Secure Application Development Research Articles

The shift to Cloud Computing: The impact of disruptive technology on the enterprise software business ecosystem

The rapid diffusion of Cloud Computing influences the way enterprise software is developed, distributed, and implemented. This uptake of Cloud Computing has profound implications for the IT industry and related industries, as it does not only affect the vendors' business models but also the other actors in the business ecosystem. This paper addresses how the value network of enterprise software solutions changes as a consequence of shifting from on-premise to Cloud-based technology. Based on a literature study and fifteen expert interviews in three case studies, we present a generic value network for Cloud-based enterprise software. We analysed the impact of the shift to Cloud-based enterprise software for each stakeholder in the network. In particular, we found that the role of the consultative partner is more focussed on business process management and that technical consulting remains relevant due to IT security, data migration, interface definition, customizing, and mobile application development. The vendor becomes a service provider and acts in several roles. The emerging technological platform offers opportunities for external developers, partners, and customers. The Cloud consumer can concentrate on his core business, but needs to consider applying best practices processes when receiving public Cloud services.

Security of Cooperative Intelligent Transport Systems: Standards, Threats Analysis and Cryptographic Countermeasures

Due to the growing number of vehicles on the roads worldwide, road traffic accidents are currently recognized as a major public safety problem. In this context, connected vehicles are considered as the key enabling technology to improve road safety and to foster the emergence of next generation cooperative intelligent transport systems (ITS). Through the use of wireless communication technologies, the deployment of ITS will enable vehicles to autonomously communicate with other nearby vehicles and roadside infrastructures and will open the door for a wide range of novel road safety and driver assistive applications. However, connecting wireless-enabled vehicles to external entities can make ITS applications vulnerable to various security threats, thus impacting the safety of drivers. This article reviews the current research challenges and opportunities related to the development of secure and safe ITS applications. It first explores the architecture and main characteristics of ITS systems and surveys the key enabling standards and projects. Then, various ITS security threats are analyzed and classified, along with their corresponding cryptographic countermeasures. Finally, a detailed ITS safety application case study is analyzed and evaluated in light of the European ETSI TC ITS standard. An experimental test-bed is presented, and several elliptic curve digital signature algorithms (ECDSA) are benchmarked for signing and verifying ITS safety messages. To conclude, lessons learned, open research challenges and opportunities are discussed.

Information Interpretation Code For Providing Secure Data Integrity On Multi-Server Cloud Infrastructure

Data security is one of the biggest concerns in cloud computing environment. Although the advantages of storing data in cloud computing environment is extremely high, there arises a problem related to data missing. CyberLiveApp (CLA) supports secure application development between multiple users, even though cloud users distinguish their vision privileges during storing of data. But CyberLiveApp failed to integrate the system with certain cloud-based computing environments on multi-server. Environmental Decision Support Systems (EDSS) move away the technical load and focus mainly on decision-making activities. EDDS does not have a secure collaborative decision-making experience on cloud services. To integrate the security level for multi-server cloud infrastructure, Information Interpretation Code on Multi-Server (IICM-S) is proposed in this paper. To ensure the information with relevance to security on cloud-based computing environments, Information Interpretation Code (IIC) algorithm is initially developed. Thus, IIC guarantee that all information pertaining to cloud is in secured condition in order to prove the trustworthiness of data. In addition, the multi-sever cloud infrastructure in IIC provides access point for secure information recovery from cloud data server. The multi-server cloud infrastructure with IIC algorithm performs the recovery task on multi-server cloud infrastructure. The Multi-server Information (MI) scheme measures the integrity level with effective data recovery process. The integrity level on multi-server cloud infrastructure is ensured using two components, verifier and verify shifter. MI scheme proficiently check integrity using these two components so that not only the data integrity is provided as well as security is ensured in all cases using IICM-S. Experiment is conducted in the Cloudsim platform on the factors such as average integration time on multi-server, security level, recovery efficiency level.

WOLF: a Research Platform to Write NFC Secure Applications on Top of Multiple Secure Elements (With an Original SQL-Like Interface)

This article presents the WOLF (Wallet Open Library Framework) platform which supports an original interface for NFC developers called SE-QL . SE-QL is a SQL-like interface which eases and optimizes NFC secure application development in making the heterogeneity of the Secure Element (SE) transparent. SE implementation could be embedded (eSE) in the mobile device, or inside the SIM Card (UICC), or on-host software-based, or in the Cloud (e.g. through HCE); every SE implementation has its own interface(s) making NFC secure-application development extremely cumbersome and complex. Proposed SE-QL solves this problem. This article demonstrates the feasibility and attractiveness of our approach based upon an original high-level API.

Test Harness on a Preconditioned Conjugate Gradient Solver on GPUs: An Efficiency Analysis

The parallelization of numerical simulation algorithms, i.e., their adaptation to parallel processing architectures, is an aim to reach in order to hinder exorbitant execution times. The parallelism has been imposed at the level of processor architectures and graphics cards are now used for general-purpose calculation, also known as “General-Purpose computation on Graphics Processing Unit (GPGPU)”. The clear benefit is the excellent performance over price ratio. Besides hiding the low level programming, software engineering leads to a faster and more secure application development. This paper presents the real interest of using GPU processors to increase performance of larger problems which concern electrical machines simulation. Indeed, we show that our auto-generated code applied to several models allows achieving speedups of the order of 10 $\, \times \,$ .

Methods of dynamic verification of the code based on the interpretation of Petri nets

One of the topical problems in the development of secure applications is the improvement of the quality of the software systems with parallel-sequential code. The verification of a software project is able to solve this problem, subject to the construction of adequate models of functioning of applications and the use of qualitative methods of verification of parallel-sequential programming models. The article considers the methods of static and dynamic verification of applications. The structure of the model for verification was proposed to be build on the basis of an intermediate model that is a complete parse tree. The working model was formed as the control Petri net (SN) with stochastic elements that allowed simulating the functioning of application under different time and communication conditions, and allowed static and dynamic analysis of critical situations. While constructing the model we have implemented the control function of the verifier, which consisted in analysis of the effects of correction of defects in the code, which would help achieve the control of the verification of applications. The article contains the example of the practical implementation of these methods - a verification of the applications written in C ++.

Face detection of ubiquitous surveillance images for biometric security from an image enhancement perspective

Security methods based on biometrics have been gaining importance increasingly in the last few years due to recent advances in biometrics technology and its reliability and efficiency in real world applications. Also, several major security disasters that occurred in the last decade have given a new momentum to this research area. The successful development of biometric security applications cannot only minimise such threats but may also help in preventing them from happening on a global scale. Biometric security methods take into account humans’ unique physical or behavioural traits that help to identify them based on their intrinsic characteristics. However, there are a number of issues related to biometric security, in particular with regard to the poor visibility of the images produced by surveillance cameras that need to be addressed. In this paper, we address this issue by proposing an integrated image enhancement approach for face detection. The proposed approach is based on contrast enhancement and colour balancing methods. The contrast enhancement method is used to improve the contrast, while the colour balancing method helps to achieve a balanced colour. Importantly, in the colour balancing method, a new process for colour cast adjustment is introduced which relies on statistical calculation. It can adjust the colour cast and maintain the luminance of the whole image at the same level. We evaluate the performance of the proposed approach by applying three face detection methods (skin colour based face detection, feature based face detection and image based face detection) to surveillance images before and after enhancement using the proposed approach. The results show a significant improvement in face detection when the proposed approach was applied.

Next-Generation Applications on Cellular Networks: Trends, Challenges, and Solutions

Applications over cellular networks now range from operator–consumer applications (e.g., mobile television, voice-over-ip, video conferencing), peer-to-peer applications (e.g., instant messaging), machine-to-machine applications (e.g., data telemetry and automotive applications), mobile web services (e.g., music and video streaming), and social networking applications. The current approach for developing mobile applications appears to focus on utilizing template-based application-development kits provided by platform developers (e.g., Google's Android, Apple's iOS, or Nokia's Symbian) to capture application designs and install them on the runtime platforms through use of code generators tied to particular versions of the platform. It is still unclear as to how an application developer (or network operator) conceptualizes the features of a mobile application in a platform-independent way, identifies its utility and explores its impact on the user, or further refines the choice of technology, platform, and mobility/interactivity requirements. This paper attempts to offer some guidelines, based on recent research in the industry and academia in these areas, toward the design and development of successful mobile applications that can utilize the capabilities of the next generation of cellular networks. We provide an overview of the growing trends of the rich multimedia and real-time mobile applications, including the diversity of application types, their impact on the enterprise and consumer, their traffic volumes, and their load and communication patterns. In addition to the overall trend analysis, we also study the design choices that are to be made, and how they are realized, and also describe how the platforms (client and server) may be implemented. Additionally, we focus on mobile video applications according to their communication characteristics and their distinct demands on the cellular network. We also present an analysis of device and network application programming interfaces (API) that form the basic building blocks for efficient and secure mobile application development of the future.

A Middleware Architecture for Wireless Sensor Networks Using Secure Web Services

This paper proposes a service oriented middleware architecture for wireless sensor networks (WSNs) with security requirements. The web services standards XML, SOAP and WSDL are used for network communication. For the WSN security the WS-Security specification is applied, using cryptography and authentication for the data traffic. A prototype developed in Java language tests the proposed architecture. The results obtained show the correct functioning of the middleware, which facilitates the development of secure applications for WSNs.

Understanding Android Security

Google's Android platform is a widely anticipated open source operating system for mobile phones. This article describes Android's security model and attempts to unmask the complexity of secure application development. The authors conclude by identifying lessons and opportunities for future enhancements.

Looking for Love in All the Wrong Places: A Security Case Study on Online Identity Theft

AbstractInformation systems are only as strong as their weakest elements. A truly secure environment requires effective network security, secure application development guidelines, well written policies and procedures, and a strong user educational component to account for the many potential attacks that can occur on a given day. In this case, the authors cover failed aspects of networking security, Web development, policies and procedures, as well as inadequate user education to illustrate how easily an attacker can glean critical business data from an organization via simple techniques known to the hacking community. This case demonstrates that even with basic physical security in place, social engineering practices, combined with well-known hacking techniques, can thwart an organization’s security procedures and practices. In our discussion, we analyze threats to Web servers and Web services using a sample business: MrLuv’s Online Dating Service. We also provide a scenario analysis to forensically expl...

Model Driven Development of Security Aspects

The development of security-critical large-scale distributed software systems is a difficult and error prone process. As we learnt from practical experiences, it is especially difficult to manually define security policies, for example for access control. A human security administrator is not able to cope with the high complexity of the interactions of the application and the low level, platform specific security policy. Therefore, a new approach is needed to ease the definition of appropriate security policies. This paper shows how realisation of security aspects of a system can be automated to a great extend by applying model-driven software development techniques not only on functional properties. In the presented approach, UML models of the application's functional properties are flexibly augmented with security relevant information. Together with a high level security policy defined by the security administrator, this augmented functional model is then used in an automatic model transformation to generate the platform specific security policy. With this approach, which supports the separation of concerns in model based software engineering, we can automatically generate security-critical applications for different middleware platforms like SecureMiddleware, which is an extended implementation of the CORBA Component Model with improved support for non functional properties like security. The concepts, platforms and tools presented in the paper are currently used for the development of several large-scale and secure applications, for example for building a Virtual Air-Space Management System with strong security requirements.

Business-driven application security: From modeling to managing secure applications

Business-driven development and management of secure applications and solutions is emerging as a key requirement in the realization of an on demand enterprise. In a given enterprise, individuals acting in various roles contribute to the modeling, development, deployment, and management of the security aspects of a business application. We look at the business-application life cycle and propose a policy-driven approach overlaid on a model-driven paradigm for addressing security requirements. Our approach suggests that security policies are to be modeled using policies and rule templates associated with business processes and models, designed and implemented through infrastructure-managed or application-managed environments based on modeled artifacts, deployed into an infrastructure and potentially customized to meet the security requirements of the consumer, and monitored and managed to reflect a consistent set of policies across the enterprise and all layers of its application infrastructure. We use a pragmatic approach to identify intersection points between the platform-independent modeling of security policies and their concrete articulation and enforcement. This approach offers a way to manage and monitor systems behavior for adherence and compliance to policies. Monitoring may be enabled through both information technology (IT) and business dashboards. Systematic approaches to connect business artifacts to implementation artifacts help implement business policies in system implementations. Best practices and security usage patterns influence the design of reusable and customizable templates. Because interoperability and portability are important in service-oriented architecture (SOA) environments, we list enhancements to standards (e.g., Business Process Execution Language [BPEL], Unified Modeling Language™ [UML®]) that must be addressed to achieve an effective life cycle.

Development of secure applications using small medical institutions

The synthesis and biological evaluation of three series of 6-phosphogluconate (6PG) analogues is described. (2R)-2-Methyl-4,5-dideoxy, (2R)-2-methyl-4-deoxy and 2,4-dideoxy analogues of 6PG were tested as inhibitors of 6-phosphogluconate dehydrogenase (6PGDH) from sheep liver and also Trypanosoma brucei where the enzyme is a validated drug target. Among the three series of analogues, seven compounds were found to competitively inhibit 6PGDH from T. brucei and sheep liver enzymes at micromolar concentrations. Six inhibitors belong to the (2R)-2-methyl-4-deoxy series (6, 8, 10, 12, 21, 24) and one is a (2R)-2-methyl-4,5-dideoxy analogue (29b). The 2,4-dideoxy analogues of 6PG did not inhibit both enzymes. The trypanocidal effect of the compounds was also evaluated in vitro against T. brucei rhodesiense as well as other related trypanosomatid parasites (i.e., Trypanosoma cruzi and Leishmania donovani).