Thèses sur le sujet « Sécurité des applications »
Créez une référence correcte selon les styles APA, MLA, Chicago, Harvard et plusieurs autres
Consultez les 50 meilleures thèses pour votre recherche sur le sujet « Sécurité des applications ».
À côté de chaque source dans la liste de références il y a un bouton « Ajouter à la bibliographie ». Cliquez sur ce bouton, et nous générerons automatiquement la référence bibliographique pour la source choisie selon votre style de citation préféré : APA, MLA, Harvard, Vancouver, Chicago, etc.
Vous pouvez aussi télécharger le texte intégral de la publication scolaire au format pdf et consulter son résumé en ligne lorsque ces informations sont inclues dans les métadonnées.
Parcourez les thèses sur diverses disciplines et organisez correctement votre bibliographie.
Cherif, Amina. « Sécurité des RFIDs actifs et applications ». Thesis, Limoges, 2021. http://www.theses.fr/2021LIMO0015.
Texte intégralOver the 30 last years, active RFID devices have evolved from nodes dedicated to identification to autonomous nodes that, in addition, sense (from environment or other sources) and exchange data. Consequently, the range of their applications has rapidly grown from identification only to monitoring and real time localisation. In recent years, thanks to their advantages, the use of active RFID nodes for mobile data collection has attracted significant attention. However, in most scenarios, these nodes are unattended in an adverse environments, so data must be securely stored and transmitted to prevent attack by active adversaries: even if the nodes are captured, data confidentiality must be ensured. Furthermore, due to the scarce resources available to nodes in terms of energy, storage and/or computation, the used security solution has to be lightweight. This thesis is divided in two parts. In the first, we will study in details the evolution of active RFID nodes and their security. We will then, present, in the second part, a new serverless protocol to enable MDCs (Mobile Data Collectors), such as drones, to collect data from mobile and static Active RFID nodes and then deliver them later to an authorized third party. The whole solution ensures data confidentiality at each step (from the sensing phase, before data collection by the MDC, once data have been collected by MDC, and during final delivery) while fulfilling the lightweight requirements for the resource-limited entities involved. To assess the suitability of the protocol against the performance requirements, we will implement it on the most resource-constrained secure devices to prove its efficiency even in the worst conditions. In addition, to prove the protocol fulfills the security requirements, we will analyze it using security games and we will also formally verify it using the AVISPA and ProVerif tools
Luo, Zhengqin. « Sémantique et sécurité des applications Web ». Nice, 2011. http://www.theses.fr/2011NICE4058.
Texte intégralIn this work we study the formal semantics and security problems of Web applications. The thesis is divided into three parts. The first part proposes a small-step operational semantics for a multitier programing language HOP, which can be used to globally reasoning about Web applications. The semantics covers a core of the HOP language, including dynamic generations of client code, and interactions between servers and clients. The second part studies a new technique to automatically prevent code injection attacks, based on multitier compilation. We add a new phase in the compiler to compare the intended and the actual syntax structure of the output. The validity of our technique is proved correct in the operational semantics of HOP. The last part of the thesis studies Mashic, a source-to-source compiler of JavaScript to isolate untrusted script by ifram sandbox and postmessage in HTML5. The compiler is proved correct in a formal semantics of JavaScript
Vayssière, Julien. « Une architecture de sécurité pour les applications réflexives : application à Java ». Nice, 2002. http://www.theses.fr/2002NICE5772.
Texte intégralHadhiri, Amine. « Sécurité des applications androïde : menaces et contre-mesures ». Mémoire, École de technologie supérieure, 2012. http://espace.etsmtl.ca/1008/1/HADHIRI_Amine.pdf.
Texte intégralSomé, Dolière Francis. « Sécurité et vie privée dans les applications web ». Thesis, Université Côte d'Azur (ComUE), 2018. http://www.theses.fr/2018AZUR4085/document.
Texte intégralIn this thesis, we studied security and privacy threats in web applications and browser extensions. There are many attacks targeting the web of which XSS (Cross-Site Scripting) is one of the most notorious. Third party tracking is the ability of an attacker to benefit from its presence in many web applications in order to track the user has she browses the web, and build her browsing profile. Extensions are third party software that users install to extend their browser functionality and improve their browsing experience. Malicious or poorly programmed extensions can be exploited by attackers in web applications, in order to benefit from extensions privileged capabilities and access sensitive user information. Content Security Policy (CSP) is a security mechanism for mitigating the impact of content injection attacks in general and in particular XSS. The Same Origin Policy (SOP) is a security mechanism implemented by browsers to isolate web applications of different origins from one another. In a first work on CSP, we analyzed the interplay of CSP with SOP and demonstrated that the latter allows the former to be bypassed. Then we scrutinized the three CSP versions and found that a CSP is differently interpreted depending on the browser, the version of CSP it implements, and how compliant the implementation is with respect to the specification. To help developers deploy effective policies that encompass all these differences in CSP versions and browsers implementations, we proposed the deployment of dependency-free policies that effectively protect against attacks in all browsers. Finally, previous studies have identified many limitations of CSP. We reviewed the different solutions proposed in the wild, and showed that they do not fully mitigate the identified shortcomings of CSP. Therefore, we proposed to extend the CSP specification, and showed the feasibility of our proposals with an example of implementation. Regarding third party tracking, we introduced and implemented a tracking preserving architecture, that can be deployed by web developers willing to include third party content in their applications while preventing tracking. Intuitively, third party requests are automatically routed to a trusted middle party server which removes tracking information from the requests. Finally considering browser extensions, we first showed that the extensions that users install and the websites they are logged into, can serve to uniquely identify and track them. We then studied the communications between browser extensions and web applications and demonstrate that malicious or poorly programmed extensions can be exploited by web applications to benefit from extensions privileged capabilities. Also, we demonstrated that extensions can disable the Same Origin Policy by tampering with CORS headers. All this enables web applications to read sensitive user information. To mitigate these threats, we proposed countermeasures and a more fine-grained permissions system and review process for browser extensions. We believe that this can help browser vendors identify malicious extensions and warn users about the threats posed by extensions they install
Mouelhi, Tejeddine. « Modélisation et test de mécanismes de sécurité dans des applications internet ». Phd thesis, Institut National des Télécommunications, 2010. http://tel.archives-ouvertes.fr/tel-00544431.
Texte intégralMakiou, Abdelhamid. « Sécurité des applications Web : Analyse, modélisation et détection des attaques par apprentissage automatique ». Thesis, Paris, ENST, 2016. http://www.theses.fr/2016ENST0084/document.
Texte intégralWeb applications are the backbone of modern information systems. The Internet exposure of these applications continually generates new forms of threats that can jeopardize the security of the entire information system. To counter these threats, there are robust and feature-rich solutions. These solutions are based on well-proven attack detection models, with advantages and limitations for each model. Our work consists in integrating functionalities of several models into a single solution in order to increase the detection capacity. To achieve this objective, we define in a first contribution, a classification of the threats adapted to the context of the Web applications. This classification also serves to solve some problems of scheduling analysis operations during the detection phase of the attacks. In a second contribution, we propose an architecture of Web application firewall based on two analysis models. The first is a behavioral analysis module, and the second uses the signature inspection approach. The main challenge to be addressed with this architecture is to adapt the behavioral analysis model to the context of Web applications. We are responding to this challenge by using a modeling approach of malicious behavior. Thus, it is possible to construct for each attack class its own model of abnormal behavior. To construct these models, we use classifiers based on supervised machine learning. These classifiers use learning datasets to learn the deviant behaviors of each class of attacks. Thus, a second lock in terms of the availability of the learning data has been lifted. Indeed, in a final contribution, we defined and designed a platform for automatic generation of training datasets. The data generated by this platform is standardized and categorized for each class of attacks. The learning data generation model we have developed is able to learn "from its own errors" continuously in order to produce higher quality machine learning datasets
Serme, Gabriel. « Modularisation de la sécurité informatique dans les systèmes distribués ». Electronic Thesis or Diss., Paris, ENST, 2013. http://www.theses.fr/2013ENST0063.
Texte intégralAddressing security in the software development lifecycle still is an open issue today, especially in distributed software. Addressing security concerns requires a specific know-how, which means that security experts must collaborate with application programmers to develop secure software. Object-oriented and component-based development is commonly used to support collaborative development and to improve scalability and maintenance in software engineering. Unfortunately, those programming styles do not lend well to support collaborative development activities in this context, as security is a cross-cutting problem that breaks object or component modules. We investigated in this thesis several modularization techniques that address these issues. We first introduce the use of aspect-oriented programming in order to support secure programming in a more automated fashion and to minimize the number of vulnerabilities in applications introduced at the development phase. Our approach especially focuses on the injection of security checks to protect from vulnerabilities like input manipulation. We then discuss how to automate the enforcement of security policies programmatically and modularly. We first focus on access control policies in web services, whose enforcement is achieved through the instrumentation of the orchestration mechanism. We then address the enforcement of privacy protection policies through the expert-assisted weaving of privacy filters into software. We finally propose a new type of aspect-oriented pointcut capturing the information flow in distributed software to unify the implementation of our different security modularization techniques
Fila, Barbara. « Automates pour l'analyse de documents XML compressés, applications à la sécurité d'accès ». Phd thesis, Université d'Orléans, 2008. http://tel.archives-ouvertes.fr/tel-00491193.
Texte intégralFila-Kordy, Barbara. « Automates pour l'analyse de documents XML compressés, applications à la sécurité d'accès ». Orléans, 2008. http://www.theses.fr/2008ORLE2029.
Texte intégralCiobâcǎ, Ştefan. « Verification and composition of security protocols with applications to electronic voting ». Thesis, Cachan, Ecole normale supérieure, 2011. http://www.theses.fr/2011DENS0059/document.
Texte intégralThis thesis is about the formal verification and composition of security protocols, motivated by applications to electronic voting protocols. Chapters 3 to 5 concern the verification of security protocols while Chapter 6 concerns composition.We show in Chapter 3 how to reduce certain problems from a quotient term algebra to the free term algebra via the use of strongly complete sets of variants. We show that, when the quotient algebra is given by a convergent optimally reducing rewrite system, finite strongly complete sets of variants exist and are effectively computable.In Chapter 4, we show that static equivalence for (classes of) equational theories including subterm convergent equational theories, trapdoor commitment and blind signatures is decidable in polynomial time. We also provide an efficient implementation.In Chapter 5 we extend the previous decision procedure to handle trace equivalence. We use finite strongly complete sets of variants introduced in Chapter 3 to get rid of the equational theory and we model each protocol trace as a Horn theory which we solve using a refinement of resolution. Although we have not been able to prove that this procedure always terminates, we have implemented it and used it to provide the first automated proof of vote privacy of the FOO electronic voting protocol.In Chapter 6, we study composition of protocols. We show that two protocols that use arbitrary disjoint cryptographic primitives compose securely if they do not reveal or reuse any shared secret. We also show that a form of tagging is sufficient to provide disjointness in the case of a fixed set of cryptographic primitives
Makiou, Abdelhamid. « Sécurité des applications Web : Analyse, modélisation et détection des attaques par apprentissage automatique ». Electronic Thesis or Diss., Paris, ENST, 2016. http://www.theses.fr/2016ENST0084.
Texte intégralWeb applications are the backbone of modern information systems. The Internet exposure of these applications continually generates new forms of threats that can jeopardize the security of the entire information system. To counter these threats, there are robust and feature-rich solutions. These solutions are based on well-proven attack detection models, with advantages and limitations for each model. Our work consists in integrating functionalities of several models into a single solution in order to increase the detection capacity. To achieve this objective, we define in a first contribution, a classification of the threats adapted to the context of the Web applications. This classification also serves to solve some problems of scheduling analysis operations during the detection phase of the attacks. In a second contribution, we propose an architecture of Web application firewall based on two analysis models. The first is a behavioral analysis module, and the second uses the signature inspection approach. The main challenge to be addressed with this architecture is to adapt the behavioral analysis model to the context of Web applications. We are responding to this challenge by using a modeling approach of malicious behavior. Thus, it is possible to construct for each attack class its own model of abnormal behavior. To construct these models, we use classifiers based on supervised machine learning. These classifiers use learning datasets to learn the deviant behaviors of each class of attacks. Thus, a second lock in terms of the availability of the learning data has been lifted. Indeed, in a final contribution, we defined and designed a platform for automatic generation of training datasets. The data generated by this platform is standardized and categorized for each class of attacks. The learning data generation model we have developed is able to learn "from its own errors" continuously in order to produce higher quality machine learning datasets
Tizraoui, Adel. « Un nouveau modèle de sécurité pour les applications Internet Application à la téléphonie sur IP SIM IP ». Paris 6, 2003. http://www.theses.fr/2003PA066321.
Texte intégralRasoamiaramanana, Sandra. « Conception de schémas de chiffrement boîte blanche pour la sécurité des applications mobiles ». Electronic Thesis or Diss., Université de Lorraine, 2020. http://www.theses.fr/2020LORR0060.
Texte intégralToday mobile devices are an integral part of our lives with the development of applications. In addition to smart phones, which are increasingly powerful, other devices such as connected objects may have to handle data that must remain secret. For example, the authentication of a connected object in a network requires the existence of a ``secret" held by the object. In the case of mobile applications, the emergence of payment applications allowing contactless payment from the telephone or banking applications poses serious security challenges. The need to secure applications is therefore essential both for users wishing to access a service without risking their goods and for service providers who have a financial interest in it. Thus, cryptography is used to protect these various mobile applications. In this context, we wish to meet this need with both a software and hardware approach to secure cryptography on open and exposed platforms. The aim of this thesis is to verify the security of software implementations of cryptographic algorithms in the white-box model and to propose techniques to reinforce this security in a mobile environment. The white-box model or white-box attacks context is opposed to the traditional black-box model and refers to a context in which an attacker controls an execution environment and has access to software implementations of cryptographic algorithms. Once a secret key is revealed, the security of the encryption scheme is no longer valid. In this context, the last line of defense is the implementation itself: the secret key is hidden in the code so that it cannot be distinguished or extracted. Many studies have been conducted on White-Box Cryptography and have led to proposals for white-box implementations of standardized algorithms such as the DES (Data Encryption Standard) or the AES (Advanced Encryption Standard). These algorithms are of particular interest due to their wide deployment. Unfortunately these proposals have revealed vulnerabilities and do not guarantee the confidentiality of the secret key. In this thesis, we are first interested in the reasons why not all proposed implementations allow to ``hide'' the secret key sufficiently. We will make a detailed study of the techniques used as well as the possible attacks. Secondly, we propose new techniques to counter these attacks and study the cost of these techniques in terms of code size and performance. Another approach in White-Box Cryptography is to design algorithms that can be proved to be resistant to key extraction. This new approach involves proposing security notions adapted to the white-box model. In particular, the main problem is to ensure that the implementation of the cryptographic algorithm cannot be copied and executed in another environment. This attack called "code lifting" (code copying) is equivalent to extracting the secret key. One solution proposed in the literature is to increase the size of the code in order to increase the space complexity of the attack. We propose a solution to this problem by defining an encryption scheme that can be implemented in a white-box and that uses a physical device called Physically Unclonable Function (PUF). A PUF refers to a physical device with unique and unclonable characteristics that can be used to identify it. Thus, a PUF can be seen as the fingerprint (in the biometric sense) of a device. The PUF will be used in our scheme as a means of identifying the execution environment of a cryptographic algorithm and will generate a key specific to a given device
Duflos, Sandrine Viviane Julie. « Sosma : une architecture pour la gestion de la sécurité des applications multimédias réparties ». Paris 6, 2005. http://www.theses.fr/2005PA066587.
Texte intégralQuerrec, Ronan. « Les Systèmes Multi-Agents pour les Environnements Virtuels de Formation : Application à la sécurité civile ». Brest, 2003. http://www.theses.fr/2002BRES2037.
Texte intégralThis study concerns virtual environments for training in operationnal conditions. The principal developed idea is that these environments are heterogeneous and open multiagent systems. The MASCARET model is proposed to organize the interactions between the agents and to give them reactives, cognitives ans socials abilities to simulate the physical and social environment. The physical environment represent, in a realistic way, the phenomena that the learners and the teachers have to take into account. The social environment is simulated by agents executing collaborative and adaptative tasks. They realize, in team, the procedures that they have to adapt to the environment. The users participate to the training environment throught their avatar. To validate our model, the SecuRevi application for fire-fighters training is developed
Serme, Gabriel. « Modularisation de la sécurité informatique dans les systèmes distribués ». Thesis, Paris, ENST, 2013. http://www.theses.fr/2013ENST0063/document.
Texte intégralAddressing security in the software development lifecycle still is an open issue today, especially in distributed software. Addressing security concerns requires a specific know-how, which means that security experts must collaborate with application programmers to develop secure software. Object-oriented and component-based development is commonly used to support collaborative development and to improve scalability and maintenance in software engineering. Unfortunately, those programming styles do not lend well to support collaborative development activities in this context, as security is a cross-cutting problem that breaks object or component modules. We investigated in this thesis several modularization techniques that address these issues. We first introduce the use of aspect-oriented programming in order to support secure programming in a more automated fashion and to minimize the number of vulnerabilities in applications introduced at the development phase. Our approach especially focuses on the injection of security checks to protect from vulnerabilities like input manipulation. We then discuss how to automate the enforcement of security policies programmatically and modularly. We first focus on access control policies in web services, whose enforcement is achieved through the instrumentation of the orchestration mechanism. We then address the enforcement of privacy protection policies through the expert-assisted weaving of privacy filters into software. We finally propose a new type of aspect-oriented pointcut capturing the information flow in distributed software to unify the implementation of our different security modularization techniques
Chantelauve, Guillaume. « Evaluation des risques et réglementation de la sécurité : Cas du secteur maritime - Tendances et applications ». Phd thesis, INSA de Lyon, 2006. http://tel.archives-ouvertes.fr/tel-00780595.
Texte intégralLa, Vinh Hoa. « Security monitoring for network protocols and applications ». Thesis, Université Paris-Saclay (ComUE), 2016. http://www.theses.fr/2016SACLL006/document.
Texte intégralComputer security, also known as cyber-security or IT security, is always an emerging topic in computer science research. Because cyber attacks are growing in both volume and sophistication, protecting information systems or networks becomes a difficult task. Therefore, researchers in research community give an ongoing attention in security including two main directions: (i)-designing secured infrastructures with secured communication protocols and (ii)-monitoring/supervising the systems or networks in order to find and re-mediate vulnerabilities. The former assists the later by forming some additional monitoring-supporting modules. Whilst, the later verifies whether everything designed in the former is correctly and securely functioning as well as detecting security violations. This is the main topic of this thesis.This dissertation presents a security monitoring framework that takes into consideration different types of audit dataset including network traffic and application logs. We propose also some novel approaches based on supervised machine learning to pre-process and analyze the data input. Our framework is validated in a wide range of case studies including traditional TCP/IPv4 network monitoring (LAN, WAN, Internet monitoring), IoT/WSN using 6LoWPAN technology (IPv6), and other applications' logs. Last but not least, we provide a study regarding intrusion tolerance by design and propose an emulation-based approach to simultaneously detect and tolerate intrusion.In each case study, we describe how we collect the audit dataset, extract the relevant attributes, handle received data and decode their security meaning. For these goals, the tool Montimage Monitoring Tool (MMT) is used as the core of our approach. We assess also the solution's performance and its possibility to work in "larger scale" systems with more voluminous dataset
Scholte, Theodoor. « Amélioration de la sécurité par la conception des logiciels web ». Electronic Thesis or Diss., Paris, ENST, 2012. http://www.theses.fr/2012ENST0024.
Texte intégralThe web has become a backbone of our industry and daily life. The growing popularity of web applications and services and the increasing number of critical transactions being performed, has raised security concerns. For this reason, much effort has been spent over the past decade to make web applications more secure. Despite these efforts, recent data from SANS institute estimates that up to 60% of Internet attacks target web applications and critical vulnerabilities such as cross-site scripting and SQL injection are still very common. In this thesis, we conduct two empirical studies on a large number of web applications vulnerabilities with the aim of gaining deeper insights in how input validation flaws have evolved in the past decade and how these common vulnerabilities can be prevented. Our results suggest that the complexity of the attacks have not changed significantly and that many web problems are still simple in nature. Our studies also show that most SQL injection and a significant number of cross-site scripting vulnerabilities can be prevented using straight-forward validation mechanisms based on common data types. With these empirical results as foundation, we present IPAAS which helps developers that are unaware of security issues to write more secure web applications than they otherwise would do. It includes a novel technique for preventing the exploitation of cross-site scripting and SQL injection vulnerabilities based on automated data type detection of input parameters. We show that this technique results in significant and tangible security improvements for real web applications
Senegas, Stéphanie. « Applications de la similitude aux interactions ondes de choc-surface plane : sécurité des personnes ». Orléans, 2000. http://www.theses.fr/2000ORLE2059.
Texte intégralLepers, Bernard. « Coopération dynamique et sécurité homme-machine : applications en téléopération et chirurgie assistée par ordinateur ». Lille 1, 1990. http://www.theses.fr/1990LIL10048.
Texte intégralAverlant, Guillaume. « Contrôle d'accès dynamique et architecture de sécurité pour la protection des applications sous Android ». Thesis, Toulouse, INSA, 2019. http://www.theses.fr/2019ISAT0026.
Texte intégralIn this thesis, we specifically focus on the Android environment. Indeed, we noticed a lack in the capabilities of the Android permission model against a number of emerging threats. To address these threats, we propose a security policy that complements the current Android permission system. This policy aims at restricting dynamically, i.e. based on the current smartphone execution context, the execution rights and the ability to access smartphone resources for each installed application. Besides the security benefits, the use of such a policy allows a user to have a tighter control over the access ofapplications to privacy-related data. This security policy is the first contribution of this thesis. Furthermore, we designed a security architecture that implements the access control mechanisms required to carry out such a policy. This second contribution is based on a so-called "multi-level" architecture, i.e. made up of several components of different privilege levels. Specifically, these have been implemented both in the Android framework, in the Linux kernel, and in a hypervisor. The last contribution of this thesis involves the realization of a prototype of this architecture on a development board, associated with the presentation of tests that showcase the effectiveness and relevance of the approach
Laguillaumie, Fabien. « Signatures à vérification contrôlée basées sur des applications bilinéaires : conception et analyse de sécurité ». Caen, 2005. http://www.theses.fr/2005CAEN2008.
Texte intégralPellegrino, Giancarlo. « Détection d'anomalies logiques dans les logiciels d'entreprise multi-partis à travers des tests de sécurité ». Electronic Thesis or Diss., Paris, ENST, 2013. http://www.theses.fr/2013ENST0064.
Texte intégralMulti-party business applications are distributed computer programs implementing collaborative business functions. These applications are one of the main target of attackers who exploit vulnerabilities in order to perform malicious activities. The most prevalent classes of vulnerabilities are the consequence of insufficient validation of the user-provided input. However, the less-known class of logic vulnerabilities recently attracted the attention of researcher. According to the availability of software documentation, two testing techniques can be used: design verification via model checking, and black-box security testing. However, the former offers no support to test real implementations and the latter lacks the sophistication to detect logic flaws. In this thesis, we present two novel security testing techniques to detect logic flaws in multi-party business applicatons that tackle the shortcomings of the existing techniques. First, we present the verification via model checking of two security protocols. We then address the challenge of extending the results of the model checker to automatically test protocol implementations. Second, we present a novel black-box security testing technique that combines model inference, extraction of workflow and data flow patterns, and an attack pattern-based test case generation algorithm. Finally, we discuss the application of the technique developed in this thesis in an industrial setting. We used these techniques to discover previously-unknown design errors in SAML SSO and OpenID protocols, and ten logic vulnerabilities in eCommerce applications allowing an attacker to pay less or shop for free
Bursuc, Sergiu. « Contraintes de déductibilité dans une algèbre quotient : réduction de modèles et applications à la sécurité ». Cachan, Ecole normale supérieure, 2009. http://www.theses.fr/2009DENS0055.
Texte intégralTo enable formal and automated analysis of security protocols, one has to abstract implementations of cryptographic primitives by terms in a given algebra. However, the algebra can not be free, as cryptographic primitives have algebraic properties that are either relevant to their specification or else they can be simply observed in implementations at hand. These properties are sometimes essential for the execution of the protocol, but they also open the possibility for an attack, as they give to an intruder the means to deduce new information from the messages that he intercepts over the network. In consequence, there was much work over the last few years towards enriching the Dolev-Yao model, originally based on a free algebra, with algebraic properties, modelled by equational theories. In this thesis, driven by both practical and theoretical interests, we propose general decision procedures for the insecurity of protocols, that can be applied to several classes of equational theories
Bréjon, Jean-Baptiste. « Quantification de la sécurité des applications en présence d'attaques physiques et détection de chemins d'attaques ». Electronic Thesis or Diss., Sorbonne université, 2020. http://www.theses.fr/2020SORUS275.
Texte intégralEmbedded systems are processing and handling more and more sensitive data. The security of these systems is now a prime concern for those who designs them. Fault attacks are indented to disrupt the execution of programs through the manipulation of physical quantities in the system environment and enable an attacker to bypass security mechanisms or achieve privilege escalation. Software counter-measures are deployed to address this threat. Various analyses are now being used to assess the efficiency of the counter-measures once deployed but they are little or not automated, costly and limited in terms of code coverage of the possible behaviour and of faults types that can be analysed. We propose a method to analyse the robustness of binary code combining formal methods and symbolic execution. Performing the analysis at the binary positions the analysis after compilation which can affect the counter-measures and allows it to take into account information which is only visible at the binary level and which can be exploited to perform an attack. Formal methods are capable of exhaustiveness and thus allow the analysis to consider all possible configurations of inputs. The proposed analysis is nevertheless carried out with respect to a symbolic context, extracted by symbolic execution, which confines it to a realistic set of inputs and thus limits false positives. We have implemented this method in a tool called \texttt{RobustB}. It is automated from the source code. We propose three metrics synthesising the analysis results and helping the designer of counter-measures to assess the sensitivity of the code as a whole and at the granularity of an instruction
Martinez, Denis. « Détection de comportements à risque dans les applications en utilisant l'analyse statique ». Thesis, Montpellier, 2016. http://www.theses.fr/2016MONTT266.
Texte intégralThe mobile device world allows users to install applications on theirpersonal devices, but typically falls short in terms of security, because theusers lack any ability to judge if an application will be dangerous, and thereis no way to limit the harmfulness of a program after it is installed.We explore static analysis as a tool for risk assessment and detection of malware behavior. Our method characterizes as a rule-driven, partial program approach: one of our goals is to provide a convenient, expressive domain-specific language to express an abstract domain and associate behavior to the library functions of the system.Expressivity is an important asset to have and it is obtained by the means of abstraction. The mobile technologies evolve fast and new ways to develop programs frequently appear.A real-world static analysis solution absolutely needs to react fast to the arrival of new technologies, in order not to fall into obsolescence. Weshow how it is possible to develop static analyses, and then to reuse them across mutiple smartphone platforms
Hrizi, Fatma. « Mécanismes de contrôle pour les applications coopératives de sécurité routière dans les systèmes de transport intelligents ». Phd thesis, Télécom ParisTech, 2012. http://pastel.archives-ouvertes.fr/pastel-00998531.
Texte intégralHrizi, Fatma. « Mécanismes de contrôle pour les applications coopératives de sécurité routière dans les systèmes de transport intelligents ». Electronic Thesis or Diss., Paris, ENST, 2012. http://www.theses.fr/2012ENST0081.
Texte intégralIn the last decades, Intelligent Transportation Systems (ITS) have been considered as one of the most emerging research area due to their promising role in promoting traffic efficiency and enhancing road safety. ITS cooperative safety applications, being the most vital and critical, have gained a lot of attention. The effectiveness of these applications depends widely on the efficient exchange of two main types of information. The periodic awareness corresponding to the one-hop location information of surrounding environment and the multi-hop event-driven information generated at the detection of a safety situation. Due to the large scale characteristic of ITS, this information is expected to be subject to severe congestion which might impact its reliable reception. The goal of this thesis is to focus on the reliable and robust control of safety-related information by reducing the channel congestion and at the same time taking into account the requirements of safety applications. We address first the event-driven safety information. We proposed a multi-hop policy showed to improve the dissemination of the event-driven information. However, it remains strongly sensitive to the channel load resulting from periodic awareness transmissions. On the other hand, the effective transmission of event-driven information depends primarily on the accurate detection of safety events and accordingly on the accuracy of awareness. Thus, we provide an efficient awareness control mechanism in order to provide better accuracy and limit the channel congestion. The approaches proposed in this thesis have deeply investigated the trade-off between ensuring the requirements of cooperative safety and the efficient management of congestion in vehicular network
Druyer, Rémy. « Réseau sur puce sécurisé pour applications cryptographiques sur FPGA ». Thesis, Montpellier, 2017. http://www.theses.fr/2017MONTS023/document.
Texte intégralWhether through smartphones, portable game consoles, or high performances computing, Systems-on-Chip (SoC) have seen their use widely spread over the last two decades. This can be explained by the low power consumption of these circuits with the regard of the performances they are able to deliver, and the numerous function they can integrate. Since SoC are improving every day, they require better performances from interconnects that support their communications. In order to address this issue Network-on-Chip have emerged.In addition to ASICs, FPGA circuits are one of the possible choices when conceiving a SoC. Our first contribution was therefore to perform and study the performance of Hermes NoC initially designed for ASIC, on reconfigurable circuit. This allowed us to confirm that the architecture of the interconnection system must be adapted to that of the circuit in order to achieve the best possible performances. Thus, our second contribution was to design TrustNoC, an optimized NoC for FPGA platform, with low latency, high operating frequency, and a moderate quantity of logical resources required for implementation.Security is also a primordial aspect of systems-on-chip, and more generally, of all digital systems. Our latest contribution was to study the threats that target SoCs during all their life cycle, then to develop and integrate hardware security mechanisms to TrustNoC in order to counter IP hijacking, and software attacks. During the design of security mechanisms, we tried to limit as much as possible the overhead on NoC performances
Al-Kassar, Feras. « Testability Tarpits - Navigating the Challenges of Static Tools in Web Applications ». Electronic Thesis or Diss., Sorbonne université, 2023. http://www.theses.fr/2023SORUS675.
Texte intégralThe goal of this thesis was to evaluate the effectiveness of a combination of commercial and open source security scanners. Through experimentation, we identified various code patterns that hinder the ability of state-of-the-art tools to analyze projects. By detecting these patterns during the software development lifecycle, our approach can offer valuable feedback to developers regarding the testability of their code. Additionally, it enables them to more accurately evaluate the residual risk that their code might still contain vulnerabilities, even if static analyzers report no findings. Our approach also suggests alternative methods to transform the code and enhance its testability for SAST
Fenet, Serge. « Vers un paradigme de programmation pour les applications distribuées basé sur le comportement des insectes sociaux : application à la sécurité des réseaux ». Lyon 1, 2001. http://www.theses.fr/2001LYO10261.
Texte intégralBerradj, Adel. « Contrôle de la diffusion multi-saut pour la dissémination de messages d'alerte dans les réseaux véhiculaires ». Thesis, Toulouse 3, 2015. http://www.theses.fr/2015TOU30166/document.
Texte intégralRoad safety applications are the main motivation of vehicular networks, although other road traffic management and entertainment applications are considered. The multi-hop broadcasting communication is an important component of these applications, such as Road Hazard Signaling application where the multi-hop broadcasting is used to notify an accident on the road, a presence of animal, an object that blocks the road, sudden braking of the vehicle in front, etc. As the information handled in these applications is very critical and can affect the human life the dissemination must be fast and reliable. However, broadcasting messages over several hops comes with many challenges to overcome such as broadcast storm problem (i.e. redundant retransmissions, high load of the channel, high contention on the communication channel and thus, high packet loss rate) in the case of dense network, and the problem of disconnection when the network is sparse. In addition, road safety applications are time-critical and satisfaction of their demands is very difficult because there is a trade-off between the dissemination reliability and the delivery delay. Many studies have been conducted in recent years and a variety of mechanisms have been proposed. However, most of them still suffer from problems of collisions when the network is dense and a high latency when the density of the network is low. The aim of this thesis is to analyze protocols allowing a reliable and fast delivery of alert messages, understand their limitations and propose a solution for fast and reliable dissemination of safety information in vehicular networks
Badrignans, Benoît. « Utilisation des FPGAs dans le contexte des applications sécurisées ». Montpellier 2, 2009. http://www.theses.fr/2009MON20184.
Texte intégralMotivations to employ FPGAs (Field-Programmable Gate Array) in secured applications are multiple : hardware configuration can be updated all along system life-cycle, FPGA can be finely configured to implement cryptographic functions efficiently, secured applications generally generate low sales volumes making FPGAs more attractive than ASICs (Application Specific Integrated Circuits). However secured ASICs often contains special features that are not available in all FPGAs, for instance most current FPGAs do not include non-volatile memories that are useful for secured applications, for instance to store cryptographic key. Moreover FPGA designers that have security concerns must use those devices carefully. Like secured applications implemented on ASICs, FPGA-based systems are subject to attacks. Those threats can be found at software, logical or physical level. In the particular case of FPGAs, attacks can also focus configuration process, and thereby modify functions implemented inside FPGA user logic. The main goal of this thesis is to study FPGAs devices in the general field of secured applications. Since the topic is vast, this works mainly focus on FPGAs bitstream management. First it offers a state of the art of FPGA security mechanisms and good practices, and also performances analysis achievable using hardware implementation of cryptographic algorithm in current FPGAs. Then it highlights security issues specific to FPGA, like bitstream replay attack, and proposes solutions to enhance bitstream management security, focusing on the security of remote update of FPGA bitstreams. Finally results of this work are applied to a real concrete case, a platform based on a FPGA device. This platform was developed during the thesis in collaboration with LIRMM laboratory and Netheos company. This last part offers a practical and an industrial point of view that allows readers to measure pertinence of proposed solutions
Saleh, Mohammad. « Secure communications in wireless networks for biomedical EEG sensor networks applications ». Thesis, Bourgogne Franche-Comté, 2018. http://www.theses.fr/2018UBFCA024/document.
Texte intégralThe general framework of the thesis concerns sensor networks and the privacy protocols for wireless communications in the implementation of reliable healthcare systems. More precisely, it presents a novel biomedical wireless sensor Network monitoring system, as a predictor and advance sensitive portable electroencephalogram (EEG). The EEG wireless sensor network proposed to monitor spontaneous brain waves, including normal and abnormal waves, for the patients suffering from different types of epilepsy. The biomedical epilepsy wireless sensor Network monitoring system (WSN-EEG) read’s signals from a wireless sensor network on the patient scalp, and filter these signals to run parallel data processing for the brain waves. However, the predicting procedure for the severity of the forthcoming epileptic attack based on, a proposed mathematical model, which analyses the abnormality in the brain waves and alerts by giving signals for the patient. This method can save many patients by predicting the seizure before it occurs and helps them from different injuries and risky behavior arising during epilepsy attack. In addition, the proposed approaches can use the patient data for further medical diagnosis measures. Another approach is proposed as a learning-based approach for prediction using Feed Forward Neural Network (FFNN) for the alert system. The research used the IEEE802.11n as a communication method for the wireless sensor networks and measure the IEEE802.11n security performances as privacy protocol for data transmission of the proposed systems. The measurements indicated the calibration of the prediction algorithms to take account of the delays introduced by the security of the communications in the data transmission and seizure prediction which might significantly reduce prediction time and delay the alert signals
Tseng, Yuchia. « Securing network applications in software defined networking ». Electronic Thesis or Diss., Sorbonne Paris Cité, 2018. http://www.theses.fr/2018USPCB036.
Texte intégralThe rapid development and convergence of computing technologies and communications create the need to connect diverse devices with different operating systems and protocols. This resulted in numerous challenges to provide seamless integration of a large amount of heterogeneous physical devices or entities. Hence, Software-defined Networks (SDN), as an emerging paradigm, has the potential to revolutionize the legacy network management and accelerate the network innovation by centralizing the control and visibility over the network. However, security issues remain a significant concern and impede SDN from being widely adopted.To identity the threats that inherent to SDN, we conducted a deep analysis in 3 dimensions to evaluate the security of the proposed architecture. In this analysis, we summarized 9security principles for the SDN controller and checked the security of the current well-known SDN controllers with those principles. We found that the SDN controllers, namely ONOS and OpenContrail, are relatively two more secure controllers according to our conducted methodology. We also found the urgent need to integrate the mechanisms such as connection verification, application-based access control, and data-to-control traffic control for securely implementing a SDN controller. In this thesis, we focus on the app-to-control threats, which could be partially mitigated by the application-based access control. As the malicious network application can be injected to the SDN controller through external APIs, i.e., RESTful APIs, or internal APIs, including OSGi bundles, Java APIs, Python APIs etc. In this thesis, we discuss how to protect the SDN controller against the malicious operations caused by the network application injection both through the external APIs and the internal APIs. We proposed a security-enhancing layer (SE-layer) to protect the interaction between the control plane and the application plane in an efficient way with the fine-grained access control, especially hardening the SDN controller against the attacks from the external APIs. This SE-layer is implemented in the RESTful-based northbound interfaces in the SDN controller and hence it is controller-independent for working with most popular controllers, such as OpenDaylight, ONOS, Floodlight, Ryu and POX, with low deployment complexity. No modifications of the source codes are required in their implementations while the overall security of the SDN controller is enhanced. Our developed prototype I, Controller SEPA, protects well the SDN controller with network application authentication, authorization, application isolation, and information shielding with negligible latency from less than 0.1% to 0.3% for protecting SDN controller against the attacks via external APIs, i.e, RESTful APIs. We developed also the SE-layer prototype II, called Controller DAC, which makes dynamic the access control. Controller DAC can detect the API abuse from the external APIs by accounting the network application operation with latency less than 0.5%. Thanks to this SE-layer, the overall security of the SDN controller is improved but with a latency of less than 0.5%. However, the SE-layer can isolate the network application to communicate the controller only through the RESTful APIs. However, the RESTful APIs is insufficient in the use cases which needs the real-time service to deliver the OpenFlow messages. Therefore, we proposed a security-enhancing architecture for securing the network application deployment through the internal APIs in SDN, with a new SDN architecture dubbed SENAD. In SENAD, we split the SDN controller in: (1) a data plane controller (DPC), and (2) an application plane controller (APC) and adopt the message bus system as the northbound interface instead of the RESTful APIs for providing the service to deliver the OpenFlow messages in real-time. (...)
Tanguy, Eric. « Développement d'un laser verre codopé erbium et ytterbium compact à sécurité oculaire pour des applications de télémétrie ». Phd thesis, Université Paris Sud - Paris XI, 1996. http://tel.archives-ouvertes.fr/tel-00937945.
Texte intégralScholte, Theodoor. « Amélioration de la sécurité par la conception des logiciels web ». Thesis, Paris, ENST, 2012. http://www.theses.fr/2012ENST0024/document.
Texte intégralThe web has become a backbone of our industry and daily life. The growing popularity of web applications and services and the increasing number of critical transactions being performed, has raised security concerns. For this reason, much effort has been spent over the past decade to make web applications more secure. Despite these efforts, recent data from SANS institute estimates that up to 60% of Internet attacks target web applications and critical vulnerabilities such as cross-site scripting and SQL injection are still very common. In this thesis, we conduct two empirical studies on a large number of web applications vulnerabilities with the aim of gaining deeper insights in how input validation flaws have evolved in the past decade and how these common vulnerabilities can be prevented. Our results suggest that the complexity of the attacks have not changed significantly and that many web problems are still simple in nature. Our studies also show that most SQL injection and a significant number of cross-site scripting vulnerabilities can be prevented using straight-forward validation mechanisms based on common data types. With these empirical results as foundation, we present IPAAS which helps developers that are unaware of security issues to write more secure web applications than they otherwise would do. It includes a novel technique for preventing the exploitation of cross-site scripting and SQL injection vulnerabilities based on automated data type detection of input parameters. We show that this technique results in significant and tangible security improvements for real web applications
Hiet, Guillaume. « Détection d'intrusions paramétrée par la politique de sécurité grâce au contrôle collaboratif des flux d'informations au sein du système d'exploitation et des applications : mise en œuvre sous Linux pour les programmes Java ». Phd thesis, Université Rennes 1, 2008. http://tel.archives-ouvertes.fr/tel-00355089.
Texte intégralHarb, Naim. « Dynamically and Partially Reconfigurable Embedded System Architecture for Automotive and Multimedia Applications ». Valenciennes, 2011. http://ged.univ-valenciennes.fr/nuxeo/site/esupversions/1810c575-b28e-4817-a3be-f0527631eabd.
Texte intégralShort time-to-market windows, high design and fabricationcosts, and fast changing standards of application-specificprocessors, make them a costly and risky investment for embedded system designers. To overcome these problems, embedded system designersare increasingly relying on Field Programmable Gate Arrays(FPGAs) as target design platforms. FPGAs are generally slower and consumemore power than application-specific integrated circuits(ASICs), and this can restrict their use to limited applicationdomains. However, recent advances in FPGA architectures,such as dynamic partial reconfiguration (DPR), are helpingbridge this gap. DPR reduces area and enables mutually exclusive subsystemsto share the same physical space on a chip. It also reducescomplexity, which usually results in faster circuits and lowerpower consumption. The work in this PhD targets first a Driver Assistant System (DAS) system based on a Multiple Target Tracking (MTT) algorithm as our automotive base system. We present a dynamically reconfigurable filtering hardwareblock for MTT applications in DAS. Our system shows thatthere will be no reconfiguration overhead because the systemwill still be functioning with the original configuration until thesystem reconfigures itself. The free reconfigurable regions canbe implemented as improvement blocks for other DAS systemfunctionalities. Two approaches were used to design the filtering block according to driving conditions. We then target another application on the basis of DPR, the H. 264 encoder as a multimedia system. Regarding the H. 264 multimedia system, we propose a reconfigurable H. 264 Motion Estimation (ME) unit whose architecture can be modified to meet specific energy and image quality constraints. By using DPR, we were able to support multiple configurations each with different levels of accuracy and energy consumption. Image accuracy levels were controlled via application demands, user demands or support demands
Pellegrino, Giancarlo. « Détection d'anomalies logiques dans les logiciels d'entreprise multi-partis à travers des tests de sécurité ». Thesis, Paris, ENST, 2013. http://www.theses.fr/2013ENST0064/document.
Texte intégralMulti-party business applications are distributed computer programs implementing collaborative business functions. These applications are one of the main target of attackers who exploit vulnerabilities in order to perform malicious activities. The most prevalent classes of vulnerabilities are the consequence of insufficient validation of the user-provided input. However, the less-known class of logic vulnerabilities recently attracted the attention of researcher. According to the availability of software documentation, two testing techniques can be used: design verification via model checking, and black-box security testing. However, the former offers no support to test real implementations and the latter lacks the sophistication to detect logic flaws. In this thesis, we present two novel security testing techniques to detect logic flaws in multi-party business applicatons that tackle the shortcomings of the existing techniques. First, we present the verification via model checking of two security protocols. We then address the challenge of extending the results of the model checker to automatically test protocol implementations. Second, we present a novel black-box security testing technique that combines model inference, extraction of workflow and data flow patterns, and an attack pattern-based test case generation algorithm. Finally, we discuss the application of the technique developed in this thesis in an industrial setting. We used these techniques to discover previously-unknown design errors in SAML SSO and OpenID protocols, and ten logic vulnerabilities in eCommerce applications allowing an attacker to pay less or shop for free
Kopka, Bernard. « Étude et validation d'une redondance homogène d'ordre deux à décalage temporel pour des applications à haut niveau de sécurité ». Nancy 1, 1988. http://www.theses.fr/1988NAN10041.
Texte intégralLabe, Alice. « Etude des mécanismes lésionnels de la région abdomino-pelvienne : applications à la traumatologie virtuelle et à la sécurité routière ». Aix-Marseille 2, 2008. http://theses.univ-amu.fr.lama.univ-amu.fr/2008AIX22031.pdf.
Texte intégralPelvic and abdominal segments are high complex mechanical structures. Tissues which it contains are very different in terms of composition, mechanical function or mobility. Pelvic or abdominal traumatisms are a frequent pathology mainly due to motor vehicles accidents. The proximity of rigid structures, vital organs and a rich vascularization is considered as a worsening factor. Pelvic fractures and organ lacerations often cause severe haemorrhages leading to a high mortality rate. Therefore, it is vital to clearly understand how such traumatisms initiate and propagate in order to develop effective treatment methods. Finite element models are very attractive candidates for such tasks because of their apparent advantages against experimental methods. The model we have chosen to develop should be a graphical and a mechanical tool which could reproduce injury mechanisms of the pelvis and the abdomen in crash situations. Developing finite element models able to perform such tasks is not trivial. Firstly, one needs a model that accurately reflects the geometry and material properties of the human abdominal and pelvic segments. Particularly, the model should integrate a realistic venous and arterial system. Moreover, mechanical properties should be adapted as well as interactions and dynamic effects. The model geometry was obtained by using a semi-automatic CT-scan image segmentation technique. The model is made of more than 2 million elements, composed of triangular and tetrahedron elements. Element size was set between 1 and 2 mm as a compromise between accuracy (to describe macroscopic failure processes) and computation time (constraints imposed by the solver). Material cards are defined on mechanical data accessible from the literature and on experimental tests able to characterise human biological behaviour tissues. Then, the model should be rigorously validated with experimental measures. Impact simulations on the pelvis highlighted a high complex mechanical behaviour. Realistic failure profiles were obtained which allowed to evaluate pelvic traumatisms. Tolerance thresholds were defined on experimental tests realised on isolated organs. Finally, real crash situations were reproduced with frontal and lateral simulations on the whole model. Results are first compared with experimental data. Then, larger analyses offer data which would not have been accessible experimentally : an injury chronology and an injury evaluation on all abdominal and pelvic organs
Possemato, Andrea. « A Multidimensional Analysis of The Android Security Ecosystem ». Electronic Thesis or Diss., Sorbonne université, 2021. https://accesdistant.sorbonne-universite.fr/login?url=https://theses-intra.sorbonne-universite.fr/2021SORUS455.pdf.
Texte intégralWith more than 2.5 billion active devices based on Android, Google's mobile operating system is now one of the most widely used in the world.Despite all the efforts made by Google to constantly improve the security of the entire Android ecosystem, there are still several problems that remain unresolved. In this thesis, we analyse in detail some of the open problems that affect different components and players that are part of and contribute to the Android ecosystem. We start with the security analysis of the network communication of Android applications, showing how, even if Android provides several techniques to secure network communications, developers sometimes are still forced to use cleartext protocols. Our study continues with the analysis of another issue that puts the security and privacy of the user at risk. We analyze the vulnerabilities exploited by malicious applications to perform phishing attacks and how there is still no system in place to allow applications to protect themselves against these attacks. Last, we analyze what we think may be the perfect representation of how difficult it is to ensure security in a domain as extensive as Android analyzing how customizations, even though beneficial to vendors, can lead to security problems that are lowering down the overall security of the Android system. In this thesis, for each of the problems, we analyze the issue in detail, we measure how widespread it is, and we propose an alternative solution with the aim of solving the problem, making a step towards a more secure Android ecosystem
Allal, Salim. « Optimisation des échanges dans le routage géocast pour les réseaux de Véhicules Ad Hoc VANETs ». Thesis, Paris 13, 2014. http://www.theses.fr/2014PA132056/document.
Texte intégralVehicular ad hoc networks (VANETs) are a part of intelligent transportation systems (ITS). These letter attempt to answer the question of how to equip vehicles with wireless communication means to avoid accidents, better manage congestion and have positive impact on economics, energy and environment. Indeed, with wireless communication mechanisms such as IEEE 802.11p, a vehicle may exchange information with its near neighbors at one hop or at two furthur hops trhough relaying messages technique across intermediate vehicles. Some of these messages may cover vehicles wich are in a defined geographical area and spread throughout the network will consume bandwidth and penalize other vehicles. This is the case for information on the road trafic, for example. In the latter case, routing protocols said Geocast are used for the dissemination of these messages. The protocols are used to route a message from a unique source to multiple destination vehicles locked in the same geographic area. In this thesis, we considered the case where we have several geographic areas of interest and have proposed a new Geocast routing mechanism, called GeoSUZ, for conveying a message optimally between a source and multiple destination areas. An optimized broadcasting mechanism within an area is also combined with GeoSUZ algorithm to ensure end-to-end routing with minimal overhead
Uttha, Worachet. « Etude des politiques de sécurité pour les applications distribuées : le problème des dépendances transitives : modélisation, vérification et mise en oeuvre ». Thesis, Aix-Marseille, 2016. http://www.theses.fr/2016AIXM4044/document.
Texte intégralThe access control is a fundamental ingredient of computer security. Since the 70s, the research in this area has provided many solutions to the privacy issue of personal data with applications to different environments (operating systems, databases, etc.). Among many access control models, we are interested in the model based on organisations (OrBAC) and we propose an extension adapted to distributed environments such as web services. This extended model is able, in particular, to handle access transitive requests. This situation can occur when a service has to call another service that may need to invoke in turn one or more services to meet the initial demand.We call D-OrBAC (Distributed Organisation Based Access Control), the extension of OrBAC model with a notion of delegation represented by a delegation graph. This graph allows us to represent agreements between the different organisations involved in the chain of service invocations, and to keep track of transitive authorisations. We also propose an analytical technique based on Datalog that allows us to simulate execution of scenarios and to check for the existence of unsafe situations.Thereafter, we use rewriting techniques to ensure that the security policy specified via our D-OrBAC model complies with important properties such as termination and consistency. Finally, we implement for a case study, the mechanism of access request evaluations according to the XACML on the WSO2 Identity Server platform to show that our solution is able to provide both the desired functionality and the security for the system
Touzeau, Valentin. « Analyse statique de caches LRU : complexité, analyse optimale, et applications au calcul de pire temps d'exécution et à la sécurité ». Thesis, Université Grenoble Alpes (ComUE), 2019. http://www.theses.fr/2019GREAM041.
Texte intégralThe certification of real-time safety critical programs requires bounding their execution time.Due to the high impact of cache memories on memory access latency, modern Worst-Case Execution Time estimation tools include a cache analysis.The aim of this analysis is to statically predict if memory accesses result in a cache hit or a cache miss.This problem is undecidable in general, thus usual cache analyses perform some abstractions that lead to precision loss.One common assumption made to remove the source of undecidability is that all execution paths in the program are feasible.Making this hypothesis is reasonable because the safety of the analysis is preserved when adding spurious paths to the program model.However, classifying memory accesses as cache hits or misses is still hard in practice under this assumption, and efficient cache analysis usually involve additional approximations, again leading to precision loss.This thesis investigates the possibility of performing an optimally precise cache analysis under the common assumption that all execution paths in the program are feasible.We formally define the problems of classifying accesses as hits and misses, and prove that they are NP-hard or PSPACE-hard for common replacement policies (LRU, FIFO, NRU and PLRU).However, if these theoretical complexity results legitimate the use of additional abstraction, they do not preclude the existence of algorithms efficient in practice on industrial workloads.Because of the abstractions performed for efficiency reasons, cache analyses can usually classify accesses as Unknown in addition to Always-Hit (Must analysis) or Always-Miss (May analysis).Accesses classified as Unknown can lead to both a hit or a miss, depending on the program execution path followed.However, it can also be that they belong to one of the Always-Hit or Always-Miss category and that the cache analysis failed to classify them correctly because of a coarse approximation.We thus designed a new analysis for LRU instruction that is able to soundly classify some accesses into a new category, called Definitely Unknown, that represents accesses that can lead to both a hit or a miss.For those accesses, one knows for sure that their classification does not result from a coarse approximation but is a consequence of the program structure and cache configuration.By doing so, we also reduce the set of accesses that are candidate for a refined classification using more powerful and more costly analyses.Our main contribution is an analysis that can perform an optimally precise analysis of LRU instruction caches.We use a method called block focusing that allows an analysis to scale by only analyzing one cache block at a time.We thus take advantage of the low number of candidates for refinement left by our Definitely Unknown analysis.This analysis produces an optimal classification of memory accesses at a reasonable cost (a few times the cost of the usual May and Must analyses).We evaluate the impact of our precise cache analysis on the pipeline analysis.Indeed, when the cache analysis is not able to classify an access as Always-Hit or Always-Miss, the pipeline analysis must consider both cases.By providing a more precise memory access classification, we thus reduce the state space explored by the pipeline analysis and hence the WCET analysis time.Aside from this application of precise cache analysis to WCET estimation, we investigate the possibility of using the Definitely Unknown analysis in the domain of security.Indeed, caches can be used as side-channel to extract some sensitive data from a program execution, and we propose a variation of our Definitely Unknown analysis to help a developer finding the source of some information leakage
Graux, Pierre. « Challenges of native android applications : obfuscation and vulnerabilities ». Thesis, Rennes 1, 2020. http://www.theses.fr/2020REN1S047.
Texte intégralAndroid is the most used operating system and thus, ensuring security for its applications is an essential task. Securing an application consists in preventing potential attackers to divert the normal behavior of the targeted application. In particular, the attacker may take advantage of vulnerabilities left by the developer in the code and also tries to steal intellectual property of existing applications. To slow down the work of attackers who try to reverse the logic of a released application, developers are incited to track potential vulnerabilities and to introduce countermeasures in the code. Among the possible countermeasures, the obfuscation of the code is a technique that hides the real intent of the developer by making the code unavailable to an adversary using a reverse engineering tool. With the growing amount of malware and applications carrying sensitive information, obfuscating the code and searching vulnerabilities becomes essential. This thesis presents the impact of native code on both reverse-engineering and vulnerability finding applied to Android applications. First, by listing the possible interferences between assembly and bytecode, we highlight new obfuscation techniques and software vulnerabilities. Then, we propose new analysis techniques combining static and dynamic analysis blocks, such as taint tracking or system monitoring, to observe the code behaviors that have been obfuscated or to reveal new vulnerabilities. These two objectives have led us to develop two new tools. The first one spots a specific vulnerability that comes from inconsistently mixing native and Java data. The second one extracts the object level behavior of an application, regardless of whether this application contains native code, embedded for obfuscation purposes. Finally, we implemented these new methods and conducted experimental evaluations. In particular, we automatically found a vulnerability in the Android SSL library and we analyzed several Android firmware to detect usage of a specific class of obfuscation
Coulon, Bruno. « Les normes sécuritaires en milieu carcéral français : les théories et les applications : l'adaptation des normes au système carcéral et l'adaptabilité réciproque de ce système ». Aix-Marseille 3, 2000. http://www.theses.fr/2000AIX32018.
Texte intégral