The rapid uptake of the Wireless Body Area Networks (WBAN) and their services poses unprecedented security requirements. WBAN are evolving to support these requirements. Fulfilling these tasks is challenging as their mobile context is increasingly complex, heterogeneous, and evolving. One potential solution to meet the WBAN security requirements is trust management that helps to reach a more secure and adaptable WBAN environment. Accordingly, this article aims to serve as a brief survey of trust management approaches within intra-WBAN and inter-WBAN. For that, we first summarize trust management concepts, discuss WBAN challenges and classify the attacks on WBAN trust management models. Subsequently, we detail and compare the existing trust based approaches in a WBAN context. We pinpoint their limitations and provide a new classification of these different approaches. We also propose a set of best practices that may help the reader to build a robust and an efficient trust management framework. We complete this survey by highlighting the open future directions and perspectives for research.

No abstract

No abstract

International audienceThe secure deployment of an application requires the definition of the security properties that it should meet. This is typically performed on the basis of a security policy, which aims at providing a concrete view of security requirements to the application developer. In this paper, we propose a framework to manage security policies that could be associated with applications based on an AOP approach. The paper shows mainly how different aspects types can be generated using the knowledge defined within the security policies. BesKyotoides, it proposes an approach to weave the generated aspects within application code

No abstract

No abstract

Current information systems are more and more complex. They require more interactions between different components and users. So, ensuring system security must not be limited to using an access control model but also, it is primordial to deal with information flows in a system. Thus, an important function of a security policy is to enforce access to different system elements and supervise information flows simultaneously. Several works have been undertaken to join together models of access control and information flow. Unfortunately, beyond the fact that the reference model they use is BLP which is quite rigid, these research works suggest a non integrated models which do nothing but juxtapose access control and information flow controls or are based on a misuse of a mapping between MLS and RBAC models. In this paper, we suggest to formalize DTE model in order to use it as a solution for a flexible information flow control. Then, we integrate it into an unique access control model expressive enough to handle access and flow control security rules. The expressivity of the OrBAC model makes this integration possible and quite natural.

No abstract