Iliadis John
jiliad@aegean.gr
An IT leader with more than 15 years of delivering budget-conscious business results and ensuring the secure operation and strategic transformation of resilient digital infrastructures, while inspiring people to expand their professional expertise and develop synergistic teams.
His published research work includes more than 20 international journal, conference papers and book chapter contributions (Information Systems Security and Contemporary Cryptography, both in Greek). His research results have been cited more than 250 times in journal papers, conference papers and patent applications. An online list of citations exists at Google Scholar.
He also maintains a LinkedIN profile and a personal homepage.
Research Interests
Mr. Iliadis' interests are focused in the following fields:
- Software Agents, Mobile Code Security
- Distributed Systems Security
- Computer Security
- Certification Service Providers and Public Key Infrastructure
- Network Security
Evaluation Activities
Mr. Iliadis has reviewed submitted papers (as a Reviewer or Associate Reviewer) at the following journals and conferences:
- Journal of Information Processing Systems Information Processing Systems, 2011
- 8th International Conference on Trust, Privacy & Security in Digital Business (TrustBus 2011) September 2011, Toulouse, France
- 25th Annual WG 11.3 Conference on Data and Applications Security and Privacy (DBSec'11) July, 2011, Richmond, Virginia USA.
- Sixth European Workshop on Public Key Services, Applications and Infrastructures (EuroPKI’09), September 2009, Pisa, Italy
- Computer Standards & Interfaces Journal (CSI 2008), Special Issue on Frameworks for Secure, Forensically Safe and Auditable Applications Elsevier Science, Vol 30, Issue 4, 2008
- IEEE Cosumer Communications and Networking Conference - Communications and Information Security (CCNC 2008), Las Vegas, USA, January 2008
- Second International Workshop on Critical Information Infrastructures Security (CRITIS’07), Benalmadena-Costa (Malaga), Spain, October 2007
- Third International Symposium on Information Assurance and Security (IAS07), Manchester, United Kingdom, August 2007
- 3rd International Workshop on Security, Privacy and Trust in Pervasive and Ubiquitous Computing (SECPERU07), Istanbul, Turkey, June 2007
- Fourth European PKI Workshop (EUROPKI07), Mallorca, Spain, June 2007
- Workshop in Information Security Theory and Practice 2007 (WISTP07), Heraklion, Greece, May 2007
- Computer and Communications Network Symposum, IEEE International Conference on Communications 2007 (ICC 2007), Glasgow, Scotland, UK, June 2007
- ACM Computer and Communications Security Conference (CCS 2006), ACM Press, October 2006, Virginia, USA
- IEEE 49th Global Telecommunications Conference (GLOBECOM'2006), San Francisco, California, USA, December 2006
- Third European PKI Workshop (EuroPKI '06), Torino, Italy, June 2006
- Internet Research journal, Special issue on Privacy and Anonymity in the Digital Era: Theory, Technologies, and Practice, Emerald Science, 2006
- 21st ACM Symposium on Applied Computing – Security, Track (Dijon: France), April 2006, Proceedings by ACM Press
- 10th Panhellenic Conference on Informatics (PCI'05), November 2005, Volos, Greece
- 4th International Workshop for Applied PKI (IWAP'05), Singapore, September 2005
- 8th Information Security Conference (ISC'05), Singapore, September 2005
- International Workshop on Mathematical Methods, Models and Architectures for Computer Networks Security (MMM-ACNS '05), September 2005, St. Petersburg, Russia
- 2nd International Conference on Trust, Privacy, and Security in Digital Business (TrustBus '05), held in conjunction with the 16th International Conference on Database and Expert Systems Applications (DEXA 2005), Copenhagen, Denmark, August 2005
- 1st International Workshop on Security, Privacy and Trust 2005 (held in conjunction with the Pervasive and Ubiquitous Computing IEEE International Conference on Pervasive Services 2005), Santorini, Greece, July 2005
- Second European PKI Workshop (EuroPKI '05), Kent, England, July 2005
- 20th IFIP International Information Security Conference (IFIPSEC '05), Makuhari-Messe, Chiba, Japan, May 2005
- International Journal of Information Security (Special Issue PKI: Research and Applications), Springer Verlag, 2005
- ICICS'04 Sixth International Conference on Information and Communications Security (ICICS '04), Malaga, Spain, October 2004
- Journal of Electronic Imaging, co-published by the International Society for Optical Engineering (SPIE) and the Society for Imaging Science and Technology, 2004
- IEEE GLOBECOM'2004 Global Telecommunications Conference - Security and Network Management Symposium, USA, November 2004
- ESORICS '04: 9th European Symposium on Research in Computer Security, Sophia Antipolis, France, September 2004
- TRUSTBUS'04 1st International Conference on Trust and Privacy of Digital Business, Saragosa, Spain, September 2004
- 1st European PKI Workshop: Research and Applications, Samos, Greece, June 2004
- Security Track of the ACM Symposium on Applied Computing, Nicosia, Cyprus, May 2004
- IFIPSEC 2003 International Conference, International Federation for Information Processing, Athens, Greece, 2003
R&D Activities - National
- Redesign of the Information System of GSIS (General Secretariat for Information Systems) to provide secure electronic services to internal and external users based on a Public Key Infrastructure, 2009-2010
Main tasks: Design of PKI services, redesign of existing services in order to adopt PKI mechanisms and benefit from them, study of new potential for interoperability between GSIS systems thank to the new PKI services.
- Security of the Greek Integrated Customs Information System Network (ICISNet), General Secretariat of Information Systems, 2008
Main tasks: Research Associate. Design of the security countermeasures to be implemented, satisfying the respective Risk Analysis performed on ICISNet and protecting ICISNet.
- Security Analysis for the Information System of the Hellenic Foundation for Social Security (ISS), Hellenic Foundation for Social Security 2002.
Main tasks: Research Associate. Study of the vulnerabilities and the respective security threats to the Information System of the Foundation for Social Security. Analysis of requirements and respective actions to be taken by the Foundation for Social Security. Development of a Security Policy for the Foundation for Social Security.
- Development and operation of a TTP infrastructure and services, in the framework of the Athens Chamber of Commerce and Industry (ACCI) Clearing House Development Programme, (1999-2000). Work subcontracted by Intracom, contract C02/99/0284.
Main tasks: Research Associate. Requirements analysis, design (UML) and implementation (MS VC++, cryptographic libraries, COTS base PKI software) of a Public Key Infrastructure (Certification Authority, Registration Authority, Timestamping and Notary services, Web and LDAP interface to the PKI services), operating at the ACCI Clearing House.
- Development and pilot operation of a TTP infrastructure and services, Athens Chamber of Commerce and Industry (ACCI), Clearing House Development Programme, (1997-1998).
Main tasks: Research Assistant, Analysis of requirements for a Trusted Third Party, operating at the Athens Chamber of Commerce and Industry, implementation, pilot deployment and pilot testing of the TTP, conducted a seminar for the ACCI TTP staff regarding the administration of the implemented TTP infrastructure.
R&D Activities - InterNational
- Automated Generation and Execution of Test Suites for Distributed Component-based Software (AGEDIS), IST-1999-20218, European Commission, 2001-2003
Main tasks: Project Management of the part of the contract undertook by Intrasoft Intl (Project Leader), software project management of tools for automated software testing.
- A Transport Information Agent for accessing the different ETIS data sources (ETIS-Agent), GMA2-2001-52035, GROWTH Programme, European Commission, 2003-2005.
Main tasks: Project Management, software project management for a software collecting and monitoring transport information from a variety of heterogeneous transport sources.
- Delivery of Mediterranean Destination Links in Unified Environments (DAEDALUS), EUMEDIS-311, European Commission, 2002-2005
Main tasks: Project Management of the part of the contract undertook by Intrasoft Intl (Project Leader), software project management of a tourist portal.
- Training on Information Technology in Southeastern Europe (TrainSEE), IST-2000-28181, DG Information Society, European Commission, 2001-2003.
Main tasks: System Administration of a SUN Solaris Server and an e learning platform, that was setup in this project to offer IT e learning services to trainees throughout Southeastern Europe.
- Electronic Court: judicial IT-based management (e Court), IST-2000-28199, DG Information Society, European Commission, 2002-2003.
Main tasks: Management of the part of the project undertook by Intrasoft Intl, improving the schema of the database that is being used by judicial personnel to store and retrieve multimedia judicial information.
- 6. Secure Mobile Payment Service (SEMOPS), EU Research Contract, IST Project, IST-2001-37055, IST-2001-37055D, European Commission, 2002-2004
Main tasks: Technical Management of the project, Quality Assurance of the project deliverables, creating UML diagrams (UML artifacts) in the process of design and analysis of the payment service.
- Security Critical Applications Based on Open Source Internet Protocols (SECRETS), EU Research Contract, IST Project IST-2000-29289, Accompanying Measures, European Commission, 2000-2002
Main tasks: Technical Management of the project, Quality Assurance of the project deliverables, applied research in the domain of Software Engineering in order to develop a framework for the evaluation of open source security software, management of a group of developers that implemented application prototypes using open source software, which were evaluated with the aforementioned evaluation framework.
- Quality in the Statistical Information Life-Cycle: A Distributed System for Data Validation (INSPECTOR), IST-2000-26347, DG Information Society, European Commission , 2001-2003.
Main tasks: Development of a statistical application prototype, in Inprise Delphi and MS Access.
- Study on the Scalability of Certificate Revocation and Certificate Suspension and Proposals for Enhancements on the Respective Mechanisms, EU Research Contract. Project ETD/99/502536, European Commission Directorate General III, 2000.
Main tasks: Research Associate. Taxonomy of revocation mechanisms, development of evaluation metrics for revocation mechanisms, comparative evaluation based on these metrics, proposed enhancements to these mechanisms according to the requirements set forth by EU Laws and regulatory framework (ETSI work on Digital Signatures and EU Directive on Digital Signatures).
- 10. COSACC - Coordination of Security Activities between Chambers of Commerce (EU Research Contract. Project 4001AD, RTD in Telematics for Administrations, Telematics Applications Programme, Fourth Framework Programme, European Commission, DGXIII, 1998-2000).
Main tasks: Research Associate. Identification of primary business needs of European Union Chambers of Commerce in electronic communications and related legal and regulatory issues, analysis of requirements for Trusted Third Party services to support electronic co operation and interconnection of European CoCs, design, implementation, pilot deployment and testing of TTP services and mechanisms for CoCs that participated in COSACC, design, implementation and testing of Electronic Seals for EU CoCs to issue to their members.
- 11. EUROMED-ETS - Trusted Third Party Services for Health Care in Europe, EU Research Contract. INFOSEC Office Project No 20820, DGXIII, ETS I, European Commission, 1997.
Main tasks: Research Assistant. Installation pilot testing and documentation of information security services (Certificate Server, Directory Server and an SSL compliant Web Server) to support an hierarchical telemedicine network that links isolated medical centers across Europe.
Scientific And Professional Organizations Membership
1. Member, Greek Computer Society
2. Member, Association for Computing Machinery
Copyright Notice: This material is presented to ensure timely dissemination of scholarly and technical work. Copyright and all rights therein are retained by authors or by other copyright holders. All persons copying this information are expected to adhere to the terms and constraints invoked by each author's copyright. In most cases, these works may not be reposted or mass reproduced without the explicit permission of the copyright holder.
Journals
E. Tsekmezoglou, J. Iliadis, A Critical View on Internet Voting Technology, The Electronic Journal for E-Commerce Tools & Applications (eJETA.org), Vol. 1, No. 4, 2005, http://www.ejeta.org/fourth-issue/e...
Abstract
We present a set of requirements for Internet voting protocols. We also present a short overview of the most prominent Internet voting protocols published so far, and we provide a comparative evaluation of those protocols, using the set of requirements we have developed. We proceed with discussing our thoughts regarding possible improvements in e-voting protocols. Internet is an application with a vision to the future. Nevertheless, a lot of work needs to be done before it can be accepted for large-scale elections.
We present a set of requirements for Internet voting protocols. We also present a short overview of the most prominent Internet voting protocols published so far, and we provide a comparative evaluation of those protocols, using the set of requirements we have developed. We proceed with discussing our thoughts regarding possible improvements in e-voting protocols. Internet is an application with a vision to the future. Nevertheless, a lot of work needs to be done before it can be accepted for large-scale elections.
K. Moulinos, J. Iliadis, V. Tsoumas, Towards Secure Sealing of Privacy Policies, Information Management and Computer Security, Vol. 12, No. 4, pp. 350-361, 2004, MCB University Press, http://dx.doi.org/10.1108/096852204...
Abstract
A common practice among companies with an online presence is to sign on to a "seal" programme in order to provide customers with a sense of security regarding the protection of their personal data. Companies must adhere to a set of rules, forming a privacy protection policy designed by the seal issuer in accordance to underlying laws, regulatory frameworks and related best practice. Some of the most widely used seal programmes are TRUSTe, BBOnline, WebTrust and BetterWeb. Using the functionality they offer a user can verify online that a specific organisation adheres to a published privacy policy. In this paper, we argue that the verifications means these programmes use are vulnerable to DNS spoofing attacks. Furthermore, we present a privacy policy verification ("seal") scheme, which is not vulnerable to the aforementioned attack. We also argue that there are disadvantages in operating seal schemes that attempt to publicly certify compliance levels with a self-regulatory privacy protection model. On the contrary, these disadvantages are softened when used in a regulatory model that has adopted comprehensive laws to ensure privacy protection.
A common practice among companies with an online presence is to sign on to a "seal" programme in order to provide customers with a sense of security regarding the protection of their personal data. Companies must adhere to a set of rules, forming a privacy protection policy designed by the seal issuer in accordance to underlying laws, regulatory frameworks and related best practice. Some of the most widely used seal programmes are TRUSTe, BBOnline, WebTrust and BetterWeb. Using the functionality they offer a user can verify online that a specific organisation adheres to a published privacy policy. In this paper, we argue that the verifications means these programmes use are vulnerable to DNS spoofing attacks. Furthermore, we present a privacy policy verification ("seal") scheme, which is not vulnerable to the aforementioned attack. We also argue that there are disadvantages in operating seal schemes that attempt to publicly certify compliance levels with a self-regulatory privacy protection model. On the contrary, these disadvantages are softened when used in a regulatory model that has adopted comprehensive laws to ensure privacy protection.
J. Iliadis, S. Gritzalis, D. Spinellis, D. De Cock, B. Preneel, D. Gritzalis, Towards a Framework for Evaluating Certificate Status Information Mechanisms, Computer Communications, Vol. 26, No. 16, pp. 1839-1850, 2003, Elsevier, http://www.sciencedirect.com/scienc..., indexed in SCI-E, IF = 0.556
Download Abstract
A wide spectrum of certi?cate revocation mechanisms is currently in use. A number of them have been proposed by standardisation bodies, while some others have originated from academic or private institutions. What is still missing is a systematic and robust framework for the sound evaluation of these mechanisms. We present a mechanism-neutral framework for the evaluation of certi?cate status information (CSI) mechanisms. These mechanisms collect, process and distribute CSI. A detailed demonstration of its exploitation is also provided. The demonstration is mainly based on the evaluation of Certi?cate Revocation Lists, as well as of the Online Certi?cate Status Protocol. Other well-known CSI mechanisms are also mentioned for completeness.
A wide spectrum of certi?cate revocation mechanisms is currently in use. A number of them have been proposed by standardisation bodies, while some others have originated from academic or private institutions. What is still missing is a systematic and robust framework for the sound evaluation of these mechanisms. We present a mechanism-neutral framework for the evaluation of certi?cate status information (CSI) mechanisms. These mechanisms collect, process and distribute CSI. A detailed demonstration of its exploitation is also provided. The demonstration is mainly based on the evaluation of Certi?cate Revocation Lists, as well as of the Online Certi?cate Status Protocol. Other well-known CSI mechanisms are also mentioned for completeness.
J. Iliadis, S. Gritzalis, D. Gritzalis, ADoCSI: Towards an Alternative Mechanism for Disseminating Certificate Status Information, Computer Communications, Vol. 26, No. 16, pp. 1851-1862, 2003, Elsevier, http://www.sciencedirect.com/scienc..., indexed in SCI-E, IF = 0.556
Abstract
Several mechanisms have been proposed for disseminating information regarding the status of a digital certi?cate, each one with its own advantages and disadvantages. We believe that what is still missing from such mechanisms is transparency. A user should not need to comprehend the mechanics of such mechanisms in order to verify a certi?cate. In this paper, we present a mechanism called Alternative mechanism for the Dissemination of Certi?cate Status Information that supports transparency in disseminating Certi?cate Status Information.
Several mechanisms have been proposed for disseminating information regarding the status of a digital certi?cate, each one with its own advantages and disadvantages. We believe that what is still missing from such mechanisms is transparency. A user should not need to comprehend the mechanics of such mechanisms in order to verify a certi?cate. In this paper, we present a mechanism called Alternative mechanism for the Dissemination of Certi?cate Status Information that supports transparency in disseminating Certi?cate Status Information.
D. Spinellis, K. Moulinos, J. Iliadis, D. Gritzalis, S. Gritzalis, S. K. Katsikas, Deploying a Secure Cyberbazaar by adding Trust on Commercial Transactions, The Electronic Journal for E-Commerce Tools & Applications, Vol. 1, No. 2, 2002, eJETA.org, http://www.ejeta.org/second-issue/e...
Abstract
Traditional business practice depends on trust relations between the transacting parties. One of the most important aspects of this trust is the quality of the offered services or products. The Web currently constitutes an enabler for Electronic Commerce, providing a global transaction platform that does not require physical presence. However, transferring trust from the physical world to the electronic one is a process that requires a trust infrastructure to be provided by the electronic world. We believe that current infrastructure models based on Trusted Third Parties can be enhanced. We introduce the notion of Digital Seals and we provide a mechanism for transferring the trust placed by users to companies in the physical world, to the electronic one.
Traditional business practice depends on trust relations between the transacting parties. One of the most important aspects of this trust is the quality of the offered services or products. The Web currently constitutes an enabler for Electronic Commerce, providing a global transaction platform that does not require physical presence. However, transferring trust from the physical world to the electronic one is a process that requires a trust infrastructure to be provided by the electronic world. We believe that current infrastructure models based on Trusted Third Parties can be enhanced. We introduce the notion of Digital Seals and we provide a mechanism for transferring the trust placed by users to companies in the physical world, to the electronic one.
S. Gritzalis, D. Gritzalis, K. Moulinos, J. Iliadis, An integrated Architecture for deploying a Virtual Private Medical Network over the Web, Medical Informatics and the Internet in Medicine journal, Vol. 26, No. 1, pp. 49-72, 2001, Taylor & Francis Publications, http://informahealthcare.com/doi/pd..., indexed in SCI-E, IF = 0.419
Abstract
In this paper we describe a pilot architecture aiming at protecting Web-based medical applications through the development of a virtual private medical network. The basic technology, which is utilized by this integrated architecture, is the Trusted Third Party (TTP). In specific, a TTP is used to generate, distribute, and revoke digital certificates to/from medical practitioners and healthcare organizations wishing to communicate in a secure way. Digital certificates and digital signatures are, in particular, used to provide peer and data origin authentication and access control functionalities. We also propose a logical Public Key Infrastructure (PKI) architecture, which is robust, scalable, and based on standards. This architecture aims at supporting large-scale healthcare applications. It supports openness, scalability, flexibility and extensibility, and can be integrated with existing TTP schemes and infrastructures offering transparency and adequate security. Finally, it is demonstrated that the proposed architecture enjoys all desirable usability characteristics, and meets the set of criteria, which constitutes an applicable framework for the development of trusted medical services over the Web.
In this paper we describe a pilot architecture aiming at protecting Web-based medical applications through the development of a virtual private medical network. The basic technology, which is utilized by this integrated architecture, is the Trusted Third Party (TTP). In specific, a TTP is used to generate, distribute, and revoke digital certificates to/from medical practitioners and healthcare organizations wishing to communicate in a secure way. Digital certificates and digital signatures are, in particular, used to provide peer and data origin authentication and access control functionalities. We also propose a logical Public Key Infrastructure (PKI) architecture, which is robust, scalable, and based on standards. This architecture aims at supporting large-scale healthcare applications. It supports openness, scalability, flexibility and extensibility, and can be integrated with existing TTP schemes and infrastructures offering transparency and adequate security. Finally, it is demonstrated that the proposed architecture enjoys all desirable usability characteristics, and meets the set of criteria, which constitutes an applicable framework for the development of trusted medical services over the Web.
S. Gritzalis, J. Iliadis, S. Oikonomopoulos, Distributed Component Software Security Issues on Deploying a Secure Electronic Marketplace, Information Management and Computer Security, Vol. 8, No. 1, pp. 5-13, 2000, MCB University Press, http://www.emeraldinsight.com/journ...
Abstract
A secure electronic marketplace involves a significant number of real-time transactions between remote systems, either for commercial or for authentication purposes. The underlying infrastructure of choice to support these transactions seems to be a distributed component architecture. Distributed component software (DCS) is the natural convergence of client/server network computing and object oriented technology in a mix providing reusability, scaleability and maintainability for software constructs. In DCS a client acquires references to objects provided by components located to remote machines and invokes methods of them as if they were located in its native environment. One implementation also provides the ability to pass objects by value, an approach recently examined also by others. The three major models in the distributed component software industry are OMG's CORBA, Sun's Enterprise Java Beans, and Microsoft's DCOM. Besides these, we will discuss the progress for interoperable DCS systems performed in TINA, an open architecture for telecommunications services based on CORBA distributed components. In this paper the security models of each architecture are described and their efficiency and flexibility are evaluated in a comparative manner. Finally, upcoming extensions are discussed.
A secure electronic marketplace involves a significant number of real-time transactions between remote systems, either for commercial or for authentication purposes. The underlying infrastructure of choice to support these transactions seems to be a distributed component architecture. Distributed component software (DCS) is the natural convergence of client/server network computing and object oriented technology in a mix providing reusability, scaleability and maintainability for software constructs. In DCS a client acquires references to objects provided by components located to remote machines and invokes methods of them as if they were located in its native environment. One implementation also provides the ability to pass objects by value, an approach recently examined also by others. The three major models in the distributed component software industry are OMG's CORBA, Sun's Enterprise Java Beans, and Microsoft's DCOM. Besides these, we will discuss the progress for interoperable DCS systems performed in TINA, an open architecture for telecommunications services based on CORBA distributed components. In this paper the security models of each architecture are described and their efficiency and flexibility are evaluated in a comparative manner. Finally, upcoming extensions are discussed.
S. Gritzalis, J. Iliadis, D. Gritzalis, D. Spinellis, S. K. Katsikas, Developing Secure Web based Medical Applications, Medical Informatics and the Internet in Medicine Journal, Vol. 24, No. 1, pp. 75-90, 1999, Taylor & Francis Publications, http://informahealthcare.com/doi/pd..., indexed in SCI-E, IF = 0.419
Abstract
The EUROMED-ETS pilot system offers a number of security functionalities using off-the-shelf available products, in order to protect Web-based medical applications. The basic concept used by the proposed security architecture is the Trusted Third Party (TTP). A TTP is used in order to generate, distribute and revoke digital certificates to medical practitioners and healthcare organizations that wish to communicate securely. Digital certificates and digital signatures are used to provide peer and data origin authentication and access control. The paper demonstrates how TTPs can be used effectively in order to develop medical applications that run securely over the World Wide Web.
The EUROMED-ETS pilot system offers a number of security functionalities using off-the-shelf available products, in order to protect Web-based medical applications. The basic concept used by the proposed security architecture is the Trusted Third Party (TTP). A TTP is used in order to generate, distribute and revoke digital certificates to medical practitioners and healthcare organizations that wish to communicate securely. Digital certificates and digital signatures are used to provide peer and data origin authentication and access control. The paper demonstrates how TTPs can be used effectively in order to develop medical applications that run securely over the World Wide Web.
D. Spinellis, S. Gritzalis, J. Iliadis, D. Gritzalis, S. K. Katsikas, Trusted third Party services for deploying secure telemedical applications over the Web, Computers & Security, Vol. 18, No. 7, pp. 627-639, 1999, Elsevier, http://www.sciencedirect.com/scienc..., indexed in SCI-E, IF = 0.743
Abstract
The EUROMED-ETS schema provides a robust security framework for telemedical applications operating over the World Wide Web. It is based on a trusted third party architecture under which certificate authorities store the public-key certificates of participating hospitals and medical practitioners. Digital signatures are used to provide peer and data origin authentication, and, in combination with access control lists, to provide access control. The deployed infrastructure is based on off-the-shelf available clients and servers, and provides functions for electronic registration of participants, session initialization, user authentication, key generation and personalization, certificate generation, distribution, storage and retrieval, certificate revocation lists, and auditing. It was found that, as the underlying technologies mature, a Web-based trusted third party architecture provides a viable solution for delivering secure telemedical applications.
The EUROMED-ETS schema provides a robust security framework for telemedical applications operating over the World Wide Web. It is based on a trusted third party architecture under which certificate authorities store the public-key certificates of participating hospitals and medical practitioners. Digital signatures are used to provide peer and data origin authentication, and, in combination with access control lists, to provide access control. The deployed infrastructure is based on off-the-shelf available clients and servers, and provides functions for electronic registration of participants, session initialization, user authentication, key generation and personalization, certificate generation, distribution, storage and retrieval, certificate revocation lists, and auditing. It was found that, as the underlying technologies mature, a Web-based trusted third party architecture provides a viable solution for delivering secure telemedical applications.
S. K. Katsikas, D. Spinellis, J. Iliadis, B. Blobel, Using trusted third parties for secure telemedical applications over the WWW: The EUROMED-ETS approach, International Journal of Medical Informatics, Vol. 49, No. 1, pp. 59-68, 1998, Elsevier Science
Abstract
This paper reports on the results obtained by the pilot operation of Trusted Third Parties (TTP) for secure telemedical applications over the WWW The work reported on herein was carried out within the context of EUROMED-ETS, a R&D project funded by the INFOSEC office of Directorate General XIII of the European Union. The paper discusses the platform used, the security needs of the specific application, the TTP solution provided, the steps taken in order to implement the solution at a pilot scale and the results of the pilot opreration; it is compiled using material included in the project deliverables.
This paper reports on the results obtained by the pilot operation of Trusted Third Parties (TTP) for secure telemedical applications over the WWW The work reported on herein was carried out within the context of EUROMED-ETS, a R&D project funded by the INFOSEC office of Directorate General XIII of the European Union. The paper discusses the platform used, the security needs of the specific application, the TTP solution provided, the steps taken in order to implement the solution at a pilot scale and the results of the pilot opreration; it is compiled using material included in the project deliverables.
Conferences
Abstract
There is a scale between authentication and anonymity, which is currently leaning towards the side of authentication, when it comes to e-commerce. Service providers and merchants are usually keeping track of user-related information in order to construct behavioural profiles of their customers. Service providers and merchants also correlate profiles of this kind, stemming from different sources, in order to increase their profit. This correlation is usually performed with the use of Unified Codes. Authentication, confidentiality, integrity, authentication, and non-repudiation are necessary functionalities for enabling e-commerce. Most of the currently used mechanisms that support these services do not provide anonymity. This paper presents PyTHIA, a mechanism, which is based on the use of Message Digest Algorithms and the intermediation of Trusted Third Parties in order to provide anonymity to e-commerce users who have to authenticate themselves in order to access services or buy goods from service providers and merchants respectively. With PyTHIA e-commerce users are able to authenticate without giving away any personal data and without using Unified Codes. In addition, PyTHIA ensures that service providers and merchants can effectively trace a customer in case he behaves maliciously.
There is a scale between authentication and anonymity, which is currently leaning towards the side of authentication, when it comes to e-commerce. Service providers and merchants are usually keeping track of user-related information in order to construct behavioural profiles of their customers. Service providers and merchants also correlate profiles of this kind, stemming from different sources, in order to increase their profit. This correlation is usually performed with the use of Unified Codes. Authentication, confidentiality, integrity, authentication, and non-repudiation are necessary functionalities for enabling e-commerce. Most of the currently used mechanisms that support these services do not provide anonymity. This paper presents PyTHIA, a mechanism, which is based on the use of Message Digest Algorithms and the intermediation of Trusted Third Parties in order to provide anonymity to e-commerce users who have to authenticate themselves in order to access services or buy goods from service providers and merchants respectively. With PyTHIA e-commerce users are able to authenticate without giving away any personal data and without using Unified Codes. In addition, PyTHIA ensures that service providers and merchants can effectively trace a customer in case he behaves maliciously.
Abstract
A number of mechanisms have been proposed for generating and disseminating information on the status of certificates. Their operation is different, if not contradicting sometimes, and advantages and disadvantages depend on the requirements of the underlying PKI. PKI designers and implementors should perform a small scale study before deploying such a mechanism in a specific PKI, in order to select the most suitable mechanism for their environment. This paper presents a method for categorising Certificate Status Information mechanisms, depending on their elementary functionality. This taxonomy can be used as a guide for selecting CSI mechanisms to be used in large-scale PKI deployment efforts.
A number of mechanisms have been proposed for generating and disseminating information on the status of certificates. Their operation is different, if not contradicting sometimes, and advantages and disadvantages depend on the requirements of the underlying PKI. PKI designers and implementors should perform a small scale study before deploying such a mechanism in a specific PKI, in order to select the most suitable mechanism for their environment. This paper presents a method for categorising Certificate Status Information mechanisms, depending on their elementary functionality. This taxonomy can be used as a guide for selecting CSI mechanisms to be used in large-scale PKI deployment efforts.
J. Iliadis, S. Gritzalis, V. Oikonomou, Towards Secure Downloadable Executable Content: The Java Paradigm, SAFECOMP, pp. 117-127, 1998, Springer LNCS 1516, http://link.springer.com/content/pd...
Abstract
Java is a programming language that conforms to the concept of downloadable, executable content. Java offers a wide range of capabilities to the application programmer, the most important being that a program may be executed remotely, without any modification, on almost any computer regardless of hardware configuration and operating system differences. However, this advantage raises a serious concern : security. When one downloads and executes code from various Internet sources, he is vulnerable to attacks by the code itself. A security scheme must be applied in order to secure the operations of Java programs. In this paper, the Java security scheme is examined and current implementations are evaluated on the basis of their efficiency and flexibility. Finally, proposed enhancements and upcoming extensions to the security model are described.
Java is a programming language that conforms to the concept of downloadable, executable content. Java offers a wide range of capabilities to the application programmer, the most important being that a program may be executed remotely, without any modification, on almost any computer regardless of hardware configuration and operating system differences. However, this advantage raises a serious concern : security. When one downloads and executes code from various Internet sources, he is vulnerable to attacks by the code itself. A security scheme must be applied in order to secure the operations of Java programs. In this paper, the Java security scheme is examined and current implementations are evaluated on the basis of their efficiency and flexibility. Finally, proposed enhancements and upcoming extensions to the security model are described.
S. Gritzalis, J. Iliadis, V. Oikonomou, Security issues surrounding the Java programming language, 14th IFIPSEC , pp. 3-14, 1998, IFIP & Austrian Computer Society, http://delivery.acm.org/10.1145/510...
Abstract
JAVA is claimed to be a programming language that introduces new methods for platform?independent development and remote execution. However, the ability to download, integrate, and execute code from a remote computer raises serious concerns about JAVA's effect on network security. In this paper, a brief introduction to the JAVA programming language is given, the potential security risks of downloadable executable content is discussed, the details of the proposed JAVA security mechanism are presented, and an evaluation of the current implementations is discussed. Finally, proposed enhancements and upcoming extensions to the security model are described.
JAVA is claimed to be a programming language that introduces new methods for platform?independent development and remote execution. However, the ability to download, integrate, and execute code from a remote computer raises serious concerns about JAVA's effect on network security. In this paper, a brief introduction to the JAVA programming language is given, the potential security risks of downloadable executable content is discussed, the details of the proposed JAVA security mechanism are presented, and an evaluation of the current implementations is discussed. Finally, proposed enhancements and upcoming extensions to the security model are described.
S. Gritzalis, J. Iliadis, Addressing security issues in programming languages for mobile code, DEXA 1998, pp. 288-293, 1998, IEEE CPS Conference Publishing Services, http://ieeexplore.ieee.org/xpl/logi...
Abstract
The services offered to the Internet community have been constantly increasing the last few years. This is mainly due to the fact that mobile code has matured enough in order to provide the Internet users with high quality applications that can be executed remotely. When a user downloads and executes code from various Internet sources, security issues arise. In this paper, we are addressing the latter and we present a comparative evaluation of the methods used by Java, Safe-Tcl and ActiveX in order to confront with these issues, based on current security functions and implementations as well as on future adjustments and extensions.
The services offered to the Internet community have been constantly increasing the last few years. This is mainly due to the fact that mobile code has matured enough in order to provide the Internet users with high quality applications that can be executed remotely. When a user downloads and executes code from various Internet sources, security issues arise. In this paper, we are addressing the latter and we present a comparative evaluation of the methods used by Java, Safe-Tcl and ActiveX in order to confront with these issues, based on current security functions and implementations as well as on future adjustments and extensions.
S. K. Katsikas, D. Spinellis, J. Iliadis, B. Blobel, Using trusted third parties for secure telemedical applications over the WWW: The EUROMED-ETS approach, Pre-Proceedings of the IMIA WG4 working Conference on Common Security Solutions for Communicating Patient Data, International Medical Informatics Association (IMIA), 1997,
Abstract
This paper reports on the results obtained by the pilot operation of Trusted Third Parties (TTP) for secure telemedical applications over the WWW The work reported on herein was carried out within the context of EUROMED-ETS, a R&D project funded by the INFOSEC office of Directorate General XIII of the European Union. The paper discusses the platform used, the security needs of the specific application, the TTP solution provided, the steps taken in order to implement the solution at a pilot scale and the results of the pilot opreration; it is compiled using material included in the project deliverables.
This paper reports on the results obtained by the pilot operation of Trusted Third Parties (TTP) for secure telemedical applications over the WWW The work reported on herein was carried out within the context of EUROMED-ETS, a R&D project funded by the INFOSEC office of Directorate General XIII of the European Union. The paper discusses the platform used, the security needs of the specific application, the TTP solution provided, the steps taken in order to implement the solution at a pilot scale and the results of the pilot opreration; it is compiled using material included in the project deliverables.