effective presence searching. For approach of low search latency, one-hop caching strategy and directed buddy search are given a great support. Presence cloud is used to decrease the communication cost without compromising the search satisfaction level.

Secure management of the Intellectual Property in the Cloud

Octavian Mihai Machidon — 2014-09-30

The development of distributed computing systems – and especially cloud computing – has raised new vulnerability challenges regarding intellectual property (IP) generated by moving client’s data to the cloud infrastructure. Sensitive data is thus located at a remote facility, where clients are not granted full control and administrative access, generating critical concerns about the security of their intellectual property. This paper proposes an approach based on securing the IP in the cloud using reconfigurable hardware architectures – FPGA (Field Programmable Gate Array)-based System-on-Chip (SoC): IP elements being integrated in the programmable logic as IP cores, benefiting from the security and management of on-chip integrated IP modules. Also, by transcending the cloud computing model from macro- to micro-structures, integrated IP cores gain a higher degree of adaptability and can be easily interconnected using Network-on-Chip architectures.

OpenSSL vulnerabilities: the Heartbleed Bug and Cupid

Andrei-Sorin Jerca — 2014-09-30

In this paper we expose the importance of information security in today's context of fast technological evolution. Our main objective is to study one of the most recent security issue, discovered in the well-known OpenSSL cryptographic software library, named “the Heartbleed Bug”. This is a serious vulnerability of the Heartbeat Extension for the transport layer security protocols (TLS/DTLS) implementation in OpenSSL. This weakness allows remote attackers to obtain sensitive information (secret keys used for X.509 certificates, user credentials, instant messages, emails and other critical documents and communication) for applications such as web, email, instant messaging and some virtual private networks, which should be protected, under normal conditions, by the SSL/TLS encryption. Further, “Cupid”, shows that the bug can be used, with the same effect, against any device which implies Extensible Authentication Protocol (EAP) authentication mechanisms and a vulnerable version of OpenSSL. In addition we present guidelines, fixes and methods for preventing and managing possible attacks against vulnerable systems.

Techniques for Finding Vulnerabilities in Web Applications

Mihai Sandulescu — 2014-03-30

The current trend is to move everything on the Internet. Because a lot of companies store sensitive user information, security has become mandatory. Usually, software developers don’t follow some basic practices in order to secure their applications. This paper will present in the second chapter, the white-box, black-box and gray-box methods which can be used in order to test applications for possible vulnerabilities. It focuses on fuzz testing, which is a black-box testing method, presented in the third chapter. The fourth chapter presents the stages of a fuzzing test and in the final chapter, we show a basic practical example on how to use the Burp Suite^[8] fuzzer to find a vulnerability.

Secure Environment for Internet Browsing

Alexandru Tudor Gavrilescu — 2014-03-30

The Internet is used by a large proportion of the population, but unfortunately their education regarding the usage of the instruments available is poor, resulting in potential informational frauds, especially in the financial field.

In this article I have approached a few simple problems, yet very important and frequently occurred, regarding the secure environment for Internet browsing, proposing solutions for each of them. The security methods are: anti-phishing; the prevention of SQL injection, through the verification of the data given as input in the Address Bar and in the password fields and blocking the access in case of a potential threat; a virtual keyboard for preventing the recording of the keys pressed (key loggers); the backup of the credentials in a local file and the encryption of it to prevent unauthorized access, the decryption of the data is made using a unique encryption key, owned by the user.

Mobile Architecture for Distributed Brute-Force Attacks

Alexandru Marculescu — 2014-03-30

The focus of this paper centers on demonstrating that a distributed brute-force search of even a medium key-sized cryptosystem’s keyspace is possible even using the increasingly present mobile devices, although not quite practical yet, except for extremely well-funded groups. It is also an operational model that also aims to be an explicit documentation source for building a distributed architecture involving a server and any number of mobile agents, as well as highlighting both the advantages and the drawbacks of executing such an algorithm on smartphones.

Security Elements in Distributed Mobile Architectures

Vlad Petre — 2014-03-30

The mobile phones have emerged in order to overcome the basic need of human beings for being in contact one with each other. In time, the functionalities of such devices have evolved. And so, the users have started to use more and more online social services like Facebook™, Twitter™ or Foursquare™, in order to keep in touch more easily. Unfortunately, the current information exchange models come with a high risk when it comes to sensitive areas like keeping the users’ data private and protecting the intimacy of the users. The purpose of this paper is to make an audit of such a mobile distributed architecture – a real time location based mobile social network that aims at helping its users to remain in permanent contact with their beloved ones.

Protecting Stored Data on Android Devices

Raluca Alina Cojocaru — 2014-03-30

According to the latest statistics, the Android has become the world’s most popular operating system used for smartphones. Not only its popularity continues to increase, but also the number of malicious hackers who want to compromise mobile applications for their own gain. This paper reviews the protections offered by the Android Platform for storing application data, and provides means to enforce them.

Cardless Withdrawal System for Mobile Banking Applications

Calin Mihai Istrate — 2014-03-30

With the whole world going mobile and with the threats represented by third party mobile payments, the banks need to react and offer their clients innovative integrated solutions for payments and money transfer. Mobile banking applications are more and more used, and the possibilities to expand are still open.

A cardless withdrawal solution integrated in an already developed smartphone mobile banking application might just give an edge in the fight with other competitors. By using SMS technologies for sending money to other people the appeal of such an application will rise considerably and will attract more and more clients. It is very important to keep the mobile payment endorsers as clients of the bank and not some other provider.

Big Data Issues: Performance, Scalability, Availability

Laura Matei — 2014-03-30

Nowadays, Big Data is probably one of the most discussed topics not only in the area of data analysis, but, I believe, in the whole realm of information technology. The simple typing of the words „big data” on an online search engine like Google will retrieve approximately 1,660,000,000 results. Having such a buzz gathered around this term, I could not help but wonder what this phenomenon means.

The ever greater portion that the combination of Internet, Cloud Computing and mobile devices has been occupying in our lives, lead to an ever increasing amount of data that must be captured, communicated, aggregated, stored, and analyzed. These sets of data that we are generating are called Big Data.

Securing Web Services using Service Token Security

Stelian Dumitra — 2014-06-30

Web services are distributed components that enable interaction of software componentsacross organizational boundaries. The main advantages of web services are related to the flexibility and versatility: they support a variety of architectures and are independent of platforms and models. Also, they can expose valuable data, applications and systems of organizations to a variety of external threats. Securing web services is one of the most important topics related to them. This paper describes the core web services specifications, the top threats facing web services and the security fundamentals. At the end of the paper is presented a custom authentication and authorization model (brokered authentication) to ensure a robust protection, a model that shows how to authenticate and authorize callers to perform operations and how to access resources. This model uses the following frameworks/standards: Windows Identity Foundation (WIF) to apply the principles of claims-based identity, Windows Communication Foundation (WCF), to develop services/client services and integrate with WIF, and Service Token Security (STS), to issue security tokens.

The conclusions and the future proposed developments are presented in the end of the paper.

Energy-Saving Strategies by Extending Unavailability Interval Approach for Multiple Traffic Classes in IEEE 802.16e

Chinmaya Misra — 2014-06-30

IEEE 802.16e standard have been designed for both delay sensitive and delay tolerant applications. This paper presents energy-saving strategies by extending unavailability interval for multiple power saving classes simultaneously. The proposed model allows mobile stations to dynamically adopt multiple sleep mode operation or multiple partial sleep mode operation based on the buffer status of power saving class I and II. We set up partial sleep interrupt function which decides whether to stay in multiple partial sleep state or busy state to enhance the response time in real time traffic. Various performance indices of the system are presented. A cost model is formulated to determine the optimal values of various parameters at minimum cost using quadratic fit search method. It is shown numerically that the proposed model improves the system performance efficiently.

Implementing Mobile Applications for Virtual Exhibitions using Augmented Reality

Cristian Ciurea — 2014-09-30

The purpose of this article is to present the possibility of implementing a mobile application for virtual exhibitions. Nowadays, the history and art consumers have available web expositions, but compared to personal computers, the mobile smart devices provide a huge portability and very fast internet access. Sending the history/culture/art in this way is a step forward and could mean a scope extension. Also implementing such mobile applications in the field of history/culture/art could mean a helpful tool in education. The paper describes the mobile augmented reality systems and two different existing applications used in museums, in order to reveal the advantages of implementing mobile applications in the cultural field.

WPA/WPA2 Password Security Testing using Graphics Processing Units

Sorin Andrei Visan — 2013-12-30

This thesis focuses on the testing of WPA/WPA 2 password strength. Recently, due to progress in calculation power and technology, new factors must be taken into account when choosing a WPA/WPA2 secure password. A study regarding the security of the current deployed password is reported here.

Harnessing the computational power of a single and old generation GPU (NVIDIA 610M released in December 2011), we have accelerated the process of recovering a password up to 3 times faster than in the case of using only our CPUs power.

We have come to the conclusion that using a modern GPU (mid-end class), the password recovery time could be reduced up to 10 times or even much more faster when using a more elaborate solution such as a GPU cluster service/distributed work between multiple GPUs. This fact should raise an alarm signal to the community as to the way users pick their passwords, as passwords are becoming more and more unsecure as greater calculation power becomes available.