researResearch - Télécom Bretagne

esearc
researResearch
architecture of privacy management for
composed services. Regarding security in
domotic networks, the work carried out on the
use of IPv6 for the confinement of services led to
the writing of a patent which has been submitted
to the INPI [8]. This work is being done in
collaboration with the structural project Pratic as
a thesis financed by the Brittany Regional
Council. Also, we have proposed new reputation
evaluation mechanisms for group management
in ad-hoc networks and shown their efficiency
compared to existing mechanisms [4]
Intrusion detection and reaction
techniques
Work carried out within the CELTIC/RED
European project deals with the conception of a
supervision platform enabling the establishment
of a sufficiently precise diagnosis of the detected
intrusion to then be able to activate an adapted
reaction to the intrusion[5]. The supervision
platform is based on three levels of reaction : (1)
the lower level following a low grade diagnosis
and triggering a reaction in the form of « reflex »
actions, (2) the intermediate level based on a
diagnosis relying on the fusion and correlation
techniques developed in CRIM (Correlation and
recognition of malicious intentions) and the
activation of reactions whose purpose is to block
the intrusion and (3) the higher level
corresponding to redeployment of the security
policy : automatic activation of the OrBAC
security rules enabling the intrusion to be dealt
with and the reconfiguration of the security
components to take these security rules into
account. Within the CIFRE bourse framework and
in collaboration with Alcatel-Lucent, we have
defined a model to evaluate the impact of an
intrusion as well as the consequences of a
reaction. Another CIFRE bourse in collaboration
with Orange Labs, has allowed current work to
deal with the management of inter-service
dependence. The different projects share a
common goal, namely, the selection of the most
appropriate reaction to deal with the intrusion.
Conception and testing of security
policies
This work, which has been carried out within the
regionally funded SETEQUI thesis framework,
aims principally at developing automatic
techniques for testing the implantation of
security mechanisms. The work enabled us to
define the difference between a functional testing
and a security testing and to study several
criteria for test generation from an access
control model. These criteria were compared on
experimental case studies with the test efficiency
being measured using an adaptation of the
mutation approach (error injection into a
programme). To ensure independence of the
access control language used (DAC, RBAC,
OrBac), we use a model driven engineering
technique to express the semantics of security
errors to the highest level (using a meta-model
extended with an operational semantic). Since
the aim is preventive, we propose solutions for
the automatic insertion of security mechanisms
into the code (Aspect-Oriented Programming
techniques), in order to transform semiautomatically
the existing functional tests into
security tests (modification of the oracle
function) or to locate the existing mechanisms
hard coded in the application when the security
policy evolves.
180