http://emamispnu.persiangig.com/Projects/Cloud%20Computing/science_2.pdf

Review: A survey on security issues in service delivery models of cloud computing

Gigantically comprehensive and carefully researched, Security Engineering makes it clear just how difficult it is to protect information systems from corruption, eavesdropping, unauthorized use, and general malice. Better, Ross Anderson offers a lot of thoughts on how information can be made more secure (though probably not absolutely secure, at least not forever) with the help of both technologies and management strategies. His work makes fascinating reading and will no doubt inspire considerable doubt--fear is probably a better choice of words--in anyone with information to gather, protect, or make decisions about. Be aware: This is absolutely not a book solely about computers, with yet another explanation of Alice and Bob and how they exchange public keys in order to exchange messages in secret. Anderson explores, for example, the ingenious ways in which European truck drivers defeat their vehicles' speed-logging equipment. In another section, he shows how the end of the cold war brought on a decline in defenses against radio-frequency monitoring (radio frequencies can be used to determine, at a distance, what's going on in systems--bank teller machines, say), and how similar technology can be used to reverse-engineer the calculations that go on inside smart cards. In almost 600 pages of riveting detail, Anderson warns us not to be seduced by the latest defensive technologies, never to underestimate human ingenuity, and always use common sense in defending valuables. A terrific read for security professionals and general readers alike. --David Wall Topics covered: How some people go about protecting valuable things (particularly, but not exclusively, information) and how other people go about getting it anyway. Mostly, this takes the form of essays (about, for example, how the U.S. Air Force keeps its nukes out of the wrong hands) and stories (one of which tells of an art thief who defeated the latest technology by hiding in a closet). Sections deal with technologies, policies, psychology, and legal matters.

Security Engineering: A Guide to Building Dependable Distributed Systems

Over the Internet today, computing and communications environments are significantly more complex and chaotic than classical distributed systems, lacking any centralized organization or hierarchical control. There has been much interest in emerging Peer-to-Peer (P2P) network overlays because they provide a good substrate for creating large-scale data sharing, content distribution, and application-level multicast applications. These P2P overlay networks attempt to provide a long list of features, such as: selection of nearby peers, redundant storage, efficient search/location of data items, data permanence or guarantees, hierarchical naming, trust and authentication, and anonymity. P2P networks potentially offer an efficient routing architecture that is self-organizing, massively scalable, and robust in the wide-area, combining fault tolerance, load balancing, and explicit notion of locality. In this article we present a survey and comparison of various Structured and Unstructured P2P overlay networks. We categorize the various schemes into these two groups in the design spectrum, and discuss the application-level network performance of each group.

/pdf/a-survey-and-comparison-of-peer-to-peer-overlay-network-cpcv2ij1hk.pdf

A survey and comparison of peer-to-peer overlay network schemes

A server federation cooperatively interacts to fulfill service requests by communicating using data structures that follow a schema in which the meaning of the communicated data is implied by the schema. Thus, in addition to the data being communicated, the meaning of the data is also communicated allowing for intelligent decisions and inferences to be made based on the meaning of the data. Cooperative interaction is facilitated over a wide variety of networks by messaging through a common API that supports multiple transport mechanisms. Also, mid-session transfer between client devices is facilitated by schema and the transport-independent messaging structure. The user interfaces of the client devices will appear consistent even if the client devices have different user interface capabilities.

Distributed computing services platform

Recent technology trends in the Web Services (WS) domain indicate that a solution eliminating the presumed complexity of the WS-* standards may be in sight: advocates of REpresentational State Transfer (REST) have come to believe that their ideas explaining why the World Wide Web works are just as applicable to solve enterprise application integration problems and to simplify the plumbing required to build service-oriented architectures. In this paper we objectify the WS-* vs. REST debate by giving a quantitative technical comparison based on architectural principles and decisions. We show that the two approaches differ in the number of architectural decisions that must be made and in the number of available alternatives. This discrepancy between freedom-from-choice and freedom-of-choice explains the complexity difference perceived. However, we also show that there are significant differences in the consequences of certain decisions in terms of resulting development and maintenance costs. Our comparison helps technical decision makers to assess the two integration styles and technologies more objectively and select the one that best fits their needs: REST is well suited for basic, ad hoc integration scenarios, WS-* is more flexible and addresses advanced quality of service requirements commonly occurring in enterprise computing.

/pdf/restful-web-services-vs-big-web-services-making-the-right-2tg7890x7z.pdf

Restful web services vs. "big"' web services: making the right architectural decision

Passport is a protocol that enables users to sign onto many different merchants' Web pages by authenticating themselves only once to a common server. This is important because users tend to pick poor (guessable) user names and passwords and to repeat them at different sites. Passport is notable as it is being very widely deployed by Microsoft. At the time of this writing, Passport boasts 40 million consumers and more than 400 authentications per second on average. We examine the Passport single signon protocol, and identify several risks and attacks. We discuss a flaw that we discovered in the interaction of Passport and Netscape browsers that leaves a user logged in while informing him that he has successfully logged out. Finally, we suggest several areas of improvement.

/pdf/risks-of-the-passport-single-signon-protocol-lmqjwzl62y.pdf

Risks of the passport single signon protocol

Traffic over a secure link or tunnel is filtered to block packets that do not conform to specified requirements for the tunnel. In one embodiment, a private network, such as an ISP network, includes a filter for blocking packets not associated with an IPSec VPN tunnel. The ISP network and/or one or both of the tunnel endpoints can include monitoring modules for detecting the presence of packets that should have been blocked by the filter.

System having filtering/monitoring of secure connections

The present invention is a method and system for recording a communication over a public network upon the request of a communicating party. The request is received for the recording service from a first communicating party and an identification number, received from the first communicating party, is verified. A number is received for a second communicating party from the first communicating party and a connection for a communication between the first and second communicating parties is established. Finally a recording of the communication is made and, after the completion of the communication is detected, the recording is converted to a standard audio file. The system may provide additional information with the recording, such as a time/date stamp and the telephone numbers associated with the communication, in order to authenticate the call.

Method for providing a phone conversation recording service

Embodiments of the invention allow the convenient transmission of URLs or content corresponding to URLs from a WAP/i-mode-enabled mobile device to any other device across a network. In an embodiment, a URL corresponding to content accessed by WAP/i-mode-enabled mobile device is transmitted to an application server. The WAP/i-mode-enabled mobile device further transmits a destination address for the content to the application server. The application server then transmits the URL corresponding to the content to the destination address. The URL can then be used to render the corresponding content at the destination address. In another embodiment, a URL corresponding to content accessed by the WAP/i-mode-enabled mobile device is transmitted to an application server. The WAP/i-mode-enabled mobile device further transmits a destination address for the content to the application server. The application server then fetches the content corresponding to the URL and transmits the content to the destination device.

Method and apparatus for sharing wireless content

The Platform for Privacy Preferences (P3P) provides a standard computer-readable format for privacy policies and a protocol that enables web browsers to read and process these policies automatically. We developed software to query a set of web sites for P3P policies, check the validity of each policy, and analyze the information practices it describes. We used this software to analyze 588 P3P-enabled web sites found by checking for P3P policies on 5,856 web sites on 17 July 2003. The sites we checked for P3P policies were taken from several lists of popular web sites, as well as from "crawling" indexes of shopping, news, children's and government web sites. We present the first major analysis of the data practices of P3P-enabled web sites.

/pdf/automated-analysis-of-p3p-enabled-web-sites-1o50d43rmt.pdf

David Kormann

Papers

Risks of the passport single signon protocol

System having filtering/monitoring of secure connections

Method for providing a phone conversation recording service

Method and apparatus for sharing wireless content

Automated analysis of P3P-enabled Web sites