Personal trusted devices for web services: revisiting multilevel security

Authors:
Edgar Weippl;Wolfgang Essmayr
Affiliations:
Software Competence Center Hagenberg, www.scch.at, Hauptstr. 99, A-4232 Hagenberg, Austria;Software Competence Center Hagenberg, www.scch.at, Hauptstr. 99, A-4232 Hagenberg, Austria
Venue:
Mobile Networks and Applications - Security in mobile computing environments
Year:
2003

Citing 11
Cited 1

A public-key based secure mobile IP

Wireless Networks
Trust (and mistrust) in secure applications

Communications of the ACM
Security models for web-based applications

Communications of the ACM
An operating system approach to securing e-services

Communications of the ACM
Understanding and Using Context

Personal and Ubiquitous Computing
Get Wireless: A Mobile Technology Spectrum

IT Professional
A Pessimistic Approach to Trust in Mobile Agent Platforms

IEEE Internet Computing
Mobile Computing and Smart Spaces

IEEE Concurrency
Trusting Mobile User Devices and Security Modules

Computer
Identity Mapping: An Approach to Unravel Enterprise Security Management Policies

Proceedings of the IFIP TC11 Fifteenth Annual Working Conference on Information Security for Global Information Infrastructures
Going beyond the sandbox: an overview of the new security architecture in the javaTM development Kit 1.2

USITS'97 Proceedings of the USENIX Symposium on Internet Technologies and Systems on USENIX Symposium on Internet Technologies and Systems

Usability study of ME2.0

Personal and Ubiquitous Computing

Quantified Score

Hi-index	0.00

Visualization

Abstract

In this paper we revisit the concept of mandatory access control and investigate its potential with personal digital assistants (PDA). Only if applications are clearly separated and Trojans cannot leak personal information can these PDAs become personal trusted devices. Limited processing power and memory can be overcome by using Web services instead of full-fledged applications - a trend also in non-mobile computing. Web services, however, introduce additional security risks, some of them specific for mobile users. We propose an identification scheme that can be effectively used to protect privacy and show how this system builds upon a light-weight version of mandatory access control.