Refine
Year of publication
- 2019 (2) (remove)
Document Type
- Doctoral Thesis (2) (remove)
Keywords
- evolution (1)
- long-living systems (1)
- model-based (1)
- security (1)
- software engineering (1)
Institute
- Institut für Softwaretechnik (2) (remove)
Absicherung der analytischen Interpretation von Geolokalisierungsdaten in der Mobilfunkforensik
(2019)
Abstract
Location based services maybe are within one of the most outstanding features of modern mobile devices. Despite the fact, that cached geolocation data could be used to reconstruct motion profiles, the amount of devices capable to provide these information in the field of criminal investigations is growing.
Motivation
The aim of this work is to generate in-depth knowledge to questions concerning geolocation in the field of mobile forensics, making especially somehow cached geolocation data forensically valuable. On top, tools meeting the specific requirements of law enforcement personnel shall be developed.
Problems
Geolocation processes within smartphones are quite complex. For the device to locate its position, different reference systems like GPS, cell towers or WiFi hot\-spots are used in a variety of ways. The whole mobile geolocation mechanism is proprietary to the device manufacturer and not build with forensic needs in mind. One major problem regarding forensic investigations is, that mainly reference points are being extracted and processed instead of real life device location data. In addition, these geolocation information only consist of bits and bytes or numeric values that have to be securely assigned to their intended meaning. The location data recovered are full of gaps providing only a part of the process or device usage. This possible loss of data has to be determined deriving a reliable measurement for the completeness, integrity and accuracy of data. Last but not least, as for every evidence within a criminal investigation, it has to be assured, that manipulations of the data or errors in position estimation have no disadvantageous effect on the analysis.
Research Questions
In the context of localisation services in modern smartphones, it always comes back to similar questions during forensic everyday life:
* Can locations be determined at any time?
* How accurate is the location of a smartphone?
* Can location data from smartphones endure in court?
Approach
For a better understanding of geolocation processes in modern smartphones and to evaluate the quality and reliability of the geolocation artefacts, information from different platforms shall be theoretically analysed as well as observed in-place during the geolocation process. The connection between data points and localisation context will be examined in predefined live experiments as well as desktop- and native applications on smartphones.
Results
Within the scope of this thesis self developed tools have been used for forensic investigations as well as analytical interpretation of geodata from modern smartphones. Hereby a generic model for assessing the quality of location data has emerged, which can be generally applied to geodata from mobile devices.
Software systems have an increasing impact on our daily lives. Many systems process sensitive data or control critical infrastructure. Providing secure software is therefore inevitable. Such systems are rarely being renewed regularly due to the high costs and effort. Oftentimes, systems that were planned and implemented to be secure, become insecure because their context evolves. These systems are connected to the Internet and therefore also constantly subject to new types of attacks. The security requirements of these systems remain unchanged, while, for example, discovery of a vulnerability of an encryption algorithm previously assumed to be secure requires a change of the system design. Some security requirements cannot be checked by the system’s design but only at run time. Furthermore, the sudden discovery of a security violation requires an immediate reaction to prevent a system shutdown. Knowledge regarding security best practices, attacks, and mitigations is generally available, yet rarely integrated part of software development or covering evolution.
This thesis examines how the security of long-living software systems can be preserved taking into account the influence of context evolutions. The goal of the proposed approach, S²EC²O, is to recover the security of model-based software systems using co-evolution.
An ontology-based knowledge base is introduced, capable of managing common, as well as system-specific knowledge relevant to security. A transformation achieves the connection of the knowledge base to the UML system model. By using semantic differences, knowledge inference, and the detection of inconsistencies in the knowledge base, context knowledge evolutions are detected.
A catalog containing rules to manage and recover security requirements uses detected context evolutions to propose potential co-evolutions to the system model which reestablish the compliance with security requirements.
S²EC²O uses security annotations to link models and executable code and provides support for run-time monitoring. The adaptation of running systems is being considered as is round-trip engineering, which integrates insights from the run time into the system model.
S²EC²O is amended by prototypical tool support. This tool is used to show S²EC²O’s applicability based on a case study targeting the medical information system iTrust.
This thesis at hand contributes to the development and maintenance of long-living software systems, regarding their security. The proposed approach will aid security experts: It detects security-relevant changes to the system context, determines the impact on the system’s security and facilitates co-evolutions to recover the compliance with the security requirements.