Sharif Digital Repository

Security has become more important in IT systems. Thus, to protect such systems from related potential threats and harms, robust and dependable security solutions should be devised. In designing security systems, a number of other issues such as assurance and verifiability are also of concern. Due to their mathematical nature, formal methods are very suitable for the above purposes. Using these methods, one can accurately define a system, its boundaries, and the requirements from design. It also makes it possible to verify that the design meets the requirements. In this dissertation, we propose a general IT security system using RAISE specification method. To do so, the specification... 

Wireless sensor networks have many applications, vary in size, and are deployed in a wide variety of areas. They are often deployed in potentially adverse or even hostile environment so security issues are of much concern in these networks. Key management is a fundamental security issue in sensor networks. In this thesis, we are mainly focusing on key establishment and group rekeying schemes aspects of key management. Due to limited resources of sensor networks, key pre-distribution schemes are currently viewed as the most promising solution. Key predistribution in sensor networks refers to the problem of distributing secret keys among sensor nodes prior to deployment. Recently, many key... 

Computational grids consist of hardware and software infrastructures which can provide end users with the power of computational networks in a ubiquitous and cheaper manner. In fact, computational grids provide the ability to use the computational power of geographically distributed and heterogeneous resources. One of the new challenges facing researchers in this area involves security in grid environment which is somehow hard to achieve, because of the distributed nature of grid resources and fast changes in resource availabilities. Since availability, integrity and confidentiality are key factors of security and system’s fault tolerance capability is directly related to resource... 

With the proliferation of Internet-based applications and malicious attacks, security has become one of the most influential aspects in the network and, it should be considered from the beginning steps of designing the network infrastructure. Based on the fact that pattern matching is considered as one of the most important roles of security devices or applications, it becomes an important procedure in firewalls that have been classified as security equipments which adopt a security mechanism in order to restrict the traffic exchanged between networks and particular users or certain applications. While the trend of using compressed traffic is drastically increasing, this type of traffic is... 

Vehicular ad hoc networks are types of mobile ad hoc networks in which each automobile acts as an intelligent node and can have links to other automobiles and with equipments that are beside the road. The main difference between vehicular ad hoc networks and mobile ad hoc networks are in terms of higher speed of their components, extent, span and scale. One of the main concerns about designing vehicular ad hoc networks is users' security and protection of their privacy policy. Althoug a lot of protocols have been suggested for improvement of securities in these networks up to now, many research challenges regarding users' security and their privacy have been left and need to be considered... 

TETRA (TErrestrial Trunked RAdio) is one of the mobile telecommunication standards which has improved in several aspects (voice, data, video, coverage, etc.), especially the security section during the last two decades. Although communication could be quite secure in TETRA when the encryption is used, however, attackers create new ways to bypass the encryption without the knowledge of the legitimate user. Security is performed in different levels and forms to create reliable operation and to protect information through the transmission path from interception and tampering. Since most of the TETRA users require the highest possible level of security, in this thesis we introduce a new... 

For increasing safety of driving, intelligent vehicles in vehicular ad hoc networks (VANETs) communicate with each other by sending announcements. The existence of a system that guarantees the trustworthiness of these announcements seems necessary. The proposed system generating announcements should be preserved from internal and external attackers that attempt to send fake messages. In this thesis, we use a group-based endorsement mechanism based on threshold signatures against internal attackers. We choose NTRUSign as a public key cryptosystem for implementing the Public Key Infrastructure (PKI) for decreasing signature generation and verification times. This approach optimizes the network... 

Wireless sensor networks (WSNs) use many tiny sensors to monitor phenomena such as temperature, humidity, brightness and traffic, and then transmit this information to a base station using wireless channels. WSNs find applications in military, ecological, urban and health related areas. Hierarchical wireless sensor networks are kind of sensor networks that use communication entities with different capabilities in terms of energy, processing power, bandwidth, communication range and etc. In this thesis, an introduction to WSNs and their applications, characteristics and designing factors is expressed. It continues on studying the infrastructures and the role of cryptography in enhancing... 

Growing need for the use of modern technologies in the field of information and communication reveals the necessity to establish an information security management system more than before. It is totally proven that information is an asset which, like other important assets of the organization is so momentous that should be crucially protected. Nowadays, with the proliferation of security threats, which can lead to undesirable events with possible damage to systems or organizations intentionally or inadvertently, by human factors or inhuman cause, existence of a safe structure has become more necessary for all organizations and agencies. One of the most critical areas of information security... 

Android phones are widely used now. Convenient user interface and various applications for these devices has played a significant role in their success. The wide usage of these devices besides the nature of their applications lead to collect lots of sensitive information on them. Consequently the protection of this information is very important. The unfamiliarity and the inattention of the most of smart phone users to security issues highlight the importance of the data protection and the privacy. The permission access in Android operating system is static and users should permit applications to access the requested permissions on installing them. Also these programs can use their... 

The promotion of oil and gas industry of a country or region requires foreign and long-term investments. Ensuring the security of demand is one of the major driving forces for increasing investments in oil and gas sectors.The status of the Caspian markets in terms of energy demand security is the main issue in this study. Just like security of supply, security of energy demand will not be affected by economic logic alone, but the combination of various factors should be considered; So in this study Combined criteria was developed.According to the horizons of policy making for the energy export of Caspian, 2015 year as the recent past, 2020 as the medium-term and 2030 as the long-term have... 

In today's world in which a major part of information is digitalized and a large portion of the communication is done via computer networks, entities authentication while maintaining privacy is a concern with the growing importance and value. To meet this goal, during the past two decades, anonymous authentication protocols with different approaches for use in various applications has presented and developed. These protocols enable users to authenticate based on some of their properties, without revealing their own identities. Secret handshake protocols are considered as type of anonymous authentication protocols. This protocol has the unique feature of hiding users' affiliation to the... 

One of the biggest challenges in online communication is privacy of individuals. Although anonymous communication (AC) protocols has been the subject of several security and anonymity analyses recently, there are still few frameworks for analyzing such complex systems (e.g. Tor) and their anonymity properties in a unified manner. In this study, an overview of anonymity features and techniques will be discussed by examining various protocols that provide undetectable network communication. Afterwards, the Tor network is described more precisely. Furthermore, the literature of formal methods is briefly reviewed, and the Universal Composable (UC) framework for the analysis of cryptography... 

Security protocols assure the security of the communications in computer systems using techniques such as cryptographic primitives. However, the usage of such protocols is faced by the lack of fault tolerance, where a minor disruption could cause a destructive damage. Therefore, there is a requirement to assess the reliability of these protocols. In this thesis model checking of timed security protocols is done. Model checking process includes steps that will be modeling protocol with high level and human readable specification language named THLPSL and converting this specification to special kind of timed automata named XTA and model checking will be done with UPPAAL verification tool. We... 

The broadcast nature of wireless communications makes the propagation medium vulnerable to security attacks such as eavesdropping and jamming from adversarial or unauthorized users. Applying physical layer secrecy approaches will enable the exchange of confidential messages over a wireless medium in the presence of unauthorized eavesdroppers, without using any secret keys. However, physical layer security approaches are typically feasible only when the source-eavesdropper channel is weaker than the source-destination channel. Cooperative jamming can be used to overcome this challenge and increase the secrecy rate. In this thesis, the security of two-phase relaying system with multiple... 

Web applications and services have been developed and deployed with unprecedented speed, providing various important functionalities to the end user such as office applications, social networking, content sharing, education, and entertainment. Given its popularity and ubiquity, the Web also attracts the attention of malicious entities. Indeed, the Web and its global user community have observed various forms of attack in the past. Among these attacks, using the Web as a channel to distribute malware has become a prominent issue. This type of attack called drive by download attack. This issue has generated a great deal of attention from the security research community . Existing systems to... 

Security is an important issue in Vehicular Ad Hoc Networks (VANETs),which are mainly aimed at enhancing safety. Analysis of security mechanisms can help design and implement secure communication establishment methods in such networks. Formal verification is an analysis approach, with the purpose of proving the correctness of a system based on defined precise assumptions. Formal verification is applicable to a vast range of systems, such as time-critical reactive systems. Timed formal verification of cryptographic protocols is a subject that has gained a lot of attention in the recent two decades. The TESLA broadcast authentication protocol is on one hand an efficient, standardized method... 

One of the most intrinsic challenges of flash-based Solid State Drives (SSDs) is erasebefore-write limitation and the limited endurance of flash chips. Wear leveling and garbage collection are two mechanisms implemented in SSD’s controller to enhance endurance and performance. While wear leveling attempts to distribute erasures across all blocks in an even manner, it imposes a new security challenge on SSD,which leads to the presence of invalid data blocks in flash chips. Therefore, some data blocks that are logically deleted by the user are still available in flash chips and can be recovered by software or hardware recovery tools.
In this paper, a new criteria named vulnerability time... 

Security protocols may be provable secure when used alone, but these protocols lose their security under composition operation. Universal Composition framework (UC) is a tool for analyzing security protocols under composition. UC framework guarantees that the cryptographic protocols keep their security under this composition operation. In this paper we state a modeling for key-evolving signature protocol within the UC framework as a case study. To do this, the ideal functionality is proposed for key-evolving signature scheme that keeps the security requirements of this scheme. Finally, we show that UC definition of security is equivalent to definition of security which is termed here as... 

Nowadays, extensive use of Hardware Trojan Horses (HTH) or backdoors is more prevalent than ever. We could count disruption, disabling, eavesdropping and sending out internal information as misuse.
In this project, we embed hardware trojan in a Programmable Logic Controller, and present different methods to detect and neutralize them. This is an important issue, as PLCs should work in a safe environment especially in industrial environments while keeping the information intact is significant as even a slight intentional malfunction could cause data to be lost or disclosed, and result in a catastrophe. Subsequently, features of hardware of PLCs should be examined and the right place of...