György Kálmán, Josef NollIEEE Symposium on Wireless Pervasive Computing, Santorini, Greece

Speaker:黃韋綸

User Controlled Content Access

Outline

2

IntroductionProposed ArchitectureThreatsConclusion

Introduction

Users are willing to share their own content (pictures, videos etc.),but lack the capability and the knowledge to protect themselves against theft.

The user has to buy a new hardware device.

3

Proposed Architecture - Content sharing with identity management and trusted component

4

Proposed Architecture – Direct key exchange

while in physical proximity, the user and the recipient are putting their phones close, and the public keys are exchanged automatically.

5

Proposed Architecture – Access rights update

The user made changes on the rights associated to his content and wants to update the server.

6

Proposed Architecture – Service discovery

User can put his phone close to a server, and the capabilities and the directory of the offered services is automatically downloaded to his phone, is possible also between two phones.

7

Compar

WiFi Bluetooth

Infrared NFC

Range 0 ~ 100 m

0 ~ 10 m

0 ~ 1 m < 50 cm

Transfer rate

High54 Mbps

Medium1 Mbps

Medium4 Mbps

Low54 Mbps

Security Low High Low Very High

Cost High Medium Medium Very Low

8

Threats - Problem areas in the user content sharing scenario

9

Threats - Eavesdroppers

WLANs broadcast information in a considerable range.

Countermeasures:symmetric encryption

10

Threats - Man in the Middle

Countermeasures:Identity checks.

The highest level of assurance may be reached with a trusted third party(CA).

11

Threats - Tampered software

Attackers may change the original code, install a trojan or hide other malicious program with the help of a rootkit.

Countermeasures:A possible solution is to use a SIM included in every mobile phone.

12

ConclusionMobile providers usually do not allow access to the SIM in order to ensure correct functionality of the network.

SIM has the potential to provide strong encryption services.

This paper propose a smartcard based right management solution, which is using the SIM of a mobile phone as trusted entity.

13