Search

Nowadays, near field communication (NFC) has been widely used in electronic payment, ticketing, and many other areas. NFC security standard requires the use of public key infrastructure (PKI) to implement mutual authentication and session keys negotiation in order to ensure communication security. In traditional PKI-based schemes, every user uses a fixed public/private key pair to implement authentication and key agreement. An attacker can create a profile based on user’s public key to track and compromise the user’s privacy. Recently, He et al. and Odelu et al. successively proposed pseudonym-based authentication key and agreement protocols for NFC after Eun et al. ’s protocol (2013), which is first claimed to provide conditional privacy for NFC. They respectively claimed that their scheme can satisfy the security requirements. In this paper, first, we prove that their protocols still have security flaws, including the confusion of the user’s identity and the random identity. Then, we propose a pseudonym-based secure authentication protocol (PSAP) for NFC applications, which is effective in lifetime and includes time synchronization-based method and nonce-based method. In our scheme, trusted service manager issues pseudonyms but does not need to maintain verification tables and it could reveal the user’s identity of internal attackers. Furthermore, security and performance analysis proves that PSAP can provide traceability and more secure features with a little more cost.

Trusted computing, which can effectively increase the credibility of information system, has made great achievements and is in continuous development. For country who is going to strengthen network construction like China, it is an important fundamental supporting technology worth researching. China is in the international forefront in the field of trusted computing. This paper gives comprehensive introductions to the new development and application of key technologies in trusted computing, such as various trusted platform modules (TPM, TCM, TPCM), TCG Software Stack (TSS), trusted cloud server and Trusted Execution Environment (TEE). We illustrate the progressing and application extension of these technologies and also point out some key problems worth studying in the future.

Display Omitted We propose an anonymous mobile payment protocol to protect users' privacy.Using anonymizing schemes to improve anonymity and unlinkability in a mobile transaction.Users can use mobile phones with NFC to perform commercial transactions. A number of mobile payment studies have been proposed in recently years. Most of the schemes are largely focused on transaction security, not on users' privacy. In this paper, we propose an Unlinkable Anonymous Payment Scheme to provide a secure and anonymous mobile commerce environment. In the proposed protocol, a user applies an anonymous virtual credit card from a trusted service manager. The sensitive information of the applied credit card is stored in the secure elements of user's mobile device. Our proposed protocol ensures various imperative security properties such as anonymity, unlinkability, and non-repudiation etc.

With the developments of mobile communications, M-commerce has become increasingly popular in recent years. However, most M-commerce schemes ignore user anonymity during online transactions. As a result, user transactions may easily be traced by shops, banks or by Internet Service Providers (ISPs). To deal with this problem, we introduce a new anonymous mobile payment scheme in this paper. Our new scheme has the following features: (1) Password-based authentication: authentication of users is done by low-entropy password, (2) Convenience: the new scheme is designed based on near field communication (NFC)-enabled devices and is compatible with EuroPay, MasterCard and Visa (EMV-compatible), (3) Efficiency: users do not need to have their own public/private key pairs and confidentiality is achieved via symmetric-key cryptography, (4) Anonymity: users use virtual accounts in the online shopping processes, thereby preventing attackers from obtaining user information even if the transaction is eavesdropped, (5) Untraceablity: no one (even the bank, Trusted Service Manager (TSM), or the shop) can trace a transaction and link the real identity with the buyer of a transaction, (6) Confidentiality and authenticity: all the transaction is either encrypted or signed by the sender so our new scheme can provide confidentiality and authenticity. We also present the performance and the security comparison of our scheme with other schemes. The results show that our scheme is applicable and has the most remarkable features among the existing schemes.

Cloud computing provides services from the available pool of resources. Even with the available condition, cloud computing can reach the peak of success amongst cloud user. The issue they face is the barrier of trust between the end users for using the given services. Conventional security and protection controls keeps on being executed on cloud; however, because of its liquid and dynamic nature, a testable trust estimate of the cloud is required. This research paper exhibits an analysis of the present trust administration strategies for cloud operations. In this research paper, we proposed a model for trust administration using Fuzzy Logic, which can be beneficial for cloud service providers to select trusted datacenter for consumers.

International audience; Nowadays, smartphones are able to process large amounts of data enabling the use of applications for personal or professional use. In these contexts, the smartphone needs to process, store and transfer sensitive data in a secure way. Encryption is a commonly used solution to enforce security but the encryption keys it relies on have also to be securely processed and stored. Several research works have investigated these issues and different solutions have been proposed. They can be classified into two main categories: hardware-based solutions (Secure Elements, Trusted Platform Module and Trusted Execution Environments) and software-based solutions (Virtualization Environments). This paper overviews/surveys these two categories highlighting their pros and cons. Examples of trusted computing applications are then provided for each category. Finally, a discussion is provided about trends and perspectives for trusted mobile computing.

The rapid advances made in the information and communication technologies have kindled and fueled a fast-paced and widespread shift of information exchange and communication channels between businesses and customers from conventional post and telephone services to mobile-based online services and smartphones. Along with the growing number of smartphone users, an increasing number of people fall victim to new types of financial crimes committed with fraudulent electronic means, such as smishing, pharming, phishing, app/web forgery and fraud, pretending to be a corporate. In this paper, we propose a reliable broker service process providing a communication channel between companies and customers based on the Mobile Wallet (app) on smartphones. The salient features of its process design and implementation are prescreening out fraudulent information and providing customers Smart Wallet-based safe information and services.

International audience; Multi-application smart card technology has gained momentum due to the Near Field Communication (NFC) and smart phone revolution. Enabling multiple applications from different application providers on a single smart card is not a new concept. Multi-application smart cards have been around since the late 1990s; however, uptake was severely limited. NFC has recently reinvigorated the multi-application initiative and this time around a number of innovative deployment models are proposed. Such models include Trusted Service Manager (TSM), User Centric Smart Card Ownership Model (UCOM) and GlobalPlatform Consumer-Centric Model (GP-CCM). In this paper, we discuss two of the most widely accepted and deployed smart card management architectures in the smart card industry: GlobalPlatform and Multos. We explain how these architectures do not fully comply with the UCOM and GP-CCM. We then describe our novel flexible consumer-centric card management architecture designed specifically for the UCOM and GP-CCM frameworks, along with ways of integrating the TSM model into the proposed card management architecture. Finally, we discuss four new security issues inherent to any architecture in this context along with the countermeasures for our proposed architecture.

Mobile devices such as smartphones are becoming the majority among computing devices. Currently, millions of persons use such devices to store and process personal data. Unfortunately, smartphones running Android are increasingly being targeted by hackers and infected with malware. Anti-malware software is being used to address this situation, but it may be subverted by the same malware it aims to detect. We present DroidPosture, a posture assessment service for Android devices. This service aims to securely evaluate the level of trust we can have on a device (assess its posture) even if the mobile OS is compromised. For that to be possible, DroidPosture is protected using TrustZone, a security extension for ARM processors. DroidPosture is configurable with a set of application and kernel analysis mechanisms that enable detecting malicious applications and rootkits. We implemented a DroidPosture prototype using a hardware board with an ARM processor with TrustZone, and evaluated its performance and security.

The impact of Location Based Services (LBS) in the mobile cloud paradigm has been huge. The location based services provide a great backbone to mobile cloud and ease the whole process of communication at a global level. Any location based cloud service is used in order to enhance the user’s accessibility and make the service more user-friendly. Using a cloud base location system can improve the quality of the data storage. The objective is creating a location based mobile cloud application in android platform. This application will be able to geo-tag captured images and upload them onto a cloud. The images that are uploaded in the cloud will be sorted according to their locality. The images in the cloud which are in public mode will be visible to a user when he is in the same locality of the picture’s geo tag.

© 2007-2012 IEEE. Nowadays, with the cloud's charismatic storage and computation power, more and more traditional services (social networking service, location-based services, etc.) are being migrated onto cloud platforms. These cloud services on different cloud platforms could be employed to form cross-cloud mobile applications of mobile cyber-physical systems (CPS). However, a cloud service may have various versions of quality of service (QoS) information revealed in different mobile CPS applications, which is often advertised as the elastic computation power. This characteristic makes it costly and time consuming to mine qualified ones from massive candidate cloud services for developing a mobile CPS application, as a service composition solution may have various evaluated values initiated by the various QoS properties. In view of this challenge, a cloud service selection method, named CSSM, is proposed in this paper. It takes the utility value as the evaluation index and aims at finding optimal or near-optimal trusted service composition solutions from a set of cloud services on users' demands. Technically, the user preference on each QoS metric is formalized as the preference interval for enhancing the fitness of a service composition solution. Furthermore, an extended top-k iteration composition process is performed among cloud services to get an optimal or near-optimal trusted service composition solution. Both theoretical analysis and experimental evaluation are conducted to guarantee the feasibility and efficiency of the CSSM.

In this paper, a secure architecture for mobile payment applications is designed, which combines public service platform, Trusted Service Manager(TSM) and Security Element Financial Certification Security Domain(SE FCSD). The architecture interconnects various platforms, authenticates the identity of transaction parties and detects the legality of applications. In the architecture, a more reliable secure channel protocol SCP10 is used to secure the confidentiality and integrity of data. Using NFC Universal Subscriber Identifier Module Card (NFC USIM card) as the hardware platform, a security element supporting the architecture is implemented, and also a USIM Chip Operating System (USIM COS) supporting both financial certification security domain and SCP10 protocol is designed. In order to improve the efficiency of identity authentication of USIM card, a compact digital certification is adopted to improve verification speed and save storage space. The experiment results and security tests show that the USIM COS has advantages of security and reliability , and it has commercial value and has achieved effective mobile payments.

The characteristics of cloud computing including on-demand self-service, resource pooling, and rapid elasticity have made it grow in popularity. However, security concerns still obstruct widespread adoption of cloud computing in the industry. Especially, security risks related to virtual machine make cloud users worry about exposure of their private data in IaaS environment. In this paper, we propose an enhanced trusted cloud computing platform to provide confidentiality and integrity of the user's data and computation. The presented platform provides secure and efficient virtual machine management protocols not only to protect against eavesdropping and tampering during transfer but also to guarantee the virtual machine is hosted only on the trusted cloud nodes against inside attackers. The protocols utilize both symmetric key operations and public key operations together with efficient node authentication model, hence both the computational cost for cryptographic operations and the communication steps are significantly reduced. As a result, the simulation shows the performance of the proposed platform is approximately doubled compared to the previous platforms. The proposed platform eliminates cloud users' worry above by providing confidentiality and integrity of their private data with better performance, and thus it contributes to wider industry adoption of cloud computing.

Contactless communication technology in mobile phones (e.g., near field communication) has a potential to simplify our everyday life by enabling services like mobile payment, ticketing and information sharing services. The recommendations in this paper are based on a comparative case study of previous mobile service ecosystems used in Norway. The findings of this study add insights into key success factors for the mobile network operator during the different business ecosystem evolutionary stages. The recommendations include the fact that mobile network operators can succeed in kick-starting contactless mobile payment services by taking a role as a trusted service manager, focusing on establishing the ecosystem and contactless payment service together with partners in the bank sector. Furthermore, in an expansion phase the mobile network operator must open up for collaboration and connect with a portfolio of aggregators, merchants and third party niche players offering secure and high quality services and applications. © 2017. This is the authors' accepted and refereed manuscript to the article. The final authenticated version is available online at: http://www.inderscience.com/storage/f511612417398210.pdf

Hardware security has become more and more important in current information security architecture. Recently collected reports have shown that there may have been considerable hardware attacks prepared for possible military usage from all over the world. Due to the intrinsic difference from software security, hardware security has some special features and challenges. In order to guarantee hardware security, academia has proposed the concept of trusted integrated circuits, which aims at a secure circulation of IC design, manufacture and chip using. This paper reviews the main problems of trusted integrated circuits, and concludes four key domains of the trusted IC, namely the trusted IC design, trusted manufacture, trusted IP protection, and trusted chip authentication. The main challenges in those domains are also analyzed based on the current known techniques. Finally, the main limitations of the current techniques and possible future trends are discussed.

Hardware-based trusted execution environments (TEEs) have been available in mobile devices for more than a decade, but their use has been limited. The On-board Credential system safely opens up TEEs so application developers can use their functionality to improve security and usability.

Trusted Network is a new research direction of the Internet. On the basis of trusted LAN, this study puts forward a trusted label of the trusted terminal, which can solve the DDOS attack efficiently and control the abnormal flow easily in the trusted LAN. In addition, it proposes the label’s verification technology, so as to ensure the execution efficiency of some real-time business in the gateway. Above all, the trusted label and the verification technology make the LAN more controllable and safer.

Trusted computing is a hot topic of information security technology research nowadays. It was developed based on computing and Information Systems. At the same time, business processes for e-commerce and Web service applications, suppliers and customers define a binding agreement or contract between the two parties, specifying quality of service (QoS) items such as products or services to be delivered, deadlines, quality of products, and cost of services. The management of QoS metrics directly impacts the success of organizations participating in e-commerce. In this paper, we discuss the present situation about QoS in the environment of trusted computing. It describes the factors related to each attribute, as well as possible tradeoffs and existing efforts to achieve that quality. The paper also discusses key issues in services level agreements that are used to contract the level of services quality between service providers and users.

The trusted network connection is a hot spot in trusted computing field and the trust measurement and access control technology are used to deal with network security threats in trusted network. But the trusted network connection lacks fine-grained states and real-time measurement support for the client and the authentication mechanism is difficult to apply in the trusted network connection, it is easy to cause the loss of identity privacy. In order to solve the above-described problems, this paper presents a trust measurement scheme suitable for clients in the trusted network, the scheme integrates the following attributes such as authentication mechanism, state measurement, and real-time state measurement and so on, and based on the authentication mechanism and the initial state measurement, the scheme uses the real-time state measurement as the core method to complete the trust measurement for the client. This scheme presented in this paper supports both static and dynamic measurements. Overall, the characteristics of this scheme such as fine granularity, dynamic, real-time state measurement make it possible to make more fine-grained security policy and therefore it overcomes inadequacies existing in the current trusted network connection.

Mobile e-commerce systems are the big trend of international economy and social development now days, and also the key process of industry upgrade, industrialization and modernization in our country. Mobile e-commerce systems are considered as the backbone of the manufacturing industry in China, Vulnerabilities in web applications continue to be the most frequently discovered security problem. This article illustrates a trusted operating systems how to provide a flexible solution to the problem of application for e-commerce. With the help of Chinese Wall, web services are becoming popular in Web applications. In the end, we present strategies for e-commerce application: trusted e-commerce module.

This paper firstly analyzes the background of the Internet of things (IoT) and describes the trusted computing technologies concept about trusted cryptography modules (TCM), then describes its basic hierarchy and gives a basic security model based on a simple IoT system. And based on this security model, a secure solution of trusted IoT has been built by using the TCM-based technology, and it covers secure boot, secure storage, platform metrics and trusted reports, key functions, and then gives the protocol design with these functions. After analysis results, the solution can provide safeguard of security and trustworthy for their development and application.

Web-based e-commerce applications need a trusted channel, which provides confidential communication, identity authentication and integrity assurance of endpoints, to guarantee the security of electronic transactions. A user-oriented trusted computing system based on Portable Trusted Module (PTM) is presented. Remote attestation is incorporated into Transport Layer Security (TLS) handshake protocol based on PTM so as to establish a trusted channel between two endpoints in network. This protocol can resist masquerading, trusted path and runtime attacks and propagate the trust in the computing system to the end user effectively. The test results of our proof-of-concept prototype show that our protocol for trusted channel is feasible for deployment in e-commerce applications on the Internet.

Code identity is a fundamental concept for authenticated operations in Trusted Computing. In today's approach, the overhead of assigning an identity to a protected service increases linearly with the service code size. In addition, service code size continues to grow to accommodate richer services. This trend negatively impacts either the security or the efficiency of current protocols for trusted executions. We present an execution protocol that breaks the dependency between the code size of the service and the identification overhead, without affecting security, and that works on different trusted components. This is achieved by computing an identity for each of the code modules that are actually executed, and then building a robust chain of trust that links them together for efficient verification. We implemented and applied our protocol to a widely-deployed database engine, improving query-processing time up to 2× compared to the monolithic execution of the engine.

In this paper, needs of trusted IOT application are identified and a methodology is proposed to create a framework "IoTEE" for rapid prototyping of secure, trusted and commercial IOT applications in absence of hardware. This has been done by analysis of requirements of a sample trusted IOT application heartbeat sensor (hbs), classification of bhs services and their decomposition into trusted and non-trusted components. Furthermore, the methodology includes algorithm design for services like registration, authentication, authorization and secure communication in the proposed framework. Detailed operation sequence of the algorithms is also depicted to understand the overall switching scenario between trusted and non-trusted components of application. Finally, a dynamic deployment structure is created to enable and disable the trusted components in the framework.

With the development of trusted computing, trusted computing model and trusted computing platforms are constantly changing, and becoming more and more perfect. In terms of the hardware platform, the trusted computing technology has been gradually matured. Many companies and businesses solve security problems by using trusted technologies. Trusted computing technology focuses on such as hardware, operating system and other aspects, wishing to build a complete, credible and reliable trusted platform. In this paper, the structure of the trusted platform has been described. Focus on Protected Capabilities, Integrity Measurement and Attestation which are the representative characteristics, some analysis and researches have been proposed. And analyze the main parts and priorities of the designing process of trusted platforms.

Trusted computing provides an efficient and practical way out for system security problems based on a trusted hardware, namely the root of trust, e.g., Trusted Platform Module TPM, Trusted Cryptographic Module TCM, Trusted Platform Control Module TPCM, so on and so forth. However, current applications calling for trusted functions have to use either the user-space trusted interfaces e.g., Trusted Software Stack TSS API or to implement customized APIs on top of the trusted hardware driver; both of them are well known of steep learning curve, which indicates error prone and low-efficient development and complex maintenance for the application of trusted software. This paper presents a new trusted encapsulation architecture and the proof-of-concept system with the aim to mitigate the gap between the current obscure trusted APIs and the actual trusted applications for trusted software development. Our system can provide high-level and much simplified trusted transaction interfaces for user applications, which can rapidly reduce the development and maintenance work for the developers and users without too much performance costs. We also present a secure remote login use-case using mainly the binding and unbinding trusted functions of our trusted encapsulation architecture.

Insufficiently protected mobile devices present a ubiquitous threat. Due to severe hardware constraints, such as limited printed circuit board area, hardware-based security as proposed by the Trusted Computing Group is usually not part of mobile devices, yet. We present the design and implementation of seTPM, a secure element based TPM, utilizing Java Card technology. seTPM establishes trust in mobile devices by enabling Trusted Computing based integrity measurement services, such as IMA for Linux. Our prototype emulates TPM functionality on a GlobalPlatform secure element, which allows seamless integration into the Trusted Software Stack of Linux-based mobile operating systems like Android. With our work, we provide a solution to run Trusted Computing based security protocols while supplying a similar security level as provided by hardware TPM chips. In addition, due to the flexible design of the seTPM, we further increase the security level as we are able to selectively replace the outdated SHA-1 hash algorithm of TPM 1.2 specification by the present Keccak algorithm. Further, our architecture comprises hybrid support for the TPM 1.2 and TPM 2.0 specifications to simplify the transition towards the TPM 2.0 standard.

In this paper, the application of Trusted Computing Platform is discussed. It is pointed out that the purpose of network management information system by trusted Computing platform is to set up a trusted network system. Based on the analysis of the environment of the trusted network information management system, we employ a trusted computing model in the information system of graduate student at our university. The implementation of network trusted management information system indicates that this method will improve the security of information system.

This paper discusses the trusted computing model which is based on existing computer network. The present trusted computing platform has to make big changes on personal pc hardware system in order to realize the trusted computing platform module on pc mainboard or hardware. To solve this, here presents a layered trusted computing platform module, which replaces the original trusted computing platform module with implemented modules on server. The prototype model ensures the trust measurement being implemented on any logical layers of the trusted platform with making a complete trust chain from the beginning of the boot stage of the client operating system. By creating a trusted computer platform with all the computers in the system, real trustworthiness in the entire local area network can be realized.

Scholars around the world have carried out extensive research word on architecture, protocols, algorithms and application for trusted network at present, and proposed a variety of network credible verification scheme and control mechanisms. In this paper, a kind of grade division policy for trusted network was provided on the basis of considering both the terminal security and profit of operators. Credible access architecture and certification model were given, and the partition rules of trusted attributes as well as the evaluate methods of grade division were explained in detail. Improved workflow for access to trusted network terminal was provided. Simulations results show that by the proposed framework, not only the safety and reliability of network can be ensured, but also the flexibility of ways to access network was strengthened, and that it can provide support for interoperability of different equipment manufacturers.

Based on the TNC architecture, using a trusted network of repair techniques in the trusted network access scenario does not meet the requirements of integrity verification solution for end users. Put forward a credible fix the overall network design, reliable model restoration and repair services, network workflow. The system is in need of restoration to provide safe and reliable repair end-user data transmission, providing a humane, reasonable repair services to ensure the credibility of fixed network and the isolation effect of the terminal to be repaired and strengthened the security of fixed server. Realized the classification of various types of repair resources management, restoration of resources in ensuring the transfer of fast, reliable, based on the performance with a certain extension.

Trusted computing technology is expected to guarantee security for network and terminal in future communication environment. In this work, we introduce the concept of trusted attribute to build a novel framework for hierarchical trusted access and feasible remediation. The categorization of trusted attribute is justified primarily in terms of the point in the boot cycle of a system at which the respective attributes are measured. The concept of trusted attribute is extended to the notion of a ''trusted grade'' that is granted by a new added module so-called trusted level division function. Also we give a reasonable example of dividing trusted grades. We discuss the promising applications of our presented framework and the access procedure of terminal. The simulations show that by the proposed framework, not only the security and reliability of network can be ensured, but also the flexibility of terminal to access network is improved. And that the presented framework can provide necessary supports for interoperability of different equipment manufacturers. It also can be concluded that the presented remediation framework is easy to be deployed, by which the convenient and reliable remediation services are able to be offered to those terminals without achieving the security standards of local network.

Secure boot is one important way to ensure the security of system for the terminal computing platform. The existing solutions for platform secure boot are based on verification by matching the reference measurements with the runtime measurements. These solutions are complex and inefficient. Based on the existing secure boot scheme, a secure boot model based on trusted personal computer (PC) is designed. Through the use of the existing trusted computing technology, a seal-based secure boot scheme for trusted computing platform is proposed in this paper. In this scheme, it is not necessary to generate the certificates on components of the reference measurements; it is also not necessary for verification proxy to verify the integrity of the runtime measurements. At the same time, the security of platform system is effectively guaranteed during booting.

Mobile environments are evolving the main communication environment as a develops of communication technology. In mobile environments, sensitive information can be compromised on-line, so demand for security has increased. Also, mobile devices that provide various services are in danger from malware and illegal devices, phishing and sniffing etc, and the privacy. Therefore, MTM(Mobile Trusted Module) is developed and promoted by TCG(Trusted Computing Group), which is an industry standard body to enhance the security level in the mobile computing environment. MTM protects user privacy and platform integrity, because it is embedded in the platform, and it is physically secure. However, a security approach is required when secret data is migrated elsewhere, because MTM provides strong security functions. In this paper, we analyze the TCG standard and migration method for cryptographic key, then we propose a secure migration scheme for cryptographic key using key Backup/Recovery method.

In recent years, a clear trend has emerged where businesses need to provide flexible access to its services so as to increase their usage by a much wider cross-section of users operating over public infrastructures but still within a trusted environment. This trusted environment must be established between all participating users and service provider entities before any transactions are carried out. To meet the challenge of enabling mobile users to work within a trusted environment on any untrusted machine, the notion of a trusted personal device (TPD) has emerged. This paper provides a survey giving a snapshot of the growing body of work ongoing in the area of TPDs and the services they support.

This article describes a Web service-based framework supported by federated identity management technologies, which enables fixed and mobile operators to create a secure, dynamic, and trusted service ecosystem around them. With this framework, new service providers can be incorporated automatically, dynamically negotiating and accepting service level agreements to control their activities. Furthermore, it is based on identity management, not only to keep user identities private and protected, but also to enable the creation of value-added services using network resources and user profiles. This service ecosystem is not limited to third party providers but also can be extended through collaboration agreements between operators.

A lot of progress has been made to secure network communication, e.g., through the use of cryptographic algorithms. However, this offers only a partial solution as long as the communicating end points still suffer from security problems. A number of applications require remote verification of software executing on an untrusted platform. Trusted computing solutions propose to solve this problem through software and hardware changes, typically a secure operating system and the addition of a secure coprocessor respectively. On the other hand, timed execution of code checksum calculations aims for a solution on legacy platforms, but can not provide strong security assurance. We present a mixed solution by using the trusted computing hardware, namely the time stamping functionality of the trusted platform module, in combination with a timing based remote code integrity verification mechanism. In this way, we do not require a secure operating system, but at the same time the overall security of the timed execution scheme can be improved.

In a mobile ubiquitous environment, service interactions between a user device and a service provider should be secure, regardless of the type of device used to access or consume a service. We present a Secure Device Management Framework (SDMF), designed to securely deliver services to user devices, whilst also hiding (some of) the complexity of security management from users. Key to this framework is the Device Management Entity (DME), that manages a user device's security credentials, and interacts with service providers on its behalf. This framework also provides users with assurance that a compromised device cannot consume the delivered service, and, at the same time, prevents users from illegally sharing their credentials with other users. We achieve these objectives using Trusted Computing functionality and certain other security mechanisms.

As a new technology, mobile agent (MA) shows a wide application in the field of network technology. However, security has been one of the crucial problems in its application. A new protection model based on a trusted element is presented in this paper. The trusted element, which differs from the traditional trusted hardware such as a smart card or a co-processor, offers a third party service based on an encrypted circuit construction. The procedure of constructing an encrypted circuit is introduced and the method of using the trusted service to protect the MA is also described. An application example is given to show how to use the new model at the end of the paper.

This paper presents a smartphone-based physical access control system in which the access points are not directly connected to a central authorization server, but rather use the connectivity of the mobile phone to authorize a user access request online by a central access server.The authentication of the smartphone is based on public-key cryptography. This requires that the private key is stored in a secure element or in a trusted execution environment to prevent identity theft. One of the basic requirement of our solution is the independence from third parties like mobile network operators, trusted service managers and handset manufacturers. Therefore, a SIM-based secure element as well as an embedded secure element (i.e. a separate hardware chip on the handset) were not an option and we had to concentrate on the remaining secure element architectures: Host Card Emulation (HCE) and a microSD-based secure element.We show that the HCE approach cannot solve the relay attack under conservative security assumptions and we present and discuss an implementation based on a microSD secure element that still allows the access points to connect to the authorization server upon every access albeit the access points are not connected with it.

Since the security problem of embedded systems are increasingly severe and the transfer of trusted chain is incomplete, a bottom-up and top-down transfer model of the trusted chain of embedded systems is presented in the paper, combining with the idea of trusted computing. Based on this model, the plan for booting trust, loading trust on real-time operating system and on applications with the prototype of partitioned RTOS on embedded system platform is designed, which can well solve to a certain extent the security problems that the current embedded system encountering.

At the center of core technologies for a future cyber world, such as Internet of Things (IoT) or big data, is a context-rich system that offers services by using situational information. The field where context-rich systems were first introduced is near-field communication (NFC)-based electronic payments. Near-field Communication (NFC) integrated payment services collect the payment information of the credit card and the location information to generate patterns in the user’s consumption or movement through big data technology. Based on such pattern information, tailored services, such as advertisement, are offered to users. However, there is difficulty in controlling access to personal information, as there is a collaborative relationship focused on the trusted service manager (TSM) that is close knit to shared personal information. Moreover, in the case of Hadoop, among the many big data analytical technologies, it offers access control functions, but not a way to authorize the processing of personal information, making it impossible to grant authority between service providers to process information. As such, this paper proposes a key generation and distribution method, as well as a secure communication protocol. The analysis has shown that the efficiency was greater for security and performance compared to relation works.

In cloud computing, geographic location of data is one of major security concerns of cloud users. To resolve this problem, most of previous work has been done on trusted relocation service in cloud service providers. For example, users are allowed to determine the physical location of their cloud servers and ensured about their requirements of relocation-based restrictions. However, it is also essential to handle trusted relocation service at cloud users' devices in mobile cloud computing. As mobile cloud tenants use cloud services everywhere, trusted relocation of cloud users arises a new security issue. Thus, in this paper, we present a novel trusted relocation system named Devisor for cloud user devices. The key mechanism of Devisor is providing a trusted channel between the relocation server and the GPS module in each mobile client device. We leverage Trusted Platform Module (TPM) and tiny hyper visor in order to securely perform the attestation of the relocation of client devices. To prove the practicality of Devisor, we design and implement a cloud word processor with trusted relocation service based on Ether pad. We also evaluate the performance of Devisor in cloud devices and show that it causes only 8.3% overhead in JavaScript benchmark, which indicates the feasibility of TGVisor.

In recent years, cloud computing service is used widespread for information systems. The significant thing for costumers is distinguishing trusted cloud. However, since this new technology covers Internet, CT and IT fields how to defines and assessment trusted cloud is very complicated. Many organizations have offered metrics for evaluating cloud, while few of them is accepted as standard, let alone those for trusted cloud. This paper proposes a new framework including 17 indicators in terms of data security, service quality and rights protection, to evaluate trusted cloud service. Additionally, this framework has been the standard of China Communication Standard Alliance, and applied in Trusted Cloud Certification of China.