Abstract The Internet of Things (IoT) is becoming the future of the Internet with a large number of connected devices that are predicted to reach about 50 billion by 2020. With proliferation of IoT devices and need to increase information sharing in IoT applications, risk-based access control model has become the best candidate for both academic and commercial organizations to address access control issues. This model carries out a security risk analysis on the access request by using IoT contextual information to provide access decisions dynamically. This model solves challenges related to flexibility and scalability of the IoT system. Therefore, we propose an adaptive risk-based access control model for the IoT. This model uses real-time contextual information associated with the requesting user to calculate the security risk regarding each access request. It uses user attributes while making the access request, action severity, resource sensitivity and user risk history as inputs to analyze and calculate the risk value to determine the access decision. To detect abnormal and malicious actions, smart contracts are used to track and monitor user activities during the access session to detect and prevent potential security violations. In addition, as the risk estimation process is the essential stage to build a risk-based model, this paper provides a discussion of common risk estimation methods and then proposes the fuzzy inference system with expert judgment as to be the optimal approach to handle risk estimation process of the proposed risk-based model in the IoT system.

According to Cisco Global Cloud Index, cloud storage users will store 1.6 Gigabytes data per month by 2019, compared to 992 megabytes data per month in 2014. With this trend, it has been shown that more and more data will reside in cloud storage and it is expected to grow further. As cloud storage is becoming an option for users for keeping their data online, it comes with security concerns for protecting data from threats. This thesis addresses the need to investigate the security factors that will enable efficient security protection for data in cloud storage and the relationships that exist between the different security factors. Consequently, this research has developed a conceptual framework that supports security in cloud storage. The main contribution of this research is the development of a Cloud Storage Security Framework (CSSF) to support an integrative approach to understanding and evaluating security in cloud storage. The framework enables understanding of the makeup of security in cloud storage and measures the understanding of security in cloud storage. Drawing upon established theories and prior research findings, the framework indicates that security in cloud storage can be determined by nine factors: (1) security policies implementation in cloud storage, security measure that relates to (2) protecting the data accessed in cloud storage; (3) modifications of data stored; (4) accessibility of data stored in cloud storage; (5) non-repudiation to the data stored; (6) authenticity of the original data; (7) reliability of the cloud storage services; (8) accountability of service provision; and (9) auditability of the data accessed and stored in cloud storage. An example of CSSF application has been demonstrated through the development of a measuring instrument called Security Rating Score (SecRaS) and through a series of experiments, SecRaS has been validated and used in a research scenario. The instrument consists of several items generated using goal-question-metric approach. These potential items were evaluated by a series of experiments; the security experts assessed using content validity ratio while the security practitioners took part in the validation study. The validation study completed two experiments that look into the correlation analyses and internal reliability. SecRaS instrument was later applied in a research scenario; the validated instrument was distributed and a number of 218 usable responses were received. Using structural equation modelling, the data has revealed a good fit of the measurement analyses and structural model. The key findings were as follow: the relationships between factors were found to have both direct and indirect effects in the result. While establishing the relationship(s) among the factors, the structural model proposes three types of causal relationships in terms of how the security implementation in cloud storage could be affected by the security factors. This thesis presents a detailed discussion of the CSSF development, confirmation, and application in a research scenario. For security managers, CSSF offers a new paradigm on how stakeholders can make cloud storage security implementation successful in some depth. For security practitioners, the CSSF enables deconstruction of the concept of security in cloud storage into smaller, conceptually distinct and manageable factors to guide the design of security in cloud storage. For researchers, the CSSF provides a common framework in which to conceptualise their research and make it easier to see how the security factors fit into the larger picture.

Although the Internet of things (IoT) brought unlimited benefits, it also brought many security issues. The access control is one of the main elements to address these issues. It provides the access to system resources only to authorized users and ensures that they behave in an authorized manner during their access sessions. One of the significant components of any access control model is access policies. They are used to build the criteria to permit or deny any access request. Building an efficient access control model for the IoT require selecting an appropriate access policy language to implement access policies. Therefore, this paper presents an overview of most common access policy languages. It starts with discussing different access control models and features of the access policy. After reviewing different access policy languages, we proposed XACML as the most efficient and appropriate policy language for the IoT as it compatible with different platforms, provides a distributed and flexible approach to work with different access control scenarios of the IoT system. In addition, we proposed an XACML model for an Adaptive Risk-Based Access Control (AdRBAC) for the IoT and showed how the access decision will be made using XACML.

The Internet of Things (IoT) represents a modern approach where boundaries between real and digital domains are progressively eliminated by changing over consistently every physical device to smart object ready to provide valuable services. These services provide a vital role in different life domains but at the same time create new challenges particularly in security and privacy. Authentication and access control models are considered as the essential elements to address these security and privacy challenges. Risk-based access control model is one of the dynamic access control models that provides more flexibility in accessing system resources. This model performs a risk analysis to estimate the security risk associated with each access request and uses the estimated risk to make the access decision. One of the essential elements in this model is the risk estimation process. Estimating risk is a complex operation that requires the consideration of a variety of factors in the access control environment. Moreover, the interpretation and estimation of the risk might vary depending on the working domain. This paper presents a review of different risk estimation techniques. Existing risk-based access control models are discussed and compared in terms of the risk estimation technique, risk factors, and the evaluation domain. Requirements for choosing the appropriate risk estimation technique for the IoT system are also demonstrated.

Cloud computing is paradigm that has emerged to deliver IT services to consumers as a utility service over the Internet. In developing countries, particularly Saudi Arabia, cloud computing is still not widely adopted. As a result, this study seeks to investigate the most influential factors that can encourage an organisation to use the cloud or which might impede them from moving to it. This research proposes an integrated model that incorporates aspects of the Technology-Organisation-Environment (TOE) framework and integrates the critical factors from existing theories along with other factors to examine the impact of this variable on the adoption decision of enterprises. Future work will be focused on confirming the proposed model.

As cloud becomes the tool of choice for more data storage services, the number of service providers has also increased. With these choices, organisations have a wide selection of services available to move their data to the cloud. However, the responsibility to maintain the security of sensitive data stored therein remains paramount. This paper will discuss some of the challenges of securing a cloud storage and putting it into context by reviewing relevant literature. The challenges associated with the three important security aspects (confidentiality, integrity and availability) are discussed together with the vulnerabilities linked to them. It is important to look into these challenges as cloud storage is not only about technological evolution but involves security considerations. We aim to provide insights of security challenges and its solutions to enhance cloud storage implementation.

With developments in grid computing and Web based data storage the task of orchestrating computations is becoming ever more difficult. Identifying which of the available computation resources and datasets to use is not trivial: it requires reasoning about the problem itself and the cost of moving data to complete the computation efficiently. This paper presents a conceptual notation and performance model that enables e-researchers to reason about their computations and make choices about the best use of resources.

In modern systems data is distributed and replicated. Its ownership is also distributed amongst a variety of stakeholders with differing requirements and expectations. A consequence is applications inevitably find data they need is missing or contains contradictions and inconsistencies from time to time leaving them unable to progress within their domain. Techniques such as transactions can help but are not enough as they rely on being able to impose their own consistency rules on data and this isn't always possible. What is required is an ability for applications to move forward despite the problems in local data by applying higher-level reasoning to that data. This paper describes DataWarp, a technique which empowers applications to make progress in such environments and illustrates its use to specify an efficient personal grid workflow scheduler.

Many developers who could benefit from building and analysing formal models of their systems are deterred from doing so by the process algebra style input languages of formal modelling languages which they find difficult to read and understand. This barrier to the adoption of formal modelling techniques can be significantly reduced if the process algebra is replaced with a graphical notation supported by a model generation tool. However, whilst having a diagrammatic base for the language appeals to the novice modeller, the diagrams can become cluttered for larger models. In this paper we address the issues of how to add hierarchical features to a graphical language without losing the fundamental benefits and appeal of having the graphical interface to the language. We illustrate these ideas using an existing formal modelling language

With the rise of distributed e-commerce in recent years, demand for automated negotiation has increased. In turn, this has facilitated a demand for ever more complex algorithms to conduct these negotiations. As the complexity of these algorithms increases, our ability to reason about and predict their behaviour in an ever larger and more diverse negotiation environment decreases. In addition, with the proliferation of internet-based negotiation, any algorithm also has to contend with potential reliability issues in the underlying message-passing infrastructure. These factors can create problems for building these algorithms, which need to incorporate methods for survival as well as negotiation. This paper proposes a simple yet effective framework for integrating survivability into negotiators, so they are better able to withstand imperfections in their environment. Results of an experiment are provided which show how the stability of a negotiation community is affected by incorporating an example survival behaviour into negotiators operating in an environment developed to support this framework.

RDT is a graphical formal modeling language in which the modeler works by constructing diagrams of the processes in their model which they join together to form complete systems. Aside from the benefits which accrue as a side effect of building a formal model of a proposed systems, these diagrammatic models can be useful as a means of communication between the development team and the users. However one of the greatest benefits of a formal model is that it can be subjected to rigorous examination to ensure that it satisfies properties required of the system. This paper describes the transformation used by the RDT toolset to generate Promela code (the input language of the SPIN model-checker) automatically from a model.

With computer systems becoming ever larger and more complex, the cost and effort associated with their construction is increasing and the systems are now sufficiently complex that developers need help to analyse and understand them. However, at design time, when this understanding is crucial, the system is unavailable because it has yet to be built. Formal, executable models can help with this problem by providing developers with a platform on which to establish the feasibility of a proposed design. However, commercial developers seem reluctant to employ this type of modelling in their design activity. This paper describes a modelling tool in which the traditional model generation technique of writing "programming language like" code is replaced with a model generation tool which uses a graphical representation of models whilst retaining sufficient formality to permit the models to be executed, or converted into code for analysis by a traditional model checking tool.

There is a continuing need for software engineers to design better-quality systems more quickly. Component-based technologies promise to make this possible, but modern systems are too complex for a full analysis of their behaviour to be practical. We propose that a reasonable alternative is to analyse abstract models of the essential features of a system. Since these models are abstract, they need contain only those details that are relevant to the aspect of the system under consideration. Consequently, they can be small enough to be constructed quickly and analysed thoroughly using formal methods. Tools are required which are accessible to the novice but which remain powerful enough to build models with a formal foundation so that they can be used by system designers who have limited expertise in the use of formal methods. We propose our tool, RolEnact, as a candidate for this role.