Keywords: trusted computing, mobile cloud computing, attestation, energy efficiency, fuzzy logic, ant colony system

As living in the cyber era, we admit that a dozen of new technologies have been born every day with the promises that making a human life be more comfortable, convenient and safe. In the forest of new technologies, mobile computing is raise as an essential part of human life. Normally, mobile devices have become the best companions in daily activities.

They have served us from the simple activities like entertainment to the complicated one as business operations. As playing the important roles, mobile devices deserve to work in the environment which they can trust for serving us better. In this thesis, we investigate the way to secure mobile devices from the primitive security level (Trusted Platforms) to the sophisticated one (bio-inspired intelligence). More precisely, after addressing the challenges of mobile cloud computing (MCC), we have studied the real-case of mobile cloud computing, in terms of energy efficiency and performance, as well as proposed a demonstration of particular MCC model, called Droplock system. Moreover, taking advantages of trusted platform module functionality, we introduced a novel schema of remote attestation to secure mobile devices in the context of Mobile-Cloud based solution. To enhance the security level, we used fuzzy logic combining with ant colony system to assess the trust and reputation for securing another mobile cloud computing model based on the cloudlet notion.

Résumé

Nous vivons aujourd'hui dans l'ère cybernétique où de nouvelles technologies naissent chaque jour avec la promesse de rendre la vie humaine plus confortable, pratique et sûre.

Parmi ces nouvelles technologies, l'informatique mobile se développe en influençant la vie de l'utilisateur. En effet, les plates-formes mobiles (smartphone, tablette) sont devenues les meilleurs compagnons de l'utilisateur pour mener à bien ses activités quotidiennes, comme les activités commerciales ou de divertissement. En jouant ces rôles importants, les plates-formes mobiles doivent opérer dans des environnements de confiance. Dans cette thèse, nous étudions la sécurité des plates-formes mobiles en passant d'un niveau de sécurité primitif qui s'appuie sur les plates-formes de confiance, à un niveau plus sophistiqué qui se base sur de l'intelligence bio-inspirée. Plus précisément, après avoir abordé les défis du cloud computing mobile (MCC), nous avons développé une étude de cas appelée Droplock pour le cloud mobile et nous avons étudié son efficacité énergétique et ses performances pour illustrer le modèle MCC. En outre, en s'appuyant sur les plates-formes de confiance (comme les TPM), nous avons introduit un nouveau schéma d'attestation à distance pour sécuriser les plates-formes mobiles dans le contexte du cloud mobile. Pour améliorer le niveau de sécurité et être adaptatif au contexte, nous avons utilisé de la logique floue combinant un système de colonies de fourmis pour évaluer la confiance et la réputation du cloud mobile basé sur la notion de cloudlets.

Mots clés :

informatique de confiance, cloud mobile, attestation, efficacité énergétique, logique floue, algorithme de fourmis.

RÉSUMÉ

It is my deep thankfulness to all the people without whom this thesis could not be possible.

I would like to express my sincere gratitude to my supervisor, Associate-Professor/HDR Mrs. Samia Bouzefrane, for her constant supports, guidance and motivation. I take also this opportunity to thank the staff members in the Department of Computer Science, Conservatoire National des Arts et Métiers (CNAM), Paris for assisting me in all administrative details regarding my thesis. I would also like to thank the Ministry of Education, Vietnam, Education University of Ho Chi Minh City for sponsoring my research scholarship in Paris.

In addition, I would like to thank Dr. Soumya Banerjee, Mr. Youcef Ould Yahia and Mr.

Aghiles Adjaz for the helpful discussions we had together and the advice to fulfill this project.

I am also grateful for the support of Uncle Tuan who has supported and given me a lot of advice on many stubborn problems during the time I am in Paris.

I would also like to deeply thank my parent, my parents in law, my grandparents, my grandparents in law, my older brother and sister, my younger brother in law and the rest of my family member for their endless support to all my endeavors.

Finally, I would give my deepest appreciation to my wife and my 2 little boys for their love, encouragement and sacrifice without which I could not have strengths to overcome all the difficulties during my overseas study time.

Contents I Introduction

II Context and State of the Art

List of Figures

Résumé de la thèse

Les appareils mobiles, comme nous le savons aujourd'hui, n'existent pas depuis longtemps.

Ce n'est que le 3 avril 1973 que Martin Cooper, ingénieur principal chez Motorola, a fait le premier appel téléphonique au monde à sa compagnie de télécommunication en leur disant qu'il parlait via un téléphone portable. Depuis lors, l'appareil mobile a énormément évolué, de l'usage personnel à l'entreprise. Avec la prolifération rapide des appareils mobiles, nous sommes conscients que chaque année une grande variété d'appareils avec différentes propriétés, des capacités améliorées, et plus d'intelligence sont disponibles sur le marché. Selon la prévision de Cisco, le nombre d'appareils mobiles, y compris les modules machine-to-machine (M2M), atteindra 1,5 par habitant en 2021, soit près de 12 milliards d'appareils connectés, contre 8 milliards et 1,1 par habitant en 2016. En outre, le trafic par appareil d'utilisateur mobile atteindra globalement 5657 mégaoctets par mois d'ici 2021, contre 977 mégaoctets par mois en 2016, soit un taux de croissance annuel composé de 42%. Les appareils mobiles vont de plus en plus faire face à de lourdes tâches de calcul car l'importance de l'énorme taille des données sera de plus en plus manipulée. En conséquence, les appareils mobiles remplaceront les PC en tant qu'appareils d'accès les plus courants pour des usages multiples.

Avec l'émergence des nouvelles technologies de l'information et de la communication, les appareils intelligents combinés à des infrastructures de communication telles qu'Internet et les réseaux mobiles doivent fournir des services fiables. à cette fin, de nombreux domaines d'application à fort impact social et commercial, tels que les soins de santé personnels, la domotique, le paiement mobile, peuvent utiliser des appareils mobiles qui s'appuient sur un environnement de confiance. Cet environnement de confiance peut être fourni ou basé sur de nombreuses plates-formes matérielles ou logicielles telles que des cartes SIM, des éléments sécurisés pour la communication en champ proche (NFC), l'émulation de carte hôte (HCE), TEE (Trusted Execution Environment) ou TPM. Même si ces plateformes fiables sont extrêmement limitées en termes d'énergie, de puissance de calcul et de mémoire, elles sont conçues pour résoudre les principales contraintes de sécurité.

D'un autre côté, le cloud computing doit rechercher comment gérer le stockage à distance et les ressources partagées par des multi-utilisateurs dans un environnement virtualisé et isolé [5]. Pour être plus précis, le cloud computing fournit les derniers services; à savoir le réseau en tant que service (NaaS), l'infrastructure en tant que service (IaaS), la plateforme en tant que service (PaaS), le logiciel en tant que service (SaaS) et le stockage en tant que service (STaaS) pour abstraire tous les types de ressources informatiques en tant que services. [START_REF] Zhou | CloudThings: A common architecture for integrating the Internet of Things with Cloud Computing[END_REF]. un exemple spécifique de plates-formes de confiance, a été spécifiquement conçu pour Résumé de la thèse constituer un bloc de construction pour l'informatique de confiance. C'est une utilisation importante dans l'industrie et le gouvernement, par exemple: Bitlocker pour le cryptage de périphérique de Microsoft et les solutions de sécurité pour ordinateur portable dans le département de la défense des États-Unis [START_REF] Dunn Owen | Cloaking Malware with the Trusted Platform Module[END_REF]. Avec ses fonctionnalités, le TPM protège le système informatique au-delà du contrôle de l'utilisateur contre une attaque délibérée ou accidentelle. En considérant les fonctionnalités du TPM, nous proposons des suggestions sur un nouveau schéma d'attestation basée sur la propriété, utilisable avec l'authentification par jeton.

Depuis, la sécurité et la confiance sont des aspects complémentaires nécessaires pour construire une solution complète et adaptative. Par conséquent, l'intelligence basée sur la confiance et la réputation, comme la logique floue et le système de colonie de fourmis, est considérée ici dans le contexte de l'environnement de cloud mobile.

Contribution de la thèse Contribution 1

La thèse commence par l'étude de cas réelle de Cloud Computing Mobile. Nous décrivons d'abord les différents modèles d'architecture de MCC et nous illustrons ces architectures en examinant leur efficacité énergétique avec le travail expérimental [START_REF] Thinh | Energy Efficiency in Mobile Cloud Computing Architectures[END_REF].

Cette approche est compétente pour adapter les deux contributions suivantes lorsque nous analyserons la performance des différentes approches. Ensuite, pour comprendre l'application du modèle MCC avec le niveau de sécurité standard de base dans un cas réel, nous proposons un système Droplock [START_REF] Thinh | Middleware to Integrate Mobile Devices, Sensors and Cloud Computing[END_REF]. L'objectif actuel de l'approche Droplock est d'améliorer la sécurité de la prestation de services du fournisseur au client. Ce travail nous a inspiré pour développer une nouvelle approche de sécurité dans la deuxième contribution.

Contribution 2

En tirant parti de la combinaison de technologies et de tendances, telles que des plateformes de confiance, le cloud computing et l'apport de votre propre appareil, nous introduisons l'attestation de jeton basée sur la propriété (Property-based Token Attestation) Résumé de la thèse pour sécuriser l'utilisateur mobile dans l'environnement cloud d'entreprise. Bien que l'architecture de MCC puisse être classifiée en plusieurs catégories [START_REF] Nasir Khan | Towards secure mobile cloud computing: A survey[END_REF], pour simplifier, nous avons sélectionné le modèle Client-Serveur de MCC pour simuler la solution de sécurité proposée.

Contribution 3

En considérant le protocole de sécurité traditionnel (infrastructure à clé publique (PKI), etc.) comme insuffisant pour sécuriser fermement l'écosystème de MCC, nous proposons un schéma d'évaluation de l'intelligence bio-inspirée fondée sur la confiance et la réputation (e.g. logique floue et système de colonies). En tant qu'addition de la deuxième contribution, le schéma proposé convient à une relation un-à -un (Client-Serveur) ainsi qu'à une relation un-à -plusieurs (Client-Cloudlets) oà les clients peuvent sélectionner dynamiquement les bons fournisseurs de services pour adapter leurs propres exigences.

Plan de la thèse

Le reste de ce manuscrit est organisé comme suit :

♦ Le chapitre 2 rappelle plusieurs techniques de virtualisation et compare la virtualisation basée sur des conteneurs avec les machines virtuelles.

♦ Le chapitre 3 introduit diverses définitions du cloud computing mobile, y compris ses structures et les modèles associés.

♦ Le chapitre 4 fournit un aperçu des plates-formes de confiance existantes et détermine leur pertinence pour les utilisateurs mobiles sécurisés dans le contexte du cloud computing mobile.

♦ Le chapitre 5 aborde les problèmes de sécurité liés au cloud computing mobile.

♦ Le chapitre 6 décrit un scénario pour mesurer la confiance et la réputation, qui consiste également en l'état de l'art de la littérature correspondante liée à l'intelligence computationnelle.

Résumé de la thèse ♦ Le chapitre 7 présente la première contribution en abordant les défis récents de MCC en termes d'énergie et de sécurité dans le cadre d'études de cas et de travaux expérimentaux réels.

♦ Le chapitre 8 expose la seconde contribution en introduisant un nouveau cadre pour l'attestation, à savoir l'attestation de jeton basée sur la propriété, dans MCC.

La performance, y compris la consommation d'énergie et la sécurité, est également analysée ici pour faire une comparaison entre le modèle actuel et les modèles connexes.

♦ Le chapitre 9 fournit la dernière contribution du travail de thèse pour la gestion de la confiance et de la réputation dans le contexte des multi-cloudlets.

♦ Le chapitre 10 analyse la performance entre les modèles proposés et les autres modèles

Les techniques de virtualization

La couche de virtualisation appelée hyperviseur ou VMM (Virtual Machine Monitor) gère les ressources matérielles entre les différentes machines virtuelles. Le système d'exploitation Résumé de la thèse invité est le système d'exploitation qui s'exécute dans une machine virtuelle. Actuellement, il existe plusieurs techniques de virtualisation que nous résumons ci-dessous. techniques spéciales pour virtualiser le matériel pour chaque machine virtuelle, ce qui génère un surcoût supplémentaire lors de l'accès au matériel [START_REF] Manohar | A Survey of Virtualization Techniques in Cloud Computing[END_REF].

Virtualisation complète

Para-virtualisation

La para-virtualisation fait référence à la collaboration entre le système d'exploitation invité et l'hyperviseur pour améliorer les performances. Cette collaboration implique de modifier le code source de système d'exploitation invité pour appeler directement, en utilisant des hypercalls, l'hyperviseur pour exécuter des instructions privilégiées. Le système d'exploitation invité est donc conscient d'être virtualisé. L'inconvénient de cette technique est la mauvaise compatibilité et la portabilité des systèmes d'exploitation.

Virtualisation assistée par matériel

Résumé de la thèse

Ring 1) pendant que le SE invité fonctionne en mode non-root (ring 0). L'état du système d'exploitation invité est stocké dans des structures de contrôle de machine virtuelle (pour Intel VT-x) ou des blocs de contrôle de machine virtuelle (pour AMDV). L'avantage de la virtualisation assistée par matériel est la réduction du surcharge provoquée par le modèle trap-and-emulate [START_REF] Rodríguez-Haro | A summary of virtualization techniques[END_REF]. Cependant, si les pilotes sont conscients d'être virtualisés, un chemin plus direct pour gérer les périphériques à l'intérieur de la VM peut être utilisé en installant des pilotes particuliers qui intéragissent avec les périphériques para-virtuels (comme l'interface virtuelle sous Linux) [START_REF] Zabaljáuregui | Grid Operating Systems/Middlewares and New Virtualization Techniques[END_REF]. prédéfinie. L'isolation peut se produire à deux niveaux: l'isolation entre les processus et l'isolation entre les processus et le matériel [START_REF] Vinh | Convergence in trusted computing and virtualized systems: A new dimension towards trusted intelligent system[END_REF].

Virtualisation du matériel

Isolation par conteneurs

Virtualisation basée sur les conteneurs par rapport aux machines virtuelles

Comme le montre la Figure Le prix pour PaaS peut se calculer sur une licence de développeur par application et sur une base de sièges hébergés [START_REF] Sridhar | Cloud Computing -A Primer -The Internet Protocol[END_REF]. Dans la hiérarchie des modèles, PaaS a un plus grand contrôle de l'utilisateur que SaaS.

Infrastructure en tant que service (IaaS)

En dessous de PaaS, on trouve l'IaaS qui fournit les facilités de communication et

Cloud Computing Mobile

Parallèlement à cette évolution, on suppose que les appareils mobiles hétérogènes ou les objets en réseau (depuis les smartphones, les ordinateurs portables et les dispositifs portables jusqu'aux objets intégrés) ont la capacité de partager des données [START_REF] Weber | Internet of Things[END_REF]; Des études pointent vers l'existence de plus de 50 milliards d'objets d'ici 2020 [START_REF] Perera | Context Aware Computing for The Internet of Things: A Survey[END_REF]. L'hétérogénéité vient du point de vue du logiciel, du matériel et de l'architecture, comme expliqué dans [START_REF] Schmohl | Heterogeneity in Mobile Computing Environmens[END_REF].

Les modèles MCC

Le modèle Server à Client

Le modèle Cloud Virtuel

Une autre approche [START_REF] Huerta-Canepa | A virtual cloud computing provider for mobile devices[END_REF], [START_REF] Barca | A virtual cloud computing provider BIBLIOGRAPHY for mobile devices[END_REF] Résumé de la thèse l'utilisation dans de nombreux domaines tels que les réseaux véhiculaires [START_REF] Kotevska | Toward a real-time framework in cloudletbased architecture[END_REF], le domaine militaire [START_REF] Lewis | Tactical Cloudlets: Moving Cloud Computing to the Edge[END_REF]. In this thesis, after investigating the real case-study of trusted platforms as well as MCC 's models, we focus mainly on the challenge of security in the mobile cloud computing ecosystem with the support of trusted platforms by proposing our interest on authentication, trust and reputation in mobile cloud computing context.

Problem Statement: Trusted computing for Mobile Cloud Computing

In mobile cloud computing, the trend nowadays is to outsource data and computation of mobile devices to the cloud in order to extend the working boundaries of resource-constrained devices and to benefit from unlimited cloud capacities such as storage. In addition, MCC must offer mechanisms to guarantee data protection and security in untrusted environment.

With the increasing use of MCC, security issues remain a challenge. Our work is to research CHAPTER 1. INTRODUCTION mainly on the existing trusted platforms to answer the following questions:

-What is a trust environment?

-Is a pure security solution sufficient to build a trust environment? and -How can mobile devices cooperate with the Cloud to build a trust environment?

Furthermore, by supporting hardware to provide security primitives independent from other system components, the concept of trusted computing is not a novel notion and is described in many researches [7; 8; 9; 10]. A specific example of trusted computing technology is Remote Attestation which enables a computing system to measure properties of a remote system in such a way that remote system will be detected if it is compromising. The properties of a platform or application can be used to define security requirements in order to satisfy the basic term C.I.A (Confidentiality, Integrity, Authentication) of system security.

In cloud environment, one of the problems that can occur is the management of encryption key. Several cloud customers may have their own encryption method and managing the security keys is another issue to address in the context of encrypted data [START_REF] Sabahi | Cloud Computing Reliability, Availability and Serviceability (RAS): Issues and Challenges[END_REF]. By supporting protection of cryptographic keys, random number generation, cryptographically binding data to certain system configuration, sealing data in the configuration of the application and platform/application authentication, we propose to use the Trusted Platform Module (TPM), which is promoted by Trusted Computing Group, to overcome this situation.

The Trusted Platform Module (TPM), a specific example of trusted platforms, has been specifically designed to be a building block for trusted computing. It is a significant use in industry and government, for example: Bitlocker for device encryption in Microsoft and security solution for laptop in the United States Department of Defense [START_REF] Dunn Owen | Cloaking Malware with the Trusted Platform Module[END_REF]. With its functionalities, the TPM protects the computing system beyond the user's control to against a deliberate or accidental attack. By considering the TPM's functionalities, we offer suggestions about a novel schema of property-based attestation suitable for use with the token based authentication.

Since, security and trust are complementary aspects that are required to build a complete and adaptive solution. Hence, the trust and reputation based intelligent, such as fuzzy logic and ant colony system, is considered here in the context of mobile cloud environment.

Thesis contribution

To be adapted to the above discussion, the main contribution of this work is threefold as presented in the following:

Contribution 1

The PhD dissertation starts by investigating the real case study of mobile cloud computing. We first describe the different architecture models of MCC and we illustrate these MCC architectures by examining their energy efficiency with the experimental work [START_REF] Thinh | Energy Efficiency in Mobile Cloud Computing Architectures[END_REF]. This approach is competent to tailor for the two subsequent contributions when we analyse the performance of various approaches. Then, for understanding the application of MCC model with the basic standard security level in real case, we propose a Droplock system [START_REF] Thinh | Middleware to Integrate Mobile Devices, Sensors and Cloud Computing[END_REF]. The current objective of Droplock's approach is to improve the security of the service delivery from the supplier to the client. This work has inspired us to develop a novel security approach in the second contribution.

Contribution 2

By taking advantage of the combination of technologies and trends, such as trusted platforms, cloud computing and bring your own device, we introduce Property based Token Attestation for securing the mobile user in the enterprise cloud environment. Although MCC 's architecture can be classified into many categories [START_REF] Nasir Khan | Towards secure mobile cloud computing: A survey[END_REF], to simplify, we have selected the Client-Server model of MCC to simulate the proposed security solution.

Contribution 3

While considering the traditional security protocol (e.g public key infrastructure (PKI) etc.) as insufficient to secure MCC 's ecosystem robustly, we propose a schema for evaluating the trust and reputation based bio-inspired intelligence (e.g fuzzy logic and ant colony system). As the addition of the second contribution, the proposed schema is suitable for one-to-one relationship (Client-Server) as well as one-to-many relationship (Client-Cloudlets) where the clients can select dynamically the right service providers for fitting CHAPTER 1. INTRODUCTION their own requirements.

Thesis outline

The rest of this manuscript is organized as follows:

♦

Virtualization techniques

The virtualization layer called hypervisor or Virtual Machine Monitor (VMM) manages the hardware resources between the different VMs. The guest OS is the OS that is running within a VM. Currently, there are several virtualization techniques that we summarize in the followings.

Full virtualization

In full virtualization, the source code of the guest OS is not modified. So, when executed, the guest OS is not aware to be virtualized. Binary translation (BT) is used to emulate a small set of instructions, i.e., privileged instructions are trapped and sensitive but nonprivileged instructions are detected then translated to show a fake value. The rest of the instructions are directly executed by the host CPU. There are two types of hypervisors that handle the full virtualization. Type 1 corresponds to a native or standalone hypervisor that runs directly on the bare hardware. Type 2 is hypervisor that runs on top of the host OS (like an ordinary application). The drawback of full virtualization is that the VMM must use special tricks to virtualize the hardware for each VM, which generates an additional overhead when accessing the hardware [START_REF] Manohar | A Survey of Virtualization Techniques in Cloud Computing[END_REF].

Para virtualization

It refers to the collaboration between the guest OS and the hypervisor to improve the performance. This collaboration involves modifying the source code of guest OS to call directly, using hypercalls, the hypervisor to execute privileged instructions. So the guest OS is aware to be virtualized. The drawback of this technique is the poor compatibility and portability of OSs.

Hardware-assisted virtualization

Virtualization of hardware

In order to run successfully the virtualized systems, the virtualization layer (VMM) needs to share CPU, memory and devices. Several mechanisms are implemented to do so.

Processor virtualization

Generally, the OS is designed to run directly on the physical machine and fully has use of the computer resources. The traditional x86 architecture has four levels of privileges (called rings 0 to 3) dedicated to the operating system and the applications in order to manage access to the computer hardware. User applications run in Ring 3 (user mode), while the operating system runs in Ring 0 (kernel mode) to have all privileges. In the new CPU generations, an extension for virtualization called Virtual Machine Extension (VMX) has been added. In the Intel VT-x architecture, there are two execution levels: VMX root mode used to execute the VMM functions; and VMX non-root mode which corresponds to a reduced privilege to run guest OSs.

Memory

In traditional operating systems, a physical memory is allocated for each process defined with its own virtual address space. When the process wants to access memory, the process virtual address is translated by memory management unit (MMU) that relies on the process page table. When a guest OS runs on a hypervisor, an additional translation level is added.

In fact, the guest OS maps guest virtual addresses (GVA) with guest physical addresses (GPA), and the translation from GPA to machine physical addresses (MPA) is done by the hypervisor [START_REF] Chiang | Optimization Techniques for Memory Virtualization-Based Resource Management[END_REF].

Devices

The VMM has to present devices to the guest OS such as disk, network interface, USB and timers. Since the drivers of the guest OS are not aware to be virtualized, all the instructions generated by the drivers have to be trapped and emulated, which is the source of overhead. However, if the drivers are aware, a more direct path to handle devices inside CHAPTER 2. VIRTUALIZATION: THE BEGINNING the VM can be used by installing particular drivers which talk to the para-virtual devices (like virtual interface in Linux) [START_REF] Zabaljáuregui | Grid Operating Systems/Middlewares and New Virtualization Techniques[END_REF].

Isolation by containers

In the virtualization based solutions, the hypervisor scheduling operates at two levels as explained in the following. The first scheduling occurs at the hypervisor level where the hypervisor schedules VMs, and the second one at the virtual machine level where the guest operating system schedules processes. Taking that into account, it is obvious that this approach creates a significant overhead. Another virtualization approach, based on containers, has been proposed to reduce significantly this overhead, and thus providing better performances, especially in terms of elasticity and density within a lean data center.

Containers

In the container based virtualization, scheduling occurs only at one level. The containers contain processes, while the kernel and the libraries are shared between the containers.

Hence, the scheduler is used only at process level to schedule processes. The behavior is similar to a classical operating system; the only difference is that, in container-based virtualization, processes are affected to a container, and between each container, an isolation is provided by the operating system.

We can define a container as a confined environment under the global environment. The

Linux operating system provides some mechanisms to create these confined environments or containers, and somehow forces each container to follow a predefined policy. The isolation can occur at two levels: Isolation between processes, and Isolation between processes and the hardware [START_REF] Vinh | Convergence in trusted computing and virtualized systems: A new dimension towards trusted intelligent system[END_REF].

Virtualization based on containers versus virtual machines

As shown in figure 2.1, unlike VMs that rely on a hypervisor, containers are viewed as applications within the host operation system. Consequently, as stated in [START_REF] Felter | An Updated Performance Comparison of Virtual Machines and Linux Containers-IBM Research Report[END_REF], the performances given by using containers are better than those for virtual machines, which is a little obvious since containers add almost no overhead comparing to VMs. The information

Annals of Mobile Cloud Computing

Introduction

In the recent year, cloud computing is an emerging area that affects IT infrastructure, network services, and applications by providing the framework such as the population of Amazon Web Service, Window Azure and Google App Engine. Cloud computing is a third party with large-scale storage servers and data centers used to provide infrastructures, software development and distribution platforms with low costs in the computing technology.

The advantage of cloud computing has come with three popular major models that are offered today as services. The figure 3.1 represents the popular service models in the cloud environment.

Software as a Service (SaaS)

SaaS or on-demand software is a model for the distribution of software which provides customers access to specific software over the Internet such as Google App, Office 360. In SaaS, the provider is known as the SaaS Provider that hosts the application at its data center and the interface to the application is usually through a standard web browser. SaaS delivers its benefits to either private use or enterprise. For example, instead of purchasing the application's license, the end-user can obtain the same functions as a hosted service provided by remote servers. Since the application is managed remotely and centrally by CHAPTER 3. ANNALS OF MOBILE CLOUD COMPUTING the providers, the complexity of software installation, maintenance and upgrade has been lessened without user intervention.

Platform as a Service (PaaS)

While license and on a hosted-seats basis [START_REF] Sridhar | Cloud Computing -A Primer -The Internet Protocol[END_REF]. In the hierarchy of models, PaaS has a greater degree of user control than SaaS.

Infrastructure as a Service (IaaS)

Below PaaS is the IaaS which provides the communication and storage facilities through the virtualization. By offering the virtualized infrastructure including hardware, storage, servers, data center and network components, the customers can install their own operating system, database and computing services over the provisioned virtual machines [START_REF] Sridhar | Cloud Computing -A Primer -The Internet Protocol[END_REF]. Instead

Mobile Cloud Computing

Along with this evolution, heterogeneous mobile devices or networked objects (from smartphones, laptops and wearable devices to embedded objects) are assumed to have the capability of sharing data [START_REF] Weber | Internet of Things[END_REF]; studies point to the existing of more than 50 billion objects by 2020 [START_REF] Perera | Context Aware Computing for The Internet of Things: A Survey[END_REF]. The heterogeneity comes from software's, hardware, and architectural point of view as explained in [START_REF] Schmohl | Heterogeneity in Mobile Computing Environmens[END_REF]. Nowadays, mobile computing is an essential part of human life which makes daily life more convenient and effective regardless of time and place. By enabling on-demand services to the users elastically, mobile applications over cloud computing can be rapidly provisioned and released with minimal efforts of service providers and management [START_REF] Weber | Internet of Things[END_REF]. However, mobile cloud computing cannot be simply defined as merging between mobile and cloud computing technologies. There are various definitions of mobile cloud computing that need to be considered before looking into its models and the remaining security issues. According to IBM 1 , "Mobile cloud computing is a new platform combining the mobile devices and cloud computing to create a new infrastructure, whereby cloud performs the heavy lifting of computing-intensive tasks and storing massive amounts of data. In this new architecture, data processing and data storage happen outside of mobile devices". Similarly, Cisco Internet Business Solutions Group (IBSG) [START_REF] Taylor | Mobile Consumers Reach for the Clouds[END_REF] defines mobile cloud as "mobile services and apps delivered from a centralized (and perhaps virtualized) data center to a mobile device, such as a smartphone. Customers access these services on-demand using the browser or thin client on their mobile devices.

This contrasts to "thicker" clients that are downloaded from app stores and reside (and run) on the mobile device. Mobile cloud services are agnostic about the type of device or operating system on which they run". Another definition from Techopedia2 stands that:

"Mobile cloud computing is a technique or model in which mobile applications are built, powered and hosted using cloud computing technology. A mobile cloud approach enables developers to build applications designed specifically for mobile users without being bound by the mobile operating system and the computing or memory capacity of the smartphone.

Mobile cloud computing centered are generally accessed via a mobile browser from a remote webserver, typically without the need for installing a client application on the recipient phone". The MCC architecture and its important partners are represented in figures 3.2a and 3.2b respectively.

MCC models

To highlight the motivation for mobile cloud computing, different architectures in the literature [28; 29; 30; 31]

Cloud Server -Client model

As we mentioned earlier, mobile cloud computing aims to prolong the capabilities of storage/computation-limited devices and to provide seamless access to data/application on a remote resource rich server from anywhere. A remote cloud server acts as a service provider to mobile devices. The network connectivity from the device to the cloud server needs to be optimized to ensure the quality of service and seamless handover (See figure 3.

3).

With the term of "No Cloud without Virtualization", to reduce the processing time and improve the efficient energy, there are many existing solutions that support this architecture by using the virtualization technique such as Virtual Machines-based, Container-based virtualization.

Virtual Cloud

Another approach [START_REF] Huerta-Canepa | A virtual cloud computing provider for mobile devices[END_REF], [START_REF] Barca | A virtual cloud computing provider BIBLIOGRAPHY for mobile devices[END_REF] is to build up a cloud with peer-to-peer connected mobile devices for data storage and processing so that mobile devices are resource providers of a virtual cloud. In this architecture (See figure 3.4), the mobile devices work as either service providers or consumers, and as such each mobile device can cooperate with its neighbors to collect/distribute its surrounding information for specific purposes such as traffic app, healthcare monitor, etc.

Cloudlet model

The concept of cloudlets as proposed in [START_REF] Satyanarayanan | The Case for VM-Based Cloudlets in Mobile Computing[END_REF], is an alternative architecture of MCC in which, the cloudlet is represented as intermediate offload elements in three-tier structure:

Mobile device-Cloudlet-Cloud. In figure 3.5, the cloudlet is considered as resource-rich, well-connected and powerful computer installed in the public infrastructure with the connectivity to Cloud server. It can be implemented thanks to Wi-Fi hotspot servers that support hypervisors to manage VMs, or can correspond to powerful base stations in a mobile edge computing. This is useful for the proximate mobile device to offload its workload while ensuring low delay and high bandwidth. Taking real time event detection for example, when a foreign tourist man visits a local museum, he faces with the languages problem for understanding all the art-works. If cloudlet is not available nearby, he has to connect with a distant cloud with 3G/4G mobile network which is costly or not always available. However, thanks to the cloudlet which is deployed everywhere as Wi-Fi hotspot, he can use cloudlet's services for language translation, image processing or sending video streams to his friends with low latency, high bandwidth and powerful processing. Currently, the cloudlet is proposed to use in many areas such as vehicle-to-vehicle [START_REF] Kotevska | Toward a real-time framework in cloudletbased architecture[END_REF],

military [START_REF] Lewis | Tactical Cloudlets: Moving Cloud Computing to the Edge[END_REF].

Summary

In this chapter, we introduced the well-known services of cloud computing and also discussed the existing models of MCC that related to the PhD's contributions. In the next definition is required to understand what is meant by the term "Trusted Platform". There is a wealth of research studies on the concept of trusted computing in a wide variety of publications. For example, the authors in [START_REF] Bouazzouni | Trusted mobile computing: An overview of existing solutions[END_REF] presented the effective survey on the existing solutions of trusted platforms. Generally, the trusted computing is about verifying the system is trustable to another one and reducing the scale, complexity of the entities that need to be trust. The prime goal of a Trusted Platform is to establish the secure foundation for the rest of the system that can be built on. According to Trusted Computing Group (TCG), "a Trusted Computing Platform is a computing platform that can be trusted to report its properties"1 . TCG also defined the trusted platform as a platform is in such manner as "the expectation that a device will behave in a particular manner for a specific purpose". In the same way, the authors in [START_REF] Pearson | Trusted Computing Platforms: TCPA Technology in Context[END_REF] claimed that "A Trusted Platform CHAPTER 4. TRUSTED PLATFORMS: COMPUTING WITH TRUST is a computing platform that has a trusted component, probably in the form of built in hardware, which it uses to create a foundation of trust for software processes" or "a Trusted

Platform is defined as a computing platform that has a trusted component, which is used to create a foundation of trust for software processes". It is worth noting that, a distinction between trusted entity and trustworthy entity in computing system needs to be drawn.

While an entity of a system is trusted means that the security of the system depends on it, the entity is trustworthy refers to the entity deserves to be trusted. To be more precise, the author in [START_REF] Anderson | Security Engineering: A Guide to Building Dependable Distributed Systems[END_REF] discussed this distinction as "The proper definition is that a trusted system or component is one whose failure can break the security policy, while a trustworthy system or component is one that will not fail".

Due to the ongoing threats from hackers, viruses, and worms continue to make security to be a top priority for IT and business professionals in both the private and public sectors, we need a standard that allows affordable authentication, encryption, and network access to be accomplished on a variety of computing platforms. To address this worrying problem, the Trusted Platform supports the reliable services to mitigate the risks associated with the security threats even though this does not solve all the attacks that we face. Platform Module, in either hardware or software form. We also make a comparison among these platforms to show how they can be suitable for securing mobile cloud computing.

Secure Element (SE)

A smartcard is a tamper resistant micro-controller [START_REF] Jurgensen | Smart Cards: The Developer's Toolkit[END_REF] whose security is enforced by multiple software and hardware countermeasures. A secure element (SE) is a smart card embedded in an NFC device such as NFC-enabled smart phone, able to store sensitive data such as PIN code and security keys and perform internal computation such as cryptographic processing when needed by the terminal (phone). A SE has the following physical features:

8, 16 to 32 bits of CPU, 32 to 64 kB of PROM that hosts the operating system, and 1 to 4 kB of RAM to execute programs, 1kB to 128 kB of EEPROM/Flash to store data and applications, while a dedicated crypto-processor is used for cryptographic computation. To interact with a SE, the terminal sends application protocol data unit (APDU) commands and the SE responds using APDU responses.

The SE is generally a Java Card platform (refer figure 4.2) composed of a Java Card Virtual Machine (JCVM), a Java Card API and a Java Card Runtime Environment (JCRE).

JCRE implements the Java Card mechanisms that are intrinsic to the smart cards such as transaction management. When the SE is a SIM card, it is enriched with Java Card packages that allow interaction with the Mobile Network Operator (MNO) such as sending SMS, generating a phone call, etc. In addition, Java Card platforms are designed in respect to Global Platform specifications2 .

In other terms, each Java Card platform is composed of isolated EEPROM areas called Applications could therefore be developed to emulate any classic contactless smartcard application using the ISO 14443-4 standard, such as loyalty, access control, ticketing or payment applications. In addition, HCE is simply an ordinary Android application without any specific hardware or software-based security services. Security concerns relating to As a software solution, HCE is considered as less secure than a physical SE. For example, the HCE cannot handle counter-measures for physical attacks. Unlike secure devices, HCE concept does not target applications with high-level security, and relies on larger resources (memory & processor) because it uses the host OS. In addition, it is independent from SE providers.

Trusted Execution Environment (TEE)

The GlobalPlatform Trusted Execution Environment (TEE) defines a standardized isolation environment for mobile devices in which sensitive code, data and resources are processed away from the main operation environment, software and memory on the device.

This isolation is enforced by hardware architecture and the boot sequence uses a hardware root of trust in the system on chip package making it highly robust against software and probing attacks. In addition, code running in the TEE and using protected resources (known as "Trusted Application") is cryptographically verified prior to execution, leading to high integrity assurance. Because it provides an isolated runtime environment entirely inside the mobile device, the TEE enables advanced device or peripheral security use cases such as securing the user interface, or controlling access to an NFC chip. As such, the TEE can be used as a distinct security coprocessor or provide a trusted "bridge" between the user and other security technologies such as secured user interface or OS user permissions on one side, and Secure Element access control on the other. The main operating system and rich applications then run as normal on the device, accessing the functionality of the Trusted Applications via a standardized "Client API". Trusted Applications are written to an "Internal API" which ensures portable trustworthy access to secure resources, cryptographic operations and secure storage regardless of the underlying SoC hardware. shows the architecture of the TEE. Furthermore, the TEE manages and executes trusted applications built-in by device makers as well as trusted applications installed as people demand them. Trusted applications running in a TEE have access to the full power of a device's main processor and memory, while hardware isolation protects these from user installed apps running in a main operating system. Software and cryptographic isolation inside the TEE protect the trusted applications like ARM Trustzone platform 7 .

Device and chip makers (such as ARM) use TEEs to build platforms that have trust built in from the start, while service and content providers rely on integral trust to start launching innovative services and new business opportunities. Hence, the Trusted Execution Environment (TEE) is a secure area that resides in the application processor of With larger resources than a SE, the RAM size of a TEE may reach 1MB with a Flash memory shared with a Rich OS. TEE may cooperate with SE to guarantee a high level of security. number generation, cryptographically binding data (refer figure4.8 9 ) to certain system configuration, sealing data in the configuration of the application and platform/application authentication [START_REF] Fernando | Mobile cloud computing: A survey[END_REF], TPM implements mechanisms and protocols to ensure that a platform has loaded its software properly. By protecting the system at hardware level, TPM is also known as the primitive security that allows affordable authentication, encryption, and network access to be executed on a variety of computing platforms. It stores secret keys to encrypt data files/messages, to sign data, etc. In addition, TPM is equipped with a set of special registers like the PCR (Platform Configuration Register) to store integrity metrics. These metrics are used to measure the integrity of any code from BIOS to applications. Therefore, P CR 0 → P CR n (n= 23 with TPM 2.0) provide evidence of a certain state of the system. For example, each time when the system event occurs, TPM computes the hash of a metric value and extends to the PCR associated with the occurred event. The operation to extend new value to the PCR [START_REF] Coker | Attestation: Evidence and trust[END_REF] is

P CR newvalue = Digest of (P CR oldvalue ||Data to extend) (4.1)
In remote attestation as discussed in next section, it is important to know that the user communicates with a genuine TPM. The computing platform uses its TPM's Attestation Identity Key (AIK) to show its identity and provide its valid evidence with other parties.

The private part of AIK is also used to sign message/data.

Remote Attestation

Remote Attestation (RA) is a mechanism for either authenticating to a remote entity or validating the integrity of the application/platform. Currently, the point of view in remote attestation is full of change and variety. Depending on different research aspects, RA can be categorized into two mechanisms and three techniques to serve for the same goal of the remote attestation which is to ensure the trustworthy of the current platform/applications.

The former is Binary Attestation (BA) and Property based Attestation (PBA) [START_REF] Nagarajan | Property Based Attestation and Trusted Computing: Analysis and Challenges[END_REF]. The latter is Hardware-based, Software-based, and Hybrid technique [START_REF] Vieira | Attestation in Wireless Sensor Networks: A Survey[END_REF]. The remote attestation is also one of the most important functionalities supported by the TPM. It is used for software or hardware to prove its identity/trusted state/configuration with the third party.

Before delivering to the end user, the TPM is built-in with TPM vendor and platform endorsement keys (EKs) and corresponding certificates by the TPM vendors and platform manufactures. While the TPM vendor certificate claims that "This endorsement key is resident on an authentic TPM manufactured by me", the platform manufacturer certificate shows, "This key is resident on a TPM that is part of my platform, and this platform supports certain TPM features" [START_REF] Arthur | A Practical Guide to TPM 2.0: Using the Trusted Platform Module in the New Age of Security[END_REF]. By using these evidences, the platform/TPM can prove its trusted state remotely with other entities over a network. The Remote Attestation protocol (See figure 4.9) starts with the Challenger (Chal) that challenges the Attestator (Att) by sending a request for attestation (step 1). Chal is a trusted entity that wants to attest the authenticity of Att before communicating any data with it. As, the EK of TPM is unique and cannot be revealed outside TPM, Att then generates AIK instead of using EK. Att cannot link different AIKs from the same TPM. The public part of AIK, which is signed by EK, is sent along with other identity proofs such as platform certificate, EK certificate, etc. to trusted third party (Privacy Certificate Authorization noted as PCA). This can associate AIK and EK (step 2). After validating the received data, the PCA In the other hand, another approach of attestation, namely Property based Attestation (PBA), is founded on the Binary Attestation (BA). This approach not only relies on the TPM functionalities to verify the evidence of platform but also requires a trusted third party to issue a Certificate of Property. Instead of attesting binary values, platform/application's properties, functions, or behaviors are attested to prevent binary information leaking. The principle of PBA is that various platforms may have the same properties which fulfilling the same requirement regardless a variety of platforms and components. In comparison with BA, Aarthi et al. [START_REF] Nagarajan | Property Based Attestation and Trusted Computing: Analysis and Challenges[END_REF] stated the following advantages of PBA: 1) Properties do not reveal implementation details of a system and can therefore hide system vulnerabilities; CHAPTER 4. TRUSTED PLATFORMS: COMPUTING WITH TRUST 2) Properties may not identify components and may provide a certain level of privacy.

3) Properties of components may not change as often as hash values particularly during updates; 4) Properties are easier to understand and can be useful to write meaningful access control policies rather than using an excess of binary values. Taking the login function of the computing system (e.g. application or web page) for example, despite existing the difference in configuration, implementation, types of application/website or using-purpose, these systems have two common basic factors, such as identity of user and password. These factors can be considered as properties [START_REF] Borhan | Platform Property Certificate for Propertybased Attestation Model[END_REF]. Thus, if these systems have been updated or changed, these properties still remain for their own purposes.

Comparison of Trusted Platforms features

After discussing the overview of existing Trusted Platforms, in this part, we compare (refers table 4.1 for the summarization) the different features of trusted platforms as the following criteria.

a. Form and Dependency

Different from SE and TEE (refer table 4.1), HCE and TPM are only in the software and hardware form respectively. The software is simply the android program where the user's stored credentials are of low value. The latter is a computer chip and considered as the cheapest way to enhance security in an ordinary, non-secure computing platform.

In term of dependency, TEE works as the framework for mobile-device security. It is also known as a layer between mobile OS and typical SE. b. Hardware SE, TPM and some implementations of TEE have their own limited hardware resource.

In contrast, HCE and TEE have larger resources because they have access to the host resources. Thus, the TEE provides a more powerful processing speed capability and greater accessible memory space than SE. Unlike the other platforms, HCE has at its disposal all the memory resources of the Android platform, but HCE is not a piece of hardware.

c. OS and API support

At the moment, HCE is not isolated from the device's operation system and supported by Android OS in version 4.4. However, in the software form, HCE is considered less secured than others.

d. Security features

In this aspect, the SE is the highest security level for the mobile computing. However, it also required extra cost for the implementation. In some cases, the TEE is sufficient for most applications. Moreover, the TEE can work with another trusted platform to enrich the security level. For the moment, TEE standardization is not yet finalized. By contrast, HCE concept does not target applications with high-level security. Security concerns relating to HCE are further compounded by industry report indicating that Android is, by some distance, the most attackable of all mobile environment [49].

e. Role

The role of HCE is a blur in comparison with other trusted platforms. Some drawbacks deal with HCE such as low power mode, roaming and no data connectivity scenarios and transaction speed. As stated in [49], HCE still remains in the beginning stage and needs a long way to go before it can establish a certification schema that is

Virtual Trusted Platforms

With the advantage of virtualization technology [17; 50; 51], the convergence between trusted computing and virtualized computing enables a novel security method. In the context of virtual environment, because the physical TPM that is linked to the underlying physical machine cannot attest directly guest OSs, it has been virtualized to provide its functionalities for each virtual machine (VM), which is running on a single platform. This makes VM feel it has its own private TPM. As a result, by virtualizing, a single physical TPM works as the Root of Trust which can be served by multi virtual environments on the trusted platform. For this reason, there are different implementation models for TPM virtualization [52; 53; 54; 55]. As we will see it in the next subsections, normally the TPM virtualization can be implemented by migrating the real TPM to the virtual machines or emulating the TPM in software [START_REF] Strasser | A software-based trusted platform module emulator[END_REF]. Table 4.2 presents the difference between the physical TPM (noted pTPM) and virtual TPM (noted vTPM).

TPM virtualization via Virtual Machine Monitors

This implementation is proposed by many authors for the migration of virtual TPMs (vTPMs) and their associated VMs to provide secure storage and cryptographic operations.

Berger et al. [START_REF] Perez | vTPM: Virtualizing the trusted platform module[END_REF] introduced an architecture where the TPM's specifications are available in virtual environment. Sadeghi et al. [START_REF] Sadeghi | Property-based TPM virtualization[END_REF] proposed a vTPM architecture, which is based on Berger's approach, to improve the maintainability and applicability of VMM. England and Loeser, in [START_REF] England | Para-virtualized TPM sharing[END_REF], proposed a para-virtualized TPM sharing the approach in which a physical TPM can be shared among virtualized hosts. To enhance the security, Danev

Privacy

Controlled by the user.

Controlled by the user.

No control by the user.

Controlled by the user. Each vTPM instance imitates the interface and functionality of the hardware TPM. It also requires synchronizing VM-vTPM state during the migration. In [START_REF] Perez | vTPM: Virtualizing the trusted platform module[END_REF], the authors presents vTPM migration procedure by using asymmetric and symmetric key. In the protocol, the state of vTPM is encrypted and packaged on the source platform and decrypted on the destination platform. Instead of using a migratable TPM storage key, the authors in [START_REF] Sadeghi | Property-based TPM virtualization[END_REF] proposed to use the migration procedure in a trusted channel, which is used to create a secret encryption key related to the TPM on the destination and to the configuration of trusted computing base.

TPM based Software Emulator

As mentioned above, one limitation associated with the security properties of the physical TPM is that it only permits one TPM per platform. Since Berger et al. [START_REF] Perez | vTPM: Virtualizing the trusted platform module[END_REF] introduced

Virtual Trusted Execution Environment (vTEE)

In addition, with the advantage of TEE, TEE 12

The use of TPM based attestation in mobile devices and cloud computing

The proliferation of mobile devices has changed the requirement of computing ecosystem.

The end-users would rather use their personal mobile devices than personal computers for either entertainment or work. However, the mobile device is still considered as the resource-constraint device in terms of energy, storage, processing power, and especially for security. To fulfill the requirement of security, there are many useful tools, antivirus application, and cryptography techniques in use. However, they require a trusted computing platform to run.

Trusted Computing Group (TCG) with its TPM provides a standard that enables authentication, authorization, encryption and integrity to be achieved on a variety of computing platforms. As we discussed earlier in subsection 4.1. [START_REF] Alavalapati | A Secure Anonymous Authentication Protocol for Mobile Services on Elliptic Curve Cryptography[END_REF]. To consider the problems of trust in cloud monitoring system, Awad et al. [START_REF] Awad | Property Based Attestation for a Secure Cloud Monitoring System[END_REF] introduced a trusted framework to establish a chain of trust for the clients in the cloud environment by relying on PBA. In addition, to improve the flexibility, Liu et al. [START_REF] Liu | Client Oriented Remote Attestation Model in Cloud Environment[END_REF] with their model, CORA, allow the cloud tenants not only choose the node in cloud that matches to their own security requirements but also verify the trustworthiness of this node dynamically.

To improve the security model for virtual machines and services in the cloud, Vijay et al. [START_REF] Varadharajan | Counteracting security attacks in virtual machines in the cloud using property based attestation[END_REF] brought in a new trust model to detect and prevent security attacks in cloud environment by using PBA. In their model, the authors considered the basic communication properties between the tenant virtual machine and the cloud user as the security properties for attesting, such as the source address, the traffic and the state validation of the tenant virtual machine.

In the mobile computing context, although without the existence of hardware root of trust, Nauman et al. [START_REF] Nauman | Beyond kernel-level integrity measurement: Enabling remote attestation for the android platform[END_REF] implemented BA for Android platform. By emulating the TPM as a part of the kernel, the authors created a root-of-trust to establish the chain-of-trust from this root-of-trust to the Dalvik virtual machine, and then to the entire entities within the virtual machine. Similarly, the authors in [START_REF] Francillon | A Minimalist Approach to Remote Attestation[END_REF] investigated the practicable of remote attestation for low cost embedded computing devices without trusted hardware. To support CHAPTER 4. TRUSTED PLATFORMS: COMPUTING WITH TRUST secure remote attestation, they claimed that only the essential and sufficient properties for a low cost device were identified and mapped into a minimal collection of system component.

Meanwhile, Kostiainen et al. [START_REF] Kari Kostiainen | Practical Property-Based Attestation on Mobile Devices[END_REF] applied PBA for the in-vehicle communication system enabling mobile devices to exchange data to car head units. The authors presented a new model of property-based attestation that bootstraps from existing mobile application certification infrastructure. In their work, they omitted a trusted party which is responsible for translation between software measurement and properties.

Conclusion

In this chapter, we study the existing trusted platforms and investigate one of the most important features, that is remote attestation. We also look into the recent work to figure

Securing the mobile devices

In terms of Security for mobile users, the available Trusted Platforms have played their security role well in mobile device environment. In addition, these trusted platforms can work together to meet the security requirements. For example, TEE can serve as a complementary security countermeasure and integrating nucleus for service that depends on partial identities distributed across SEs, such as Active Stickers, Secure Micro SD Cards, UICCs, and Embedded SEs. The TEE combines these into integrated solutions which assure seamless interaction and security of processes that are executed in the periphery of

Securing the Cloud

With regard to the security of apps and VMs in the cloud environment, the authors, in [START_REF] Urien | Securing NFC Mobile Services with Cloud of Secure Elements (CoSE)[END_REF], proposed the concept of a Cloud of Secure Elements (CoSE) where the secure services are hosted by servers rather than by smartphone Secure Elements. They discuss the use of CoSE for mobile payments, and illustrate how an NFC smartphone may be efficiently used as a bridge between an NFC reader and an Internet server of secure microcontroller that hosts EMV applications. The advantage of this solution is to assign dynamically a physical secure element on the cloud for a sensitive application. In cloud computing, the service provider must achieve auditability, for attesting whether security setting of applications has been tampered or not. As stated in [START_REF] Zhang | Cloud computing: State-of-the-art and research challenges[END_REF], auditability can be achieved using remote attestation techniques that require a trusted platform module (TPM). The TPM contains an endorsement private key that uniquely identifies the TPM. At boot time, the host computes its system state (boot sequence, namely the BIOS, the bootloader, and the software implementing the platform) as a sequence of hashes securely stored within the TPM. A remote party can use this sequence of hashes to authenticate and trust the host platform.

In traditional systems, the operating system is linked to the hardware machine regarding the attestation process. However, in a virtualized environment like the clouds, VMs can dynamically migrate from one location to another, making the remote attestation mechanism not sufficient. Santos et al. [START_REF] Santos | Towards trusted cloud computing[END_REF] proposed to secure the hardware layer using hardware TPM, and secure VMs using a secure virtual machine monitors. VM migration is possible if both source and destination servers are trusted. In [START_REF] Krautheim | Private Virtual Infrastructure for Cloud Computing[END_REF], the authors designed efficient protocols for trust establishment and management. Additionally, Patidar et al. [START_REF] Patidar | Integrating the trusted computing platform into the security of cloud computing system[END_REF] proposed a system in which cloud computing system is combined with trusted computing platform using a TPM. Security mechanisms like authentication, confidentiality and integrity are provided to illustrate the use of TPM. Coupled with the security of apps and VMs, how to secure data is another important aspect in the cloud ecosystem.

To this end, many authors propose security mechanisms for Cloud storage. For example, Hsueh et al. [START_REF] Hsueh | Secure cloud storage for convenient data archive of smart phones[END_REF] proposed hybrid cryptography, and digital signatures to provide security requirements for data storage of mobile phones. Their solution is used to avoid malicious WORK attackers from illegal access and to share desired information with targeted friends by distinct access rights. Unlike this kind of solution, the hardware-based encryption can take advantage of the TPM and does not require user intervention or impact system performance.

For instance, Trusted Computing Group2 has published a Trusted Storage specification to provide a manageable, enterprise-wide means for implementing full-disk encryption using TPM. This trusted storage notion may be extended to target the storage provided by the data centers of the Cloud.

In terms of digital right management (DRM), Zou et al. [START_REF] Zou | Phosphor: A Cloud Based DRM Scheme with Sim Card[END_REF] proposed Phosphor, a cloudbased mobile DRM scheme with a subscriber identity module (SIM) card in mobile phone, to avoid illegal distribution and piracy of digital contents (like video, audio, e-book, etc.).

The SIM card hosts a license state word (LSW) protocol that decrypts each digital content received from the cloud using the decryption key stored on the SIM card. The drawback of this solution is the sharing of a secret key between the Cloud and the SIM card. In other words, the Cloud has to maintain a key for each user

Authentication

The mobile devices require strong authentication, secure storage and device integrity.

That is to say, authentication and access control are more crucial than ever since the cloud services and the cloud storage may be accessible to anyone over the Internet. The TPM can easily provide stronger authentication than username and password. For instance, to improve mobile security, PIN Access or Biometric Lock (eyeprint/ fingerprints/ facial recognition) has been integrated into mobile devices. By running at the backend of TPM 2.0, if the user has no a precise password or unfollow a right verifying process, TPM locks the user and protects sensitive data.

In [START_REF] Bouzefrane | BIBLIOGRAPHY Cloudlets Authentication in NFC-Based Mobile Computing[END_REF], the authors present a protocol to authenticate a nearby Cloudlet by a mobile device that handles NFC applications. For authentication, the mobile device uses a SE and involves the Mobile Network Operator and a trusted service management that belongs to a Cloud computing.

Data Privacy

Apart from data security, privacy is a means to allow the user having a complete control on his personal data hosted on the Cloud computing. In some MCC frameworks, like in MobiCloud, Huang et al. [START_REF] Huang | MobiCloud: Building Secure Cloud Framework for Mobile Computing and Communication[END_REF] introduced the notion of Extended Semi-Shadow Image (ESSI) that was not exactly the same as a virtual image because an ESSI could be an exact clone, a partial clone, or merely an image that has extended functions of the physical device.

CloneCloud [START_REF] Byung-Gon Chun | CloneCloud: Boosting Mobile Device Applications Through Cloud Clone Execution[END_REF] was another MCC platform that uses offloading technique to perform computing on a resourceful server. For this purpose, the authors used device clones, and assumed that the clone VM was by default a trusted one, and mention establishing trust as future work. The drawback of the MobiCloud and CloneCloud platforms, which rely on device clones on the Cloud, is that no privacy means to be provided to either the user to let him choose the personal data to outsource or to the device clone. If a TEE based solution is adopted for example in this context, all the personal data that the user does not want to outsource can be stored in a secure manner by the TEE that has larger memory storage than a SE.

Summary

There is considerable consensus that the trusted platforms are helpful in cloud security.

We addressed the remaining security challenges of MCC, in this chapter. In the next chapter, the literature of computation based intelligence is presented to assess the trust and reputation.

Chapter 6

Computational Intelligence: Scenario for measuring Trust and Reputation

In order to calculate the trust based reputation for MCC, especially for cloudlet based architecture, different methods with high-ranking accuracy, such as fuzzy logic system (FLS) and bio-inspired intelligence (i.e ant colony optimization) have been involved. In this chapter, we recall the literature and the advantage of ant colony system after presenting the benefits of fuzzy logic system. The uncertain value is not existed in crisp set. For example,

Fuzzy Logic

Introduction

let x ∈ A; A can be N or R then µ(x) = { 1, (x ∈ A) 0, (x / ∈ A) (6.1)
It can be clearly seen that µ(x) can only receive 1 or 0 value with no allowing middle value.

In contrast to the uncertainty problem solving of crisp set, all items in fuzzy sets have different degrees (i.e. multivalence from 0 to 1), called degrees of membership, and sum of degree of membership is 1.

CHAPTER 6. COMPUTATIONAL INTELLIGENCE: SCENARIO FOR MEASURING TRUST AND REPUTATION

Membership functions (MFs)

MFs are used to expressed the degrees of membership. The basic types of membership functions are classified as the following [START_REF] Cirstea | Neural and Fuzzy Logic Control of Drives and Power Systems[END_REF]:

-Rectangular Membership Function:

µ(x) = { 1, lef t ≤ x ≤ right 0, otherwise ,
where left, right are left and right sides value.

For example, left = 3 and right = 5 (refer figure 6.2).

µ(x) = ⎧ ⎪ ⎪ ⎪ ⎪ ⎪ ⎨ ⎪ ⎪ ⎪ ⎪ ⎪ ⎩ 1 -x-center right-center , center < x < right 1 -center-x
center-lef t , lef t < x < center 1, center = x 0, otherwise (refer figure 6.3) We assume that the linguistic value sets are presented as:

• TrustLevel (Bad, Acceptable, Trust) (Fig. 6.5a)

• Performance (Poor, Medium, Good) (Fig. 6.5c)

• Security (Low, Average, High) (Fig. 6.5b)

Then, the rules are:

T (Ex, En, He) = (ω 1 × T 1 ) ⊕ (ω 2 × T 2 ) ⊕ • • • ⊕ (ω n × T n ) (6.2)
where ω 1 . . . ω n are weight factors of the corresponding trust nodes T 1 (Ex 1 , En 1 , He 1 ) . . . T n (Ex n .En n , He n ). The expected value Ex, En and He are calculated as:

Ex = 1 n n ∑ i=1 β i α i (6.3) En =    √ 1 n n ∑ i=1 (β i α i -Ex) 2 He =    √ 1 n -1 n ∑ i=1 (β i α i -Ex) 2 -En 2 CHAPTER 6.

COMPUTATIONAL INTELLIGENCE: SCENARIO FOR MEASURING TRUST AND REPUTATION

where β i ∈ [0, 1] is an interval scale to present the value trust levels in trust space and α i denotes the time of evaluation between two nodes.

Since reputation based user feedback is considered as subjective testimony, Liu at al. [START_REF] Liu | A fuzzy logic based reputation model against unfair ratings[END_REF] proposed a fuzzy logic based reputation to prevent unfair ratings. To improve the accuracy of the evaluation system, the author considered combining the temporal, similarity and quality aspects of the user ratings based on fuzzy theory into their trust model. The authors divided the involved parties into four different categories. Trusters are responsible for evaluating the reputation of entities known as Trustees. These Trustees provide the ratings which are referred as Witnesses. The ratings provided regarding to the entities as Testimonies. For example, the reputation (R) of trustee (I) is calculated fairly as:

R = ∑ N i=1
N , where truster U of an online system is assessing the reputation of I with a rating set {r 1 , . . . , r i , . . . , r N } and r i is a numerical integer value.

To extend the existing Certain Trust Model (CTM), Nafi et al. [START_REF] Kawser | An Advanced Certain Trust Model Using Fuzzy Logic and Probabilistic Logic theory[END_REF] applied the output of CTM with fuzzy logic by proposing two more parameters such as trust T and behavioral probability P. CTM is a decentralized trust model which enables entities to choose trustworthy partners for risky engagements [START_REF] Ries | Modeling Trust for Users and Agents in Ubiquitous Computing[END_REF]. The objective of this model is to serve as a representation for evidence-based trust and uncertain probabilities [START_REF] Ries | Certainlogic: A logic for modeling trust and uncertainty[END_REF]. The expectation value of CTM is represented as the following formula:

E(t, c, f ) = t × c + (1 -c) × f (6.4)
Where t is an average rating, c and f are certainty and initial expectation, respectively. However, according to [START_REF] Kawser | An Advanced Certain Trust Model Using Fuzzy Logic and Probabilistic Logic theory[END_REF], this model failed to apply fuzzy logic as well as probabilistic logic because of developing on the basis of human understanding. Thus, to overcome this limitation, the authors proposed that the output of CTM is applied with fuzzy logic along with two new proposed parameters. Such as, T rust T = c × t Highest value of rating range × 100% (6.5) and

P = T -f f × 100% (6.6) CHAPTER 6.

COMPUTATIONAL INTELLIGENCE: SCENARIO FOR MEASURING TRUST AND REPUTATION

Another approach based fuzzy logic for trust evaluation is hierarchical fuzzy inference system for service selection. In this approach, Qu et al. [START_REF] Qu | A Cloud Trust Evaluation System Using Hierarchical Fuzzy Inference System for Service Selection[END_REF] have analyzed past benchmark results to identify services that meet all the quality of service requirements. To evaluate trust of cloud service providers, Trust Evaluation Service has taken user requirements and the services' past performance result as input. The output is a list of trust services. Then, the clients can select the most suitable service for their own purposes. Although bias-rating can be overcome, the drawback of past experience was not mentioned in this approach.

For example, new service providers cannot be considered due to lacking of past benchmark values. In this section, we have examined the relevant approaches based fuzzy theory in order to present our proposed model, which is described in Chapter 7, for verifying the trust and reputation of entity in MCC in general and cloudlet context in particular. Since our trust and reputation solution combines fuzzy logic and ant colony, we introduce in the next subsection the principle of ant colony optimization.

Ant Colony Optimization

Introduction

Ant Colony Optimization (ACO) is a one of the swarm intelligent methods. It is considered as a population-based meta-heuristic that can be used to find approximate solutions to solve optimization problems [START_REF] Dorigo | Ant Colony Optimization[END_REF]. According to the history of appearance, ACO has been proposed initially by Marco Dongo and his colleagues in 1991, called Ant System.

In 1997, the first major improvement has been presented also by Dorigo Gambardella, namely Ant Colony System. Max-Min Ant System, which has been introduced by Stuzle and Hoos [START_REF] Stützle | MAX-MIN ant system[END_REF] in 2000, is another improvement. The best practice for understanding ACO is to solve the traveling sales man problem (TSM). The objective of TSM is to find the shortest path in a closed tour for linking a number of nodes and each node is visited once and only once. The term ACO reflects the original instinct of ant in natural world: the forward ant explores the path randomly to find the food while depositing a chemical substance to create a pheromone trail that allows other ants to follow the same path.

The return ants will update the knowledge with their collected information on the paths they traveled. In ACO algorithm, construction of ant solutions and updating pheromones CHAPTER 6. COMPUTATIONAL INTELLIGENCE: SCENARIO FOR MEASURING TRUST AND REPUTATION are two important components. To construct ant solutions, at each node, ants have to determine where to move next according to a probability that relies on two factors such as pheromone trails and heuristic information factors (refer to eq. 6.7). The former factor reflects the past experience of the colony while the latter assesses the interest of selecting a component with respect to an objective function [START_REF] Castillo | A new approach for dynamic fuzzy logic parameter tuning in Ant Colony Optimization and its application in fuzzy control of a mobile robot[END_REF].

p k ij = [τ ij ] α [η ij ] β ∑ l∈N k i [τ ij ] α [η il ] β , if j ∈ N k i (6.7)
Where p is the probability that ant k in node i move to node j after taking decision that the node with the largest probability may not be chosen [START_REF] Gao | An overview of performance trade-off mechanisms in routing protocol for green wireless sensor networks[END_REF]; τ ij represents the amount of pheromone trails on the path between i and j; η = 1 d ij , where d ij presents the distance between i and j, indicates the heuristic value. β and α are the weight factors that control the relative importance of trail against heuristic function and N k i is the feasible neighborhood of ant k which refers to the set of non-visited city. [τ ij ] α [η il ] β is the maximum value when ant k is located at node i and move to node l.

After constructing the closed tour, the pheromone trails have been updated by following the rule: the better the tour, the greater the amount of pheromone that the paths will receive [START_REF] Castillo | A new approach for dynamic fuzzy logic parameter tuning in Ant Colony Optimization and its application in fuzzy control of a mobile robot[END_REF]. Thus, it is important to note that the purpose of updating pheromone is to raise the pheromone values associated with good solutions, otherwise reducing these values that associated with bad ones [START_REF] Dorigo | Ant Colony Optimization[END_REF]. Another point is that the pheromone trails gradually evaporate over time, however the resilience of these trails amasses due to multiple ants using tour. The equation 6.8 represents the local update of pheromone which is applied immediately after passing the path between node i and j of ant k during the tour construction [START_REF] Amir | A fuzzy logic controller for ant algorithms[END_REF].

τ ij = (1 -ρ) × τ ij + ρ × τ 0 (6.8)
Where ρ, 0 < ρ < 1 is the rate of pheromone evaporation and τ 0 denotes as the initial value for the pheromone trails. After each iteration and evaporation is applied to all paths, the shortest path is determined by the elite ants. Only these ants can update the trails to increase pheromone value, namely global pheromone trail update, as presented in equation 6.9.

τ ij = (1 -ρ) × τ ij + ∆τ kbest ij (6.

Trust models with ACO: related work

Since bio-inspired computing has become important for both the industrial environment as well as the scientific world, the inspiration from swarm intelligence has obtained some highly successful optimization algorithms. In this section, some of the primary approaches related to bio-inspired computing have been presented. Amir et al. [START_REF] Amir | A fuzzy logic controller for ant algorithms[END_REF] introduced the TRUST AND REPUTATION The former refers to the weight of the heuristic information to the pheromone trail. The latter denotes the parameter that controls the exploration against the exploitation in the decision of ants. For example, the fuzzy rule can be expressed as: "IF error is low and variance is medium THEN β is Low". As a result, the modified ACO algorithm has become more flexible than the basic one. By the same token, Castillo et al. [START_REF] Castillo | A new approach for dynamic fuzzy logic parameter tuning in Ant Colony Optimization and its application in fuzzy control of a mobile robot[END_REF] presented the approach for dynamic fuzzy logic parameter tuning in ACO. By tuning the α parameter, the objective of this approach is to avoid or slow down full convergence through the dynamic variation of a parameter. In this approach, instead of taking the value of α equal to 1 as many approaches did, the α value is the output of fuzzy control, which the input are the error and change of error. Moreover, fuzzy control can be considered as the translation of external performance specification and observations of a plant behavior into a rule based TRUST AND REPUTATION linguistic system. For example the rule can be expressed as: "IF (error is P) and (change of error is P) THEN (α increment is N)".

In social network context, Saied et al. [START_REF] Asghari | A reliable path between target users and clients in social networks using an inverted ant colony optimization algorithm[END_REF] have used an alternative ACO algorithm, called the inverted ACO (IACO) [START_REF] José | An Inverted Ant Colony Optimization approach to traffic[END_REF], instead of the basic one to find trust path between the customers and service provider as well as enhancing load balancing among the customers.

Generally, in the IACO, the pheromone scent creates a repulsion effect for other ants to avoid the tour instead of using attraction effect to improve the pheromone value. The IACO algorithm can slip into two phases. Firstly, the selection operation is established among the involved users and the user with higher ρ will be selected. Then, after updating pheromone, the ants in the next interaction will travel in a new route. For instance, if ant k satisfied the user's requirement at time t and then ants in the next interaction (t+1) will move to other service providers. It leads to reduce the waiting time of other users and also improve the load balancing of service providers. Likewise, Shi et al. [START_REF] Shi | An ACO-Based Trust Inference Algorithm[END_REF] proposed an ACO-Based Trust Inference algorithm to find trust chain between two nodes in social networks. In this approach, direct trust and trust chain are used to calculate indirect trust value between two nodes. The authors calculated the inferred trust (T is ) between node i and s based on the threshold T M IN and the trust value (T ij ) of node i and j from the adapted equation [START_REF] Ann | Computing and Applying Trust in Web-Based Social Networks[END_REF]:

T is = ∑ j∈N (i),T ij ≥T min (T ij × T js ) ∑ j∈N (i),T ij ≥T min T ij (6.10)
then they can get the trust value to the destination node.

Biswas et al. [START_REF] Biswas | Trusted checkpointing based on ant colony optimization in MANET[END_REF] have applied ACO to design an ant colony based trust model for evaluating trust values of a mobile entity in mobile ad-hoc network (MANET). According to the authors, the node is considered as a trusted checkpoint that will never be a malicious or selfish node. This node also has low failure, rate of security attacks and high availability, positive reference to other nodes. In order to decide a specific node as trusted or malicious, the former has the increasing deposited pheromone value while the latter receives the less value. The shortest path between source and target nodes is chosen if there is more than one path which consists of multi-trusted nodes and high pheromone values. Fuzzy-based trusted ant routing protocol (FTAR) [START_REF] Sethi | Fuzzy-based Trusted Ant Routing (FTAR) Protocol in Mobile Ad Hoc Networks[END_REF] is another approach in MANET. In this approach, the CHAPTER 6. COMPUTATIONAL INTELLIGENCE: SCENARIO FOR MEASURING TRUST AND REPUTATION authors have used the dropped packet and time-ratio parameters as the input of fuzzy logic to calculate the trust value for distinguishing between trusted and malicious nodes.

They assumed that forward ant (fwa) and backward ant (bwa), a small packet with unique sequence number to prevent duplicate packets, are used to explore the tour. However, fwa will be destroyed when it reaches the destination node. Then, bwa is created for sending back to the source. Here, the authors claimed that their approach can avoid the black hole, gray hole or selective attack by selecting trusted node which is the output of fuzzy logic.

Summary

Since the bio-inspired computing has been attracting, it increased the attention of many researchers because of its good performance and while resolving optimization problems.

Hence, there are many effective approaches which will be discussed in the chapter 7 while making a comparison in terms of performance between our proposed approach and the existing ones. In the next chapter, we will introduce our contributions.

Part III Contribution

As the result of the technical revolution, mobile devices such as smartphone or tablets computer have been upgraded and made a huge impact on the human's life. From the perspective of security, mobile devices are the soft target of hackers to steal the personal data of the users. Thus, the security concerns need to be addressed in order to establish the trust environment.

Energy efficiency in Mobile Cloud Computing Architectures

In the context of MCC, energy efficiency must be considered not only at the cloud side but also at the mobile side. The former is used to solve the existing limitation of the latter by using remote resource provider rather than processing/storing data locally [START_REF] Fernando | Mobile cloud computing: A survey[END_REF]. In terms of saving energy for mobile devices, the externalization of data and applications is viewed as an effective solution. However, this depends on the MCC architecture that is considered. In fact, if the externalization occurs between the mobile device and the cloud, the application or the data offloading may be costly comparatively to a local mobile computation. More precisely, we conducted some experiments by considering different approaches, all of them based on the Mobile-Cloudlet model: OSGi, overlay and container based solutions, while comparing the energy efficiency among these architectures to pinpoint their merit and demerit.

To experiment on this work, we have used two devices to implement three discussed Cloudlet based architectures. Performance comparisons is conducted on a Local Area Network (LAN) to overcome Internet Wide Area Network (WAN) latencies that are common to all solutions [START_REF] Houacine | Service Architecture for Multi-environment Mobile Cloud Services[END_REF], [START_REF] Thinh | Energy Efficiency in Mobile Cloud Computing Architectures[END_REF].

• Cloudlet side: Linux Ubuntu 14.04 LTS, 64 bits, CORE i7

• Mobile device side: Windows 7/Linux-based OS 32 bits, DUAL CORE.

Elijah project [START_REF] Ha | Just-in-time Provisioning for Cyber Foraging[END_REF] based on overlay notion. As presented earlier in 3.2.3, the application overlay is calculated as the binary diff (VCDIFF RFC3284) using xdelta3 tool1 , between the complete VM disk image and the base VM disk image. The base VM is then deployed to any platform that will serve as a cloudlet. We assume that we have a VM overlay in the mobile device side. In the cloudlet side, a VM instance is rebuilt by this overlay. The mobile device connects to the cloudlet upon detecting its IP address, using the program "synthesis_client" and supplies the VM overlay. When the mobile device sends the VM overlay to the cloudlet, the cloudlet server starts performing the VM synthesis operation.

Open Service Gateway initiative (OSGi).

The OSGi framework provides an environment for the modularization of applications into smaller components called "bundles".

These bundles can be either executed on the mobile device or on the Cloud/Cloudlet. Generally, increasing size of program leads to a rise of execution time for all models.

Although transferring an overlay via high speed LAN Wi-Fi, however, Elijah takes more time in comparison with the others especially soar to double time in Program 4 which is the heaviest program. The concept of a VM overlay is similar to copy-on-write virtual disk On the other hand, with installed Java virtual machine and OSGi framework on each node [START_REF] Houacine | Service Architecture for Multi-environment Mobile Cloud Services[END_REF], applications supporting OSGi can interact with a proxy bundle which is generated dynamically with the exported methods without transferring any heavy code. As a result, running a bundle in OSGi framework is the fastest solution in term of time-consuming.

The remaining solution, Docker, has insignificant higher execution time than OSGi due to the layer transferring.

Taking the efficiency of offloading for a specific example of energy saving, we consider the following formulas as defined in [START_REF] Kumar | A Survey of Computation Offloading for Mobile Systems[END_REF] to apply with our experiments.

• M Sm denotes the execution time to run the program locally, where M is the amount of computation and S m is the speed of the mobile device

• D B + M Sc refers to the execution time and the offloading time, where D, B and S c are respectively the size of input data, the bandwidth, and the speed of the remote server.

We consider two cases: CHAPTER 7. MOBILE CLOUD COMPUTING: REAL CASE STUDY Case#1 M Sm > D B + M Sc if running, a computation takes locally more time than offloading it and running it remotely, then the performance of the whole system is improved by using a specific offloading technique.

Case#2 M Sm < D B + M Sc , it means that the offloading does not meet the requirement for computation efficiency.

Adapting these cases to the experimental results, it can be clearly seen that the result of offloading for three architectures is almost positive. Take OSGi based approach for a specific example, the value of M Sm is always greater than D B + M Sc value regardless of the program's size. However, this does not mean that the offload method is always a suitable solution in the context of energy saving. The program 4 in Elijah has proved this drawback of the offloading.

The energy consumed by the mobile device in each MCC model is mainly composed of:

-The computing energy: consumed by the mobile device for execution of local services such as initiation and service request, discovery service, locally executed processes. This energy depends on both the mobile characteristics (computing and battery features) and the performed computing; and -The communication energy: consumed during the I/O operations using mobile network. It depends on the mobile characteristics, the network characteristics and the size of data to be transferred.

The local computing energy is calculated as in equation (e.q 7.1)

ComputingEnergy Service = M obile Capacity × T ime Service (7.1)
Where:

• ComputingEnergy Service : is the local energy consumed by a service S (in Joule or kWh).

• M obile Capacity : is the battery capacity of the mobile device (in milliampere or Joule).

• T ime Service : is the time of the service execution.

CHAPTER 7. MOBILE CLOUD COMPUTING: REAL CASE STUDY

Nexus S (4.0", 480 * 800 : hdpi) is used for our experimentation with Android 2.2 system.

The energy capacity of this device is 19152 Joules (1440 mAh). Table 7 crossing architectures also need to be considered. It may lead to increase network latency and transmission rate. In addition, the execution time is based on the application size and the result does not always meet the expectation. For a function partitioning [START_REF] Hoang | A survey of mobile cloud computing: Architecture, applications, and approaches: A survey of mobile cloud computing[END_REF], application functions could be determined which part is to be offloaded to the remote cloudlet and which part is processed locally on the device. For example, the appearance of application is displayed locally, while offloading heavy computations to the cloudlet.

This takes more energy consumption in case of heavy code offloading. Consequently, the offloading technique is not always considered as the effective solution for MCC. Indeed, the OSGi based solution that relies on Client/Server interaction without offloading mechanism can confirm that offloading is not always the suitable solution in terms of energy efficiency.

To sum up, we can clearly say that MCC aims to allow the mobile user to overcome its heavy works by providing a seamless and rich functionality regardless of the resource limitations of mobile devices. Although MCC becomes the future dominant model for mobile applications, the energy consumption is necessary to consider in order to estimate the efficiency of most of approaches in the context of resource-constraints.

Demonstration of Mobile Cloud Computing model in real context

To illustrate the application of MCC, we have considered a use case inspired from Smart City, that is, a mechanism that relies on virtual keys instead of real keys of our daily life. Called DropLock, this framework can not only be applied for the product delivery as presented here, but also helps granting authorized access into anything that is locked and that requires unlocking like buildings, hotels, etc. The goal of Droplock approach [START_REF] Thinh | Middleware to Integrate Mobile Devices, Sensors and Cloud Computing[END_REF],

which is based on Mobile-Cloud model, is to improve the security of the service delivery from the supplier to the client while illustrating the need of MCC and Internet of Thing convergence. Currently, if a user orders a product on Amazon website for example, the delivery man will not deliver the product to the user if the latter is not available at the time the package is delivered. Our system overcomes this problem and enables the user to authorize the delivery man to access to the user mail box to deliver the product through an authentication and an authorization process provided by the Cloud to the mobile devices respectively of the user and the delivery man, in case the user is not at his home to receive the package. Once done, the mobile device of the delivery man can interact with an electronic board on the mailbox that will manage the box access. In the same context, the mailbox can be located at the post office. In this case, it is the delivery man that authorizes CHAPTER 7. MOBILE CLOUD COMPUTING: REAL CASE STUDY arduino board. The latter locks the door and informs the smartphone of the delivery man. This smartphone sends a message of good delivery to the delivery office cloud, which informs the user of the mailbox. When the user of the mailbox goes home, he can retrieve his product.

This functioning assumes that in the cloud side, the owner of the secure box has previously registered the users/devices which are authorized to access to his mailbox. In fact, to send the virtual key, the cloud checks before if the delivery man/device is allowed to access to the mail box. The One-Time-Password based security solution has been privileged because it avoids replay attacks.

To be more specific, in [START_REF] Thinh | Middleware to Integrate Mobile Devices, Sensors and Cloud Computing[END_REF], we have presented the system model to describe the general architecture of any system that relies on machine-to-machine Cloud computing model for smart cities that meets the following requirements:

• Data communication methods.

• Security methods to secure the communications and control the access to the Cloud.

• Resources registration methods that allow the registration of new users within the Cloud system.

• Execution on constrained environments since data processing is partly performed on sensors and mobile devices.

Based on these requirements, as can be seen from figure 7.4, we propose a distributed based machine to machine platform that integrates many services operating at different levels such as network management services, system management services, data management services, security and authentication services.

Network management services

These services offer the applications the suitable means to achieve communication between different smart entities. According to mentioned context, the framework should handle different ranges of communication protocols. b. Communication between the mobile device and the Cloud: The high-band communication is adopted to allow interaction between the mobile device and the Cloud thanks to wireless networks managed by telecom mobile operators.

c. Sensor discovery: The mobile device may integrate services that allow it to discover neighboring sensors using a peer-to-peer communication. c. Data Centers in the Cloud: Data centers are used to store big data collected from multiple sources. They need also to be managed efficiently regarding energy management concerns.

Data management services

System management services

Because smart devices are constrained environments, they host minimum services with a low footprint. On the contrary, in the Cloud computing context, system management services offer the applications the necessary services that allow task scheduling, load balancing, offloading, migration, virtualization and energy optimization. The system manager relies on distributed infrastructures (IaaS) and platforms (PaaS) to meet Sensing as a Service (SaaS) requirements. In addition, SaaS enables the smart devices such as sensors or mobile devices which may be physically accessible from the Cloud or virtualized so that the Cloud can access to the virtual images of these devices, hence facilitating the management of these devices.

Security and authentication services

The platform should provide security mechanisms in order to ensure trust in the platform and improve data privacy. In fact, unlike the access to the Cloud that can rely on a trusted party (called Trusted Service Manager in figure 7.4), the other platforms such as mobile devices and sensors are generally not trustworthy. However, mobile devices can build trusted environment by relying on hardware trusted platforms as stated in [START_REF] Bouazzouni | Trusted mobile computing: An overview of existing solutions[END_REF], [START_REF] Bouzefrane | Trusted Platforms to Secure Mobile Cloud Computing[END_REF] such as SIM cards, Secure Elements (SE), TEE (Trusted Execution Environment). Some sophisticated sensing platforms like Arduino offer specific libraries that implement some cryptographic algorithms, even if they do not have crypto-processors. In our approach, the following steps must be considered:

a. The smart devices need to be authenticated before communicating with any other CHAPTER 7. MOBILE CLOUD COMPUTING: REAL CASE STUDY platforms (sensor, mobile device, Cloud). For devices with limited resources, the authentication could be implemented as a protocol with lightweight cryptographic algorithms.

b. Data must be encrypted and sent in secure channels.

c. Privacy: Protecting the privacy of user data is the most important factor in Cloud computing. Thus, privacy management related to IoT, mobile devices and Cloud computing should be considered to make it possible for the convergence.

Summary

In this chapter, we highlight the case study of MCC by looking into the energy efficiency and demonstration in real context. Although the concern related to MCC is a wide area, we have presented areas that are relevant to the objective of this thesis. In addition, the simple security method (i.e token) in Droplock inspire us to develop a new security solution based software token. Hence, in the next chapter, the novel schema of remote attestation is proposed as the second contribution.

Chapter 8

Property based Token Attestation : A Novel Framework

Introduction

As cited in Chapter 3, the surge of the presence of personal mobile devices in multienvironment makes a significant attention to the mobile cloud computing. Along with this concern, security issues also appear as a barrier to prevent the propagation of this trend.

The goal of this chapter is to focus on an important feature in many security protocols and applications, which is the device attestation in the Mobile Cloud Computing (MCC) to accomplish a secure MCC environment, security threats need to be studied and acted accordingly, and therefore, we first present again the common threats and then explain a novel attestation schema for addressing these threats by providing security proofs. In addition, Scyther [START_REF] Cremers | Operational Semantics and Verification of Security Protocols. Information Security and Cryptography[END_REF] is used to verify the correctness of the proposed protocol.

as

CHAPTER 8. PROPERTY BASED TOKEN ATTESTATION : A NOVEL FRAMEWORK

Scenario and Threats

Scenario

Bring Your Own Device (BYOD). This term has become a current trend as it combines the benefits of the enterprises and the employees. Besides its advantages, BYOD still remains a dark side probably putting a company's business system at risk. In the BYOD context, we consider our proposed solution to address the existing challenges: 1) The employee with her own device which can be compromised to access restricted business data;

2) The user tries to access data which is not available for her level; 3) The employee quits her job but keeps accessing business data. By overcoming these issues, our work interests a real-world use case. Considering in business context, the employee can use her own phone for personal purposes such as Facebook, Twitter etc.; she can also install a company application for carrying out her work responsibilities. For daily working, depending on her working role and level, she wants to access or receive sensitive business data such as business contract, strategy; these data can be stored locally or globally. In this case, her phone needs to provide its secure evidence before being granted a right to access or receive specific information.

Threats

Although BYOD is quickly becoming the new standard in workplace technology, there are a number of security risks associated with it. Without fully understanding and controlling, the term BOYD can be turned into Bring Your Own Danger/Disaster. In fact, threats on BYOD are quite similar to that of the mobile cloud computing. The only different threat is the user increases the risks by more exposing her devices because of multi-working environments and the enterprise being out of control in the device's using circumstances, such as selling, buying, or maintaining. In this approach, there are only three involved parties in our protocol. We assume that the cloud side, including the Trusted Third Party and the enterprise server, is secure. In addition, vulnerabilities in Cloud are neglected. Before discussing the goal of our proposed solution to address the following listed threats in this subsection, we begin by shortlisting the common threats relevant to FRAMEWORK the enterprise mobile user.

1. Vulnerability. The mobile device is considered as the resource-constraint device with the limitation of data storage, computation, and energy. So it is not often installed with sophisticated anti-virus application. The mobile data also contains many privacy issues and insufficient management of data encryption techniques when being used both socially and in working environment. For example, with the existence of many data encryption methods, the enterprise faces with a difficult decision to find data encryption strategy that can adapt for all devices and different levels of users. This makes the mobile or tablet prone to attack.

Leakage of data.

There is a risk that software can deliberately/accidently leak data;

or a bad user can use a compromised application to obtain legitimate access. In BYOD context, the mobile user is responsible for devices/ software patch updates. It is to increase the risk of data leakage due to buggy/ malicious software or untrustworthy employees.

3. Miscellaneous data. The enterprise as well as personal data are often stored in the same local device storage. In some cases, a malware injected without any user awareness could find a way to harm the enterprise data.

Careless using.

There are many attractive mobile applications for daily use. However, these apps are not always free or suitable for mobile platforms. As a result, the user tends to modify her mobile platform by rooting/ jailbreaking it. Root/Jailbreak is not really bad but it is not suitable in the BOYD context where the platform cannot be exposed. In addition, lost and theft are the other risk factors to breach the security of mobile devices.

Proposed solution

In previous sections, we present the current techniques and the use case for motivating the creation of software token based TPM. In this section, we present our proposed solution, namely Property based Token Attestation (PTA), which takes the advantage of the existing

Definition of property and trust token

The property in Property based Attestation (PBA) mechanism is used to describe the behaviour of a platform or program without revealing its configuration. However, FRAMEWORK the definition of property to be attested is a broader scope. Thus, everything related to platform or application can be considered as property [START_REF] Nagarajan | Property Based Attestation and Trusted Computing: Analysis and Challenges[END_REF]. In this issue, we attest abstract properties of program's classes to define the security requirements.

Assumptions.

In this proposed model, we present the Property Token which contains random properties.

The quantity of the property is used to set the policy for accessing or for security level.

We assume each application has its own property list (PL). The third party who provides Software/Security as a Service to the Enterprise manages this list. In the client side, the mobile device can generate a list of random properties Pi which is compared to the third party's property list (PL) later. We also assume that all involved parties are equipped with the TPM, especially for the mobile client. This TPM generates a key pair to perform asymmetric cryptography. Before describing the protocol, the following pre-conditions need to be satisfied.

The Enterprise (V)

• V is the enterprise who outsources its security service to the Trusted Third Party FRAMEWORK (TTP)

• V and TTP set a security policy for the mobile client (M) based on the Token issued by TTP.

• V grants permission for its employees to access resources if the employees satisfy its requirements.

The Trusted Third Party (TTP)

• TTP is the organization which provides Cloud based security (XaaS) i.e. Software/Security as a Service

• TTP is responsible for checking valid M, either hardware or software.

• TTP has knowledge of its provided services and clients such as Application ID, Property List, and Certificate of Attestation Identity Key of M (See Fig. 8.1).

• The Public-Key Cryptosystem is used for securing data transmission between TPP and V only to prevent the compromised M.

The Mobile client (M)

• M is an employee who asks to access V's data or carries out some tasks in extension model, for example offloading or migration.

• Depending on M's role in the enterprise, she can access a specific data only.

• M installs an application securely and logs in with the user ID and password successfully.

The Token (Tk)

• Tk can be considered as a trusted proof for the employee M to access a secure resource.

• Tk is issued to M by TTP if M's hardware/software platform evidences pass the attestation process.

CHAPTER 8. PROPERTY BASED TOKEN ATTESTATION : A NOVEL FRAMEWORK

• As discussed earlier, Tk consists of the level of security based on the random property list (Pi). It is assumed, for a specific application, that the software provider (TTP) has a full list of application properties (PL) which can be defined in class levels. The application also has a special service for picking and generating a random property list for the mobile client. For example, as illustrate the figure 8.2, the PL consists of twenty six properties (a-z) of application while a quantity of matched properties (Pi) refers to a level of security as higher number higher level. Let call p a property; M1 and M2 are clients with their legal Pi. Then their integrity is verified successfully.

While M3 with its compromised Pi, M3 will be discarded. We have the following attestation conditions. (DAA) [START_REF] Brickell | Direct anonymous attestation[END_REF], [START_REF] Smyth | Direct Anonymous Attestation (DAA): Ensuring privacy with corrupt administrators[END_REF], [START_REF] Coker | Attestation: Evidence and trust[END_REF]. Hence, in this context, we assume that TPM has its own Certificate of AIK. We start this part by explaining the structure of PTA protocol in high level. After recalling the necessary notations, we present the detail of message sequence charts of PTA protocol in 8.3.5.

P i ⊂ P L | P i ̸ = 0 W ith p ∈ P i & p ∈ P L If (∀p ∈ (P i ∪ P L))T hen P ass If (∀p ∈ P i & ∃p / ∈ P L)T hen F ail

General Overview of the PTA protocol.

Before discussing the structure of the proposed protocol, we recall the following notations that we use here.

-TTP: is the software provider with a key pair (S KT T P , P KT T P ). TTP has a Property List (PL).

CHAPTER 8. PROPERTY BASED TOKEN ATTESTATION : A NOVEL FRAMEWORK

-M: is the mobile identified by M ID that has an App installed from TTP with a key pair(S KAIK , P KAIK ). This key pair is the result of the remote attestation protocol used to attest the trust of M.

-the Enterprise (V) that has data to be accessed by App of M with a key pair (S KV , P KV ).

-V has a list of mobile identities authorized to access to V's data. Hence, M ID must be registered within V.

-App can be any software or specific software of V available from TTP. App is installed with its own properties which represent App's behaviors.

-Hash (Message) computes the hash of Message.

-(Hash(M essage)S KX , M essage)P KX demonstrates the hash is followed with the same data in clear text. The whole encrypted by the public key of X to guarantee the confidentiality of the message.

-(M essage)P KX is the Public-Key Cryptosystem for secure data transmission among involved parties.

-X ID denotes the identity of party X.

-T X refers to the timestamp which is generated by party X to avoid replay attacks -N X is the nonce of party X.

-N X * N Y is the shared nonce value which is computed by Diffie-Hellman exponentiation [START_REF] Cremers | Operational Semantics and Verification of Security Protocols. Information Security and Cryptography[END_REF] between X and Y only.

-ML is the measurement list that contains the measurement value of all entities in the computing platform, for example the measurement of random desired properties in this context. In other words, ML contains the fingerprint list of the entities. ML is used for the integrity measurement with TPM.

Before using the protocol, there are two initial steps. One is related to remote attestation to attest that the mobile device is a trust environment based on TPM and that allows FRAMEWORK getting the Certificate of AIK. The other described in the following is related to the way to obtain properties Pi for the app. The process to obtain the Certificate of AIK that is described in detail in Chapter 4 and in [START_REF] Coker | Attestation: Evidence and trust[END_REF].

We assume that the user logs in with her Id and Password successfully to V's platform.

After verifying online user information (this is the user authentication step) by V, the verified result, which may indicate user's access level, user role, or registered services, will return to the application. Based on this result, the trusted service/ trusted part of application within M will generate a random Pi. The Pi cannot either be affected by application/platform's update or reveal app/platform's configuration. It satisfies the feature of property based attestation.

To prevent a compromised Pi, TTP also has knowledge of user level by exchanging information with V. For example, if the attacker can modify the Pi before TPM's extend operation, TTP will terminate a process due to the invalid quantity or quality (matched properties) of compromised Pi. In case the user loses his Id and password, the attacker with their own devices can obtain the verified result. However, asking for the token to access data is denied thanks to the remote attestation of TPM.

Dataflow of PTA protocol

To depict the general overview of PTA protocol, the message sequence is presented by figure 8.4.

In PTA protocol chart, M has an app that wants to access to V's data according to BYOD concept. Because V delegates its mobile user authentication to TTP, V requests TTP the certificate of M proving its platform attestation. After some verification, TTP sends the certificate to V so that V can discuss with the legitimate M. M requests the token from TTP, by proving that V and M are authentic entities. Then, TTP sends the token to both M and V. Hence, V can check that the token received from M is the same with the one received from TTP, which allows V to grant access to M's app. In flow 1, M initiates a message with M ID , nonce N M and a timestamp T M to start the communication.

The generation of these parameters is achieved thanks to the TPM of M. Only receiver V FRAMEWORK Figure 8.4: Overview message exchange of PTA protocol can decrypt this message using his private key. However, due to a lack of knowledge of CERT AIK , V cannot verify the hash value. V needs this certificate to extract the hash value to compare it with the calculated one and check the identity of M. It is why in flow 2, V asks TTP for CERT AIK by sending its own N V 1 and M ID . According to our assumption, TTP (acting as a Verifier) has obtained this certificate from P-CA or DAA during binary attestation. TTP decrypts the message using its secret key, and checks the integrity of (M ID , N V 1 ). It then uses M ID to find M's certificate CERT AIK that it will send in the next step. In response to V, TTP flow 3 generates the nonce N T T P 1 and sends it to V along with the hash value of N V 1 * N T T P 1 and the public key AIK of TPM/M that it has. V then decrypts the message to get P KAIK , N T T P 1 . To avoid the compromised message, V re-computes and compares a new hash value with received hash value such as Finally, the mobile user (flow 8 ) can obtain the right to access to the specific data within the valid duration T T T P . Thanks to the knowledge of this trust token, Enterprise V can manage the access of their employees.

Hash(P K AIK , SavedN V 1 * ReceivedN T T P 1 )

Security Properties Review.

In this part, we discuss briefly the following security properties associated with the messages exchanged for attestation purposes and show how our proposed protocol fulfills them.

-Confidentiality: each message m sent from A to B is confidential. The confidentiality is guaranteed thanks to the encryption of m with the B's public key allowing B to be the only entity that can decrypt m because the key used to decrypt the message is secret and held only by B. This property is applied for each flow as shown in the protocol. For example, in flow 1, when M sends a request to V, M encrypts with the public key of V to guarantee the confidentiality of the request containing sensitive data.

-Authenticity of the sender: to guarantee that sender A is the one who sends effectively data d, A signs d with its secret key. For example, in flow 2 sent by V to TTP, the d = (Hash(M ID , N V 1 )) is signed by V using its secret key S KV to ensure that only V can be the sender.

-Data integrity: each time data d is sent by A to B; d is sent with the hash value of d. This process guarantees data integrity because if clear data d is compromised, the computed hash value of d will be different from the one sent in the flow. For example,

in flow 2, d = (M ID , N V 1 ) is compared with Hash(M ID , N V 1 ). Moreover, Hash
Extend operation is used throughout the TPM for the integrity measurement. The value extended into PCR can reflect the entity's state. This operation is represented in flow 5 where the sender extends Pi into specific PCR and the receiver has to re-calculate this value by using the same hash extend operation.

-Shared secret: the nonce is used to create a secret that is known to all involved parties. The party outputs data to be stored for later use with the shared secret.

When this data is later input, the party verifies the shared secret to detect the validity of data. Take flow 3 for a specific example, instead of sending a whole value of shared secret N V 1 * N T T P 1 , a partial value N T T P 1 is sent from TTP to V. The receiver V FRAMEWORK should re-calculate and verify this shared value with its saved N V 1 .

Security Analysis

Since V and TTP are assumed to be trust environments, our proof is related only to the behavior of the mobile device M that may host malicious software and/or harmful data.

Proof 1: related to the reception of messages by M. Compromising messages flow 4 and flow 6 means that we can have access to the secret key S KAIK to decrypt the message. This can be possible if the key S KAIK is saved within the memory of a malicious mobile device M. But since M has been attested using its TPM (according to our assumption), this means that S KAIK is safely saved in the EEPROM of the TPM. By assumption, TPM cannot undergo physical attacks, that is, TPM is a secure and trust environment. In addition, all the cryptographic operations are performed inside the TPM.

In case M is not a legitimate mobile device, M cannot decrypt the messages of flow 4 and 6 because the malicious M does not have the appropriate secret key S KAIK . This key is saved in the TPM of M and changes each time the remote attestation protocol is used.

1. Flow 4 from V to M ((Hash(M ID , V ID , N V * N M , T V ))S KV , V ID , N V , T V )P KAIK Let the message D = ((Hash(M ID , V ID , N V * N M , T V ))S KV , V ID , N V , T V ) (8.1)
2. Suppose there is a malicious mobile M ′ who sniffs the message D. The secret key S KAIK of M is stored safely EEPROM of TPM. By our assumption TPM cannot undergo any physical attacks. So, M ′ cannot get in any way the key S KAIK . It is not possible to derive S KAIK from P KAIK . As in public key cryptography, a public key and a secret key are mathematically related using one-way function, thereby making a unique combination of keys. Now, M ′ has an inappropriate secret key S ′ KAIK where S KAIK ̸ = S ′ KAIK .

3. Now, using the secret key S ′ KAIK , M ′ tries to decrypt the message.

d ′ = [D]S ′ KAIK = (A ′ , V ′ ID , N ′ V , T ′ V ) (8.2) FRAMEWORK [A ′ = decrypted value of Hash(M ID , V ID , N V * N M , T V ))S KV using S ′ KAIK ] Whereas, if message D is decrypted by S KAIK , then we would get d = [D]S KAIK = (A, V ID , N V , T V ) (8.3) [A = decrypted value of Hash(M ID , V ID , N V * N M , T V ))S KV using S KAIK ]
Here as, V is a trusted environment, M ′ will not know V ID , N V , T V , because D is encrypted by P KAIK , not by the public key

P ′ KAIK of M ′ . So, V ′ ID ̸ = V ID , N ′ V ̸ = N V , T ′ V ̸ = T V .
To a legitimate M,

[A]P KV = hv (8.4) Legitimate M knows M ID , N M . So, it calculates Hash(M ID , V ID , N V * N M , T V ) = hv (8.5)
From (8.4) and (8.5), M is sure about the identity of V.

But, to a malicious M ′ , [A ′ ]P KV = hv ′ . Malicious M ′ does not know N M , but it may or may not know valid M ID .

(a) If M ′ does not know M ID , then it generates a M ′ ID and N ′ M . Now,

Hash(M ′ ID , V ′ ID , N ′ V * N ′ M , T ′ V ) = hv1 ′ ̸ = hv ′ ̸ = hv (8.6)
The reasons are as follows:

-N ′ M is a randomly generated number, so it is almost impossible to get

N ′ M = N M
-It is very difficult to know an input x from h, where Hash(x) = h -Also finding another input z is very difficult where Hash(z) = h (b) Due to the same reasons as above, when M ′ knows M ID ,

Hash(M ID , V ′ ID , N ′ V * N ′ M , T ′ V ) = hv2 ′ ̸ = hv ′ ̸ = hv (8.7) FRAMEWORK
As it is not possible by any means for M ′ to know hv and the inputs used in the Hash function, M ′ cannot get access in any way V ID , N V , T V , N M . So, it does not matter whether M ′ knows M ID or not; the message used in flow 4 will not be compromised unless it knows S KAIK .

In case of message in flow 6 from TTP to M also, M ′ cannot know in any way P i, V ID , N T T P , N V , N M , T T T P , thanks again to the Hash function. So, the message used in flow 6 will not be compromised unless it knows S AIK . The same process follows for every secret key of M, changed in each session the remote attestation protocol is used.

Proof 2: man in the middle. By using TPM remote attestation, there are many contemporary works investigated on this TPM feature, in order to prevent man-in-middle (MIM) attack [START_REF] Cheng | A Security-Enhanced Remote Platform Integrity Attestation Scheme[END_REF], [START_REF] Alpár | Avoiding man-in-the-middle attacks when verifying public terminals[END_REF], [START_REF] Francillon | Systematic Treatment of Remote Attestation[END_REF]. Similarly, we also take advantage of TPM's benefits to avoid the threat of MIM. Let's assume that, the attacker (MIM) can mimic V and uses V's certificate, Cert AIK (V ) in this case, to communicate to either TTP or M. Cert AIK (V ) cannot be linked to his own TPM because Cert AIK (V ) can only be accessed by V's TPM.

As presented in section 4.8, all involved parties must perform remote attestation process to make sure all the parties in a trusted state before establishing the communication. With Cert AIK (V ), it is not enough for the attacker to communicate successfully to TTP/M. For example, in step 4 (Figure 4.9), when he sends (Attacker ′ s P CR value), SM L, Cert AIK (V ) to the Challenger (TTP/M) to verify, the Challenger (TTP/M) will discard and declare the Attestator (Attacker) is untrusted one due to the non-matching received information.

Referring another scenario, the Attacker intercepts from step 1 and can obtain his own

Cert AIK (Attacker). He then sends this certificate to the Challenger as in step 4. This case is also impossible for him to prove that he is the owner of V because his information does not appear in the Challenger's database. According to TCG, to avoid the attacked capture and reuse encryption key, the encryption key created by the TPM can only be decrypted by the same TPM. In our proposed work, we assume that App has a key pair (SK AIK , P K AIK ) which is generated and protected by the TPM. TTP, M and V have the genuine proof of each other (e.g. evidence of Cert(AIK)) through the remote attestation.

To conclude, the proposed work can avoid the threat of regular MIM as the attacker uses FRAMEWORK the victim's certificate or his own certificate to communicate with other parities. Moreover, assume that when M wants to send messages like in flow 1 and 5, an attacker R intercepts the message on the network channel and tries to build the same message and send it to V. In this case, the information M ID , nonce, etc. will be generated by the attacker. When V receives this request, it sends the information to the trust entity TTP.

In this case, we can have two situations:

-M ID is not known because it is forged by the attacker; hence the attacker request will be rejected.

-M ID is a valid ID, the interaction is pursued between TTP/R and V/R. According to the security level of M ID of R and the properties Pi of R's app, the data access rights are different with those of the legitimate M.

In case the attacker R wants to decrypt the message m to modify m's data, it cannot because since the whole message is encrypted with a public key, only the receiver (V in flow 1 or TTP in flow 5 ) of the message can decrypt the message and has access to its content.

1. Message (intended to V from M in Flow 1 ) ((Hash(M ID , N M , T M ))S KAIK , M ID , N M , T M )P KV (8.8) At this stage, public key of M is only available to TTP. V and others do not know P KAIK . Attacker R present in between M and V intercepts the message to make V think that R is the actual sender of the message and to make M think that R is the actual V. So, R now has the message:

((Hash(M ID , N M , T M ))S KAIK , M ID , N M , T M )P KV .
R knows the public key of V but does not know the secret key S KV of V. From proof 1, we know that a message encrypted by the public key of the receiver can only be decrypted by the actual receiver using appropriate secret key. Thus, R cannot decrypt the message and therefore it has no access to the contents of the message. Now, R tries to build the same message as received and generates M ′ ID and N ′ M and T ′ M . Also, R does not know the secret key S KAIK of M. So, R generates a public key FRAMEWORK and private key pair as (P ′ KAIK , S ′ KAIK ). Now, it tries the build the same message. Hence, the message is now:

((Hash(M ′ ID , N ′ M , T ′ M ))S ′ KAIK , M ′ ID , N ′ M , T ′ M )P KV . R sends this message to V.
2. V has no information to check whether it has come from M or not, because V does not know M ID , N M , T M . As, V has not CERT AIK , V cannot decrypt the hash value.

So, V cannot check the identity of R or M. V:

[((Hash(M ′ ID , N ′ M , T ′ M ))S ′ KAIK , M ′ ID , N ′ M , T ′ M )P KV ]S KV = ((Hash(M ′ ID , N ′ M , T ′ M ))S ′ KAIK , M ′ ID , N ′ M , T ′ M ) (8.9) So, V knows M ′ ID , N ′ M , T ′ M . Now, V generates N V 1 .
3. To know the identity of the sender, V requests certificate CERT AIK to TTP, by sending the message from V to TTP:

((Hash(M ′ ID , N V 1 ))S KV , M ′ ID , N V 1 )P KT T P .
4. TTP:

[((Hash(M ′ ID , N V 1 ))S KV , M ′ ID , N V 1 )P KT T P ]S KT T P = ((Hash(M ′ ID , N V 1 ))S KV , M ′ ID , N V 1 ) (8.10) So, TTP has now M ′ ID , N V 1 .
TTP also checks the integrity of (M ′ ID , N V 1 ). To adapt to two aboved situations we have:

Case 1: M ′
ID is not known to TTP. TTP: CERT AIK of M ′ ID is not found. So, TTP rejects the request of V. So, in this case1, Man in the Middle attack cannot occur.

Case 2: M ′

ID is a valid ID and known to TTP.

TTP : CERT AIK [M ′ ID ] found. So, the public key against M ′ ID which is P ′ KAIK is obtained. TTP to V: ((Hash(P ′ KAIK , N V 1 * N T T P 1 ))S KT T P , P ′ KAIK , N T T P 1 )P KV 5. V: [((Hash(P ′ KAIK , N V 1 * N T T P 1 ))S KT T P , P ′ KAIK , N T T P 1 )P KV ]S KV = ((Hash(P ′ KAIK , N V 1 * N T T P 1 ))S KT T P , P ′ KAIK , N T T P 1 ) (8.11) So, now V has M ′ ID , N ′ M , T ′ M , N V 1 , P ′ KAIK , N T T P 1 . FRAMEWORK with M ′ ID is Pi1 ] TTP:
Hash(P CR1, P i1) = x2 ̸ = x1. (8.17)
Therefore, TTP is sure that the sender of the message is not the intended and original sender, thereby discarding the token request of R. As a result, message in flow 5 is not vulnerable to Man-in-the-Middle attack.

Proof 3: replay attacks. Timestamps T X in flow messages are used to avoid replay attacks. Consider, for example, flow 1. An attacker that intercepts this message m can try to send it again after m is received by V. In this case, V notices that the time has passed and that m has been already initiated at time T M . Hence, using timestamps avoid replaying the same messages.

1. At time T M , M generates a message and sends it to V: ((Hash(M ID , N M , T M ))S KAIK , M ID , N M , T M )P KV . Now, an attacker R gets this message.However, R does not have secret key S KV of V, so it cannot decrypt the message.

2. Suppose, V receives the message from M at time T M 1 due to permissible delay in network. V now decrypts the message.

V:

[((Hash(M ID , N M , T M ))S KAIK , M ID , N M , T M )P KV ]S KV = ((Hash(M ID , N M , T M ))S KAIK , M ID , N M , T M ) (8.18) So, V now knows N M , T M .
3. Now at a different time T N , R sends the same message to V. That is, at time

T N , R to V : ((Hash(M ID , N M , T M ))S KAIK , M ID , N M , T M )P KV 4.
At time T N +1 , V receives the message and then it decrypts the message.

CHAPTER 8. PROPERTY BASED TOKEN ATTESTATION : A NOVEL FRAMEWORK

V: [((Hash(M ID , N M , T M ))S KAIK , M ID , N M , T M )P KV ]S KV = ((Hash(M ID , N M , T M ))S KAIK , M I D, N M , T M ) (8.19)
At this time also, V gets the duplicate message with N M , T M . V checks that

T M ̸ = T N +1-δ
, where δ is a permissible delay in network for propagation of a message from sender to receiver. Also, the nonce N M is also same in both the messages, which is not possible because nonce is a randomly generated number and two nonces cannot be the same at two different time instants.

Then, V discards this message. So, Replay Attack is not possible in this protocol. -The compromised App ′ is on the legitimate M. By checking Pi ′ against PL (Property List), TTP terminates a token request due to the invalid quantity or quality (matched properties) of compromised Pi ′ . This is used to prevent a bad user who does not have a right to access a higher level of data.

Let us assume that a compromised application App ′ has false set of properties Pi ′ .

Case 1: App

′ is on compromised M ′ . So, M ′ has M ′
ID (which may or may not be a valid ID). M ′ may know V ID (as shown previously in Proof 2). M ′ has its own secret key S ′ KAIK and may know the value of (Hash

(M ′ ID , V ID , N V * N ′ M , T V ))S KV [from Proof 2 ]. R: ((P CR ′ , P i ′ )S ′ KAIK , P i ′ , M L ′ , (Hash(M ′ ID , V ID , N V * N ′ M , T V ))S KV , M ′ ID , V ID , N V * N ′
M , T V )P KT T P . Then, R sends this message to TTP. Now, it returns to proof 2 (for flow 5 ). TTP discards the token request. So, in this case a bad user cannot get access to higher level of data.

App ′ is on legitimate M. FRAMEWORK So, the property Pi ′ of App ′ is only the invalid entity here in the message sent from M to TTP.

That is, M to TTP:

(P CR, P i ′ )S KAIK , P i ′ , M L, (Hash(M ID , V ID , N V * N M , T V ))S KV , M ID , V ID , N V * N M , T V )P KT T P TTP: [(P CR, P i ′ )S KAIK , P i ′ , M L, (Hash(M ID , V ID , N V * N M , T V ))S KV , M ID , V ID , N V * N M , T V )P KT T P ]S KT T P = ((P CR, P i ′ )S KAIK , P i ′ , M L, (Hash(M ID , V ID , N V * N M , T V ))S KV , M ID , V ID , N V * N M , T V ) (8.20) TTP now has P i ′ , M L, M ID , V ID , N V * N M , T V .
TTP: by using Hash extend operation and CERT AIK tells that M has public key P KAIK and secret key S KAIK [(P CR, P i ′ )S KAIK ]P KAIK = Hash(P CR, P i ′ ) = y1 (8.21) TPM has safely stored ML corresponding to M and the property Pi corresponding to valid app in M is also stored in TTP. TTP:

Hash(P CR, P i) = y2 ̸ = y1 (8.22)
because though the PCR value was the same, P i ̸ = P i ′ . Therefore, TTP discards the token request of M.

Proof 5: related to the duration of the token. To explain the validity duration of the token, assuming that the mobile device M obtains the token from TTP and M has no battery; if the token is stored in the TPM RAM, then after the mobile battery is fully charged up, the mobile device needs to launch the protocol again to get a new token. In case the token is stored in the TPM EEPROM, we check the validity duration to see if it's not expired. If not, the token is used otherwise the protocol is launched to get a new token. FRAMEWORK 1. After flow 6, at time T T T P , TTP sends the token to M: ((Hash(P i, M ID , V ID , N T T P * N V * N M , T T T P ))S KT T P , N T T P , T T T P )P KAIK .

TTP stores the token (Hash(P i, M ID , V ID , N T T P * N V * N M , T T T P ))S KT T P in its TPM EEPROM along with the timestamp T T T P . We assume that the validity of the token is σ1.

M:

[((Hash(P i, M ID , V ID , N T T P * N V * N M , T T T P ))S KT T P , N T T P , T T T P )P KAIK ]S KAIK = ((Hash(P i, M ID , V ID , N T T P * N V * N M, T T T P ))S KT T P , N T T P , T T T P ) (8.23) The token that M receives is (Hash(P i, M ID , V ID, N T T P * N V * N M , T T T P ))S KT T P . This is stored in M's RAM. Now, M has no battery.

3. When M is fully charged, it cannot restore the token because RAM is volatile. At time T X , M launches the protocol again to get a new token from TTP. Launching the protocol means repeating the steps from flow 1 to flow 5 with different time stamps and different nonce. Now, the public key, private key pair of M has changed to (P KAIK1 , S KAIK1 ) and this pair is stored in TPM EEPROM. [START_REF] Sauveron | Multiapplication smart card: Towards an open smart card?[END_REF]. We assume that, at time T Y , TTP received the token request message from M:

[(P CR, P i)S KAIK1 , P i, M L, (Hash(M ID , V ID , N V 2 * N M 2 , T V 2 ))S KV , M ID , V ID , N V 2 * N M 2 , T V 2 )P KT T P ]S KT T P = ((P CR, P i)S KAIK1 , P i, M L, (Hash(M ID , V ID , N V 2 * N M 2 , T V 2 ))S KV , M ID , V ID , N V 2 * N M 2 , T V 2 ) (8.24)
Where N V 2 , N M 2 are different Nonce and T V 2 is one timestamp different from the previous session. TTP now has M ID which is the same as the M ID in the previous session. [The assumption here is that though N V , N M are nonces from previous session and T T T P is previous time stamp, there is no possibility of replay attack, because

TTP is a trusted environment.] (b) If (T T P : T Y -T T T P > σ1) , then [TTP to M]: ((Hash(P i, M ID , V ID , N T T P 2 * N V 2 * N M 2 , T T T P 2 ))S KT T P , N T T P 2 , T T T P 2 )P KAIK1 . M: [((Hash(P i, M ID , V ID , N T T P 2 * N V 2 * N M 2 , T T T P 2 ))S KT T P , N T T P 2 , T T T P 2 ) P KAIK1 ]SK AIK1 = (Hash(P i, M ID , V ID , N T T P 2 * N V 2 * N M 2 , T T T P 2 ))S KT T P , N T T P 2 , T T T P 2 ) (8.28)
The token that M gets is Hash(P i, M ID , V ID , N T T P 2 * N V 2 * N M 2 , T T T P 2 ))S KT T P , which is different from the previous one. FRAMEWORK attestation mechanism makes a specific application and platform bind a token together to prevent another malicious application with valid token to gain secure data (Threat 2 ). 4. Scyther. Scyther has been developed by CAS Cremer [START_REF] Cremers | Operational Semantics and Verification of Security Protocols. Information Security and Cryptography[END_REF]. It is a tool for the formal analysis of security protocols under the perfect cryptography assumption. Scyther uses the Dolev-Yao adversarial model [START_REF] Dolev | On the Security of Public Key Protocols[END_REF]. In order to establish the security analysis with Scyther, protocols must be specified in its input language, namely Security Protocol Description Language (SDPL). It is easy for a fresh user to get used to working on Scyther due to the syntax of SDPL being familiar with the existing object oriented languages such as C++/Java. To prevent the attacker to control the network and all the communication, it is assumed that all cryptographic functions are perfect: the attacker learns nothing from an encrypted message unless he knows the decryption key. The tool can be not only used to find problems that arise from the way the protocol is [START_REF] Cas | The Scyther Tool: Verification, falsification, and analysis of security protocols[END_REF] but also automatically find attacks on cryptographic protocols. Once verification is completed, the verification results are represented in OK or Fail status which demonstrates the protocol whether it is correct or false. In our experimental test, the output of the verification is OK. On behalf of the involved parties three roles M, V and TTP were defined within a scope of P{M, V, TTP} .

We could split the whole protocol into three sub-protocols: P1{M, V}, P2{V, TTP} and P3{M, TTP} to simplify the codes and take less verification time. However, to prove a robust protocol, we decide to verify our work in one protocol, though the verification time is quite long.

5.

Repudiation. Firstly, in our protocol, we have used an asymmetric key used as signing key offers non-repudiation. For example: in flow 4, ((

Hash(M ID , V ID , N V * N M , T V ))S KV , V ID , N V , T V )P K AIK .
It is used to create an asymmetric-key digital signature, the sender (V) applies its private key (SK V ) to a message (M ID , V ID , N V * N M , T V ). Then, the receiver applies the public key to the signature to recover and to verify the message. The detailed discussion is presented in part 8.3.5. Secondly, how do we trust the public key which is used to sign the message? This is due to the functionality of TPM. In order to prove it is an authentic TPM and platform, CHAPTER 8. PROPERTY BASED TOKEN ATTESTATION : A NOVEL FRAMEWORK each TPM has its own certificates which are signed by the certificate authority, such as TPM vendor and platform manufacturer. Once again, though remote attestation process, each involved party, which is equipped with TPM, has knowledge of others' TPM evidences. In addition to, the TPM 2.0 specification provides commands to create certificates [START_REF] Arthur | A Practical Guide to TPM 2.0: Using the Trusted Platform Module in the New Age of Security[END_REF]. In our work, we assume that the TPM is equipped to both client side and remote side in chapter 8.3.3. We also assume that each TPM has its own Certificate of Attestation Identity Key (AIK) to show its identity and to provide its valid evidences with other parties. Thus, we believe that our solution would avoid the repudiation.

6. Careless using. The term Careless refers to the context of human activity. The employees compromise their devices for the purpose. For example, they want to download pirated software or access illegally to the prohibited information. Due to the security concern, rootkits/bootkits are completely unsuitable in BOYD context.

To overcome this situation, TPM has provided Measured Boot feature, which runs independently with Secure Boot, to record a series of measurements for critical startup related components, including firmware, OS boot component and drivers [121]. The measurement is stored by extending (hash operation) to a particular PCR and the measured value is stored in a Stored Measurement Log (SML). The PCR values and SML are used for later attestation. If either device or TPM has been compromised, the Trusted Third Party/Verifier can detect this device being compromised or not genuine TPM by verifying the PCR value and SML. Similarly, if a careless employee wants to obtain illegally secret information with his compromised application, TTP also can detect this violation by checking integrity of application property under Property based attestation process.

Conclusion

By introducing the token consisting of random property in this chapter, the proposed security model not only lessens the remaining demerit of remote attestation mechanisms but also adapts to the context-aware. Depending on the context, attestation mechanism has FRAMEWORK its own advantages and disadvantages. The proposed model describes the novel attestation schema based on the existing attestation mechanisms. In order to prove the correctness, we have verified the proposed protocol under Scyther and analyzed it with the security proofs.

Moreover, the present protocol enables the involved parties, i.e. the enterprise and the trusted third party, to transparently deploy and manage digital tokens for mobile devices not only to accomplish authentication but also grant secure access to enterprise networks.

However, this contribution is considered as the traditional mechanisms that rely on either authenticated identities or clients getting credentials authorized to make certain actions. Most of approaches mainly rely on the cryptography mechanisms [START_REF] Sujithra | Mobile Device Data Security: A Cryptographic Approach by Outsourcing Mobile Data to Cloud[END_REF], [START_REF] Kari Kostiainen | Practical Property-Based Attestation on Mobile Devices[END_REF], [START_REF] Borhan | Platform Property Certificate for Propertybased Attestation Model[END_REF], [START_REF] Othman | A conceptual framework providing Direct Anonymous Attestation (DAA) protocol in trusted location-based services (LBS)[END_REF], such as Public Key Infrastructure. Indeed, the nature of mobile cloud computing cannot be based on static infrastructures, so these traditional mechanisms are insufficient in MCC context. Moreover, the traditional security mechanisms are used to resist to external attacks, however it is not that smart to prevent malicious or compromised entities from doing misbehavior. Thus, trust and reputation management need to be reckoned carefully to deal with the mentioned concerns in order to enrich the security and robustness of MCC.

The next chapter will deal with trust and reputation management in MCC environment.

Chapter 9

Trust and Reputation for Mobile Cloud Computing: A Road Map

Introduction

As discussed in Chapter 3, the cloudlet is considered as a specific example of MCC model.

The cloudlet is three-tiered (Mobile-Cloudlet-Cloud) architecture which is placed to serve the proximate users and operates in the same way as a cloud. However, their performance is better [START_REF] Simanta | A reference architecture for mobile code offload in hostile environments[END_REF], [START_REF] Lo | Trust delegation-based secure mobile cloud computing framework[END_REF]. One of the problems that may occur is the management of encryption key management in cloud environment. Several cloud customers may have their own encryption method and managing these keys is another issue to address in the context of encrypted data [START_REF] Sabahi | Cloud Computing Reliability, Availability and Serviceability (RAS): Issues and Challenges[END_REF]. By supporting protection of cryptographic keys, random number generation, cryptographically binding data can accomplish certain system configuration, sealing data in the configuration of the application and authentication, through the trusted platform module (TPM) 1 . However, the trusted platform, does not indicate a satisfactory reliable cloudlet because cloudlet security is not only limited to the existence of TPM, the cloudlet can be malicious. In addition, good access to the cloudlet must avoid the uncertainty of network, which persists in the form of network bandwidth, latency and expectation time. Hence, more smart, intelligent and adaptive devices [START_REF] Vinh | Convergence in trusted computing and virtualized systems: A new dimension towards trusted intelligent system[END_REF] and platforms need to be explored. The evaluation of the degree of trust is significant and it is substantially indicated towards human decisions and perspectives. We argue and introduce possible scope of fuzzy computation for measuring such human linguistics driven contexts of multiple cloudlets. In CHAPTER 9. TRUST AND REPUTATION FOR MOBILE CLOUD COMPUTING: A ROAD MAP addition to evaluate trusted platforms for cloudlets, it also becomes necessary to emphasize the trusted platforms' services. This is because many application domains with high social and business impact such as personal healthcare, home automation, mobile payment may use mobile devices which rely solely on trust environment. In a dynamic environment, trust has become the major concern of the service providers and the customers. Trust is also an important facilitator for successful business relationships and an important technology adoption determinant [START_REF] Lansing | Trust in Cloud Computing: Conceptual Typology and Trust-Building Antecedents[END_REF]. Trust can be supported by hardware, software or even as a service. For example, Trust as a Service (TaaS) should provide a single point for configuring and managing the security of cloud services from multiple providers [START_REF] Huang | Trust mechanisms for cloud computing[END_REF]. The concept of trust can be used to measure an expectation or uncertainty that the entity in the network has other's future actions [START_REF] Sherchan | A survey of trust in social networks[END_REF]. As trust is a critical factor, trust evaluation in service also plays an important role in the cloud computing.

Scenario and Proposed model

In cloud ecosystem, service providers publish and advertise their services as a quality of service (QoS) information, which may not be always true and credible. In fact, these services would provide similar functionalities to the customers, who may select abnormal service with poor quality, less security, or even damaging one. A customer deserves to know what a good service can serve and how to select a good service [START_REF] Wang | A Review on Trust and Reputation for Web Service Selection[END_REF]. Therefore, the challenge still remains and needs to be addressed to help customers to distinguish good services from bad ones. Furthermore, the cloud providers are also responsible for supporting security as important features. This becomes important as the reliability and availability of cloud should be the prime objective. In terms of security and performance, the varieties of users' requirements lead the service provider to optimally balance them. For example, the security and privacy are important factors in enterprise context due to the stored sensitive data; while academic users may require good performance for processing voluminous data [START_REF] Sabahi | Cloud Computing Reliability, Availability and Serviceability (RAS): Issues and Challenges[END_REF]. In order to enable customers to select their suitable services, the trust value should be estimated to identify reliable services. Reputation is a subjective assessment of a cloud service to represent public consensus towards a subject's expertise, attitude or reliability in a certain context [START_REF] Zuo | Reputation-based service migration for moving target defense[END_REF]. Thus, trust based reputation is a mechanism to evaluate an CHAPTER 9. TRUST AND REPUTATION FOR MOBILE CLOUD COMPUTING: A ROAD MAP entity's trustworthiness in the cloud environment.

Scenario

As the interesting motivation of cloudlet presented in Chapter 3, considering the scenario in which a mobile user wants to use the cloudlet's services for data processing/downloading externally. His device discovers many available cloudlets nearby. However, these available cloudlets are suitable for his purposes or not; this is the concern of the mobile user in this situation. Thus, the objective of this contribution here is how the mobile user can choose the trusted cloudlet, which is assessed by performance and security parameters, among the cloud mesh to meet his specific requirements.

Proposed model: Trusted based Reputation

In this contribution, we consider a cloudlet mesh that includes cloudlet master to manage its cloudlet slaves as shown in figure 9.1a. The master is responsible for collecting/tracking the related data (e.g. rated score/user's feedback, security and services information) of its slaves to calculate the trust value based reputation. To be specific, this special cloudlet receives the reputation based feedback and also verifies the quality of service information of its cloudlet slaves. In this architecture, for desired agenda the cloudlet processes data, the mobile user must find the reliable cloudlet in the cloudlet mesh. Another key point is that this master cloudlet can be considered as the Trusted Third Party (TTP) in the public cloud environment where the trusted Cloudlet does not exist. As such, we can rely on the TTP to replace a role of a master cloudlet. For example (refer figure 9.1b), the employee wants to use a specific cloudlet for processing/downloading his data which can be obtained from the enterprise cloud (EC). In this case, the EC, worked as the master cloudlet, enables the trusted cloudlet access to the EC on behalf of the user by performing the same process as the master cloudlet does. Hence, the EC, which is considered as a trusted cloud, has to verify the trust value of corresponding cloudlets before granting the access right. In general, the proposed concept will be suitable for Mobile-Cloudlet model as well as for Mobile-Cloudlet-Cloud model. To mitigate the complexity, we have used Mobile-Cloudlet architecture to demonstrate for the proposed model. We also assume that ROAD MAP However, the reputation based-feedback is vulnerable to whitewashing, incorrect reported feedback and collusion attacks [START_REF] Talal | Reputation Attacks Detection for Effective Trust Assessment among Cloud Services[END_REF]. In order to gain more accessing or advertisement tariffs, the service providers may exaggerate their QoS information or pay consumers to give them high scores for their services or to leave low scores to their competitors [START_REF] Wu | Reputation Revision Method for Selecting Cloud Services Based on Prior Knowledge and a Market Mechanism[END_REF]. As a result, the customer cannot distinguish good from poor or worst service providers. The detail of this proposed model is explained in the next section.

Trust based Reputation model

By assuming the context when no prior knowledge about a specific cloudlet is available to make a decision, we propose a model to estimate the trust value of multi-cloudlet by combining the reputation based-feedback, the reputation based-quality and the uncertainty.

CHAPTER 9. TRUST AND REPUTATION FOR MOBILE CLOUD COMPUTING: A ROAD MAP

This is expressed as in equation 9.1, by using fuzzy inference system. The proposed model is enforced in the master to filter the false reputation of cloudlet slaves. Thus, whatever the cloudlet providers advertise, the master verifies them by following the role: "a system with a high reputation not for sure to support good service and security. But for providing good service and security, the system must be in high reputation". Algorithm I describes the process of trust evaluation model.

T rust V alue = Reputation F eedback + Reputation Quality of Service +U ncertainty V alue (9.1) The QoS varies according to the application type [START_REF] Lo | Trust delegation-based secure mobile cloud computing framework[END_REF]. In the cloudlet context, we consider two important factors of QoS at runtime, namely, availability and performance.

For the security, three prime pillars of security are considered such as confidentiality, integrity and authentication. We also take advantage of TPM functionality such as machine authentication, data protection and remote attestation. Thus, in our solution, we assume that the appearance of TPM is one of the important parameters to calculate the reputation based quality. In the cloudlet mesh, we use n cloudlets, whose set is denoted by S = {1..., S i , ...S n } and R S refers to the reputation based-feedback of S in a given time t denoted by R S1 , . . . , R SS , where R Si is composed by the correct feedback (cf) and the incorrect feedback (icf) as presented in 9.2

R Si = δ × (cf ) + (1 -δ) × (icf ) (9.2)
Where δ is a reputation weight factor and 0 ≤ δ ≤ 1. In table 9.1, we present a possible degree structure of all involved elements in the process. On the other hand, we use Finally, the trust value (T rust V alue ) of a particular cloudlet slave (S i ) at a given time t is calculated by R Si and R QoS in 9.2 and 9.3 respectively combined with the uncertainty R U .

R
Where α, β and γ are the weight factors and α + β + γ = 1 as presented in equation 9.4

T rust V alue = α × (R QoS ) + β × (R S ) + γ × (R U ) (9.4)
The result of the trust value is updated to the historical record and the cloudlet with the highest value is recommended to the customer. The fuzzy inference applies to the rule-base. This is essentially the control strategy of the system and presented as a set of IF-THEN rules, to generate the fuzzy values.

Level

Fuzzification

The fuzzfier converts the crisp input data including Av, Per, R Si and SP into fuzzy sets which contain the membership functions (equation 9.5) and linguistic variables (Vp, Pr, Ac, Sa and Hs) as presented in table 9.1 and figure 9.3. We have,

µ(x) = ⎧ ⎪ ⎪ ⎪ ⎪ ⎪ ⎨ ⎪ ⎪ ⎪ ⎪ ⎪ ⎩ 1 -x-c r-c (c < x < r) 1 (c=x) 1 -c-x c-l (l < x < c) 0 otherwise (9.
µ(x) = µ X∩Y (x) µ(x) = min(µ X (x), µ Y (x)) (9.9)
For relevant dataset, the reference and details are given in appendix A.

Insight to the Fuzzy Rule Configuration

In fuzzy logic, low and high is explicit if their upper value is 1 and lower is 0 and if only if the membership function stands with 0,1. However, it is not necessary that values will lie only in the range of 0 and 1. It can be with any ranges ( minimum and maximum, Low and High, Small and Large). Therefore, these are straight linguistics not fuzzy linguistics like extreme, very, moderate etc. In table 9.2, x d represents part of the whole membership values according to the membership value (refer figure 9.4) while a, middle and b are the initial, middle and terminal final value of triangular membership functions of the linguistic value.

In addition, fuzzy models are used to extract interesting rules from quantitative or linguistic values in relational and transactional databases [START_REF] Khan | An effective fuzzy healthy association rule mining algorithm (FHARM)[END_REF]. The user can subjectively increase the number of rules depending on his experiments. As a result, many uninteresting rules might be generated that leads to the increasing of computation cost, for example, the application needs more time for processing the algorithm due to the complexity and quantity of rules. In fuzzy logic, the aim of the association rule mining is to find all the rules that have the degree of support and confidence greater than the degree of support (min_sup) and confidence (min_conf ) determined by the user (i.e. administrator or superuser of cloud/cloudlet). While the form of the association rule is presented as ROAD MAP each fuzzy membership for each attribute, can be evaluated as the following equation:

ω[i] = [W eight] i = [

Discussion

In fact, the proposed fuzzy logic has obtained a noticeable number of achievements in both theory and application to deal with vagueness and uncertainty [START_REF] Liu | A Cloud Theory-Based Trust Computing Model in Social Networks[END_REF], fuzzy set theory has still remained several drawbacks as listed in [135; 136; 137; 138]. In general, it is tedious to develop the fuzzy rules, which are known as the min-max rule for conjunctive (AND) and disjunctive (OR) reasoning. These rules are arbitrary, and it is difficult to figure out how many rules are adequate to address fully, a specific problem and to make the related robust membership functions. In addition, the fuzzy logic requires a considerable amount of data to formulate fuzzy membership functions. The decisions can also be interpreted in a number of different possibilities [START_REF] Sasikala | Generalised fuzzy aggregation in estimating the risk of desertification of a burned forest[END_REF], [START_REF] Shamim | Fuzzy logic: A "simple" solution for complexities in neurosciences[END_REF]. This leads to a trade-off between performance & robustness. With the same problem and content, for instance, all membership functions take the values between 0 and 1. Depending on the personal experience, one can consider dividing the context into 5 partitions, whereas for another expert it might be about 10 or 15 partitions. However, the more partitions are divided the less performance they exhibit. Due to the fact that the rules and ranges of value cannot be defined automatically, the fuzzy logic is also considered as a static method. Here, to be more dynamic and adaptive, this research solicits another computationally intelligent approach (e.g. ant colony optimization (ACO)) to consolidate the measure of trust [START_REF] Sanadhya | Trust Calculation with Ant Colony Optimization in Online Social Networks[END_REF], [START_REF] Tengkiattrakul | Applying ant-colony concepts to trust-based recommender systems[END_REF].Hence, we believe that this contribution evaluates the trust level as well as reputation

Background of the proposed computational intelligent agent based system

While considering the term and unit of trust is abstract, this part of the thesis is to concentrate on the measurement of trust or belief about cloudlets. Before measuring specific trust value, the following assumptions are considered:

• Trust is a relative measure and it also follows a time scale, where either time units to be enhanced or to be diminished. ROAD MAP • Practically, the cloudmesh is expressed as interconnected graph of different cloudelts.

For example, when cloudlet M agrees to communicate with cloudlet N in specific cloudmesh (M and N can be resided in the same or different cloudlet meshes), M will first fetch the trust of the reputation of N and the cloudlet mesh master proceed this value for further interaction. The degree of trust is measured as:

T M N = ω i × aReput M N + ω j × tReput M N (9.13)
Where, ω i and ω j represents associated weight of importance of reputation, aReput M N is the anticipated reputation value from cloudlet M to N and tReput M N is the complete value of trust in actual from cloudlet M to N.

Mathematical basis of trust/reputation measures

Regarding the trust or reputation as the relative index of the entropy, the entropy is investigated with different time interval scales different than γ, which can be ψ, that CHAPTER 9. TRUST AND REPUTATION FOR MOBILE CLOUD COMPUTING: A ROAD MAP means both are changing dynamically. This is because the interval scale differs from context and location as well as on the variable of time elapse. Conventional standard deviation is applied, and as the composite structure of reputation or trust persists. Hence the reputation is always anticipated and predictable value. The level is defined within the maximum and minimum level of reputation. Finally, the relationship is expressed on the basis of standard deviation. For example: if the time interval for trust is measured from parameter ψ or γ then the multiplication of measured scale and dynamic importance of trust (related to linguistic value) ω yields the expected reputation (close to anticipated reputation):

R = 1 n n ∑ i=1 (ψ i ω i ) (9.14)
where, n is the total number instances of trust to be measured at time t, i is the initial counter from which the value will navigate. However, anticipated reputation cannot be For the analytical experiments in the thesis, each artificial ant selects cloudlets of one cloudlet mesh (base cloudlet mesh) successively and pseudo-randomly according to the transition probability to form a complete path (this could be trusted solution path). The transition probability is determined by the pheromone on all cloudlets and the heuristic information. Commonly, the more pheromone deposited on a cloudlet, the higher the probability that the cloudlet is selected by an ant and hence it is more trusted for that specific time instance. However, ACO is a type of random algorithm, which means that it does not necessarily find the best solution; it can only provide a set of optimal solutions for the measurement of trust.

CHAPTER 9. TRUST AND REPUTATION FOR MOBILE CLOUD COMPUTING: A ROAD MAP

Following the mentioned entropy to represent the embedded uncertainty on the trust value, it is important to evaluate the value of entropy and meta-entropy accordingly and thus standard variance formula modified with the subtraction from anticipated or expected reputation is given, this also will eliminate the noises of data value from multiple sources:

E n =    √ 1 n n ∑ i=1 (ψ i ω i -R) 2 (9.15) M E =    √ 1 n n ∑ i=1 (ψ i ω i -R) 2 -E 2 n (9.16)
Thus, the values shown in table 9.3 as per the time scale can be varied with any value from near Confidence to Peak Trust accordingly. Hence numerically, value of E and ME is evaluated with random number generation from base cloudlet/mesh to successive cloudlet/mesh connection. Thus, when the reputation evaluation method should be referred, it could be the combination of anticipated trust, entropy, and meta-entropy (R, E and ME) with logical induction.

Analogy with ant colony

The proposed method is analytical and there is a possibility of loss function in trust or

∆ j = 1 n n ∑ i=1 Ω i (9.17)
The loss function can also be expressed as exponential and proportional loss function, which will be a type of convex function and obviously it will be non-decreasing power function of time.

Type of loss function. Considering an entropy structure (for uncertainty) in trust, the basic idea is to visualize a loss function, which can finally be measured with respect to elapsed time. Inspiring the equation from the seminal work [START_REF] Lin | Covariance structure regularization via entropy loss function[END_REF]

L(A, B) = tr(A -1 B) -log(det(A -1 B)) -m (9.18)
where A and B are m × m matrices, tr(A -1 B), det(A -1 B) is a trace and a determinant of (A -1 B) respectively and, to ensure that L(A,B) is non-negative, we assume that A and B are symmetric positive definite. Therefore, statistically:

• Given a covariance matrix and • a class of possible candidate covariance structures, to find for each structure a covariance matrix that minimizes the entropy loss function.

However, this loss function improves the present work to establish the correlational measures with pheromone evaporation and deposition (i.e. pheromone update) of ant colony.

To sum up, from the equation 9.17, it is observed that reputation and trust require more adaptive and dynamic model. Thus, in reputation of loss function and reputation itself, may contain uncertain values. This phenomenon motivates another suitable intelligent method though ant colony optimization approach.

Modeling trust with ant colony system: mathematical perspectives

Categorically, ant colony system is modeled to distribute the load of cloudlets according to the reputation. It also expresses a reverse way to identify the most trusted cloudlet that ROAD MAP will have multiple numbers of service request with initial and final time interval. Definitely, the loss function of trust is minimum in that case.

In this thesis, ant colony optimization is used as a trust or reputation search strategy (not as an alert algorithm directly) while distributing the service load. Here also, to incorporate ant colony as an effective trust or reputation search, certain prior initialization of model and parameter setting is required.

The following node scenario is represented an undirected graph G(V, E), in which V is the set of all slave cloudlets in the specific cloudlet mesh of interest among many (whose reputation has to be measured), E is the network set which connects to each slave cloudlet. After dividing the cloudlet meshes with effective groups, and then ants can be assigned to each group randomly. Then each ant will search for trusted entropy from random assignments. There might be several exploration of the trusted path in the form of different search algorithms.

The following parameters should be considered in the metric:

-Expected execution time, -E T (f ) refers to the path of f at the end of the computing resources to cope with this job takes time T, which is the time to execute the search to find the optimal trust.

-Network latency: N D (f ) refers to the maximum network delay D generated by path f, for the base cloudlet/mesh -Network bandwidth: B W (f ) refers to the maximum bandwidth provided by the path f, with respect to concurrent cloudlet/mesh.

To investigate a trusted and optimal search path, it becomes mandatory to adjust the pheromone matrix with respect to loss function (evaporation mechanism). In this context, from the ant colony perspectives, group of different colonies can be used for different cloudlet in the same location. The behavior of ants in one colony will be influenced by the solution information received from other colonies, where pheromone is added to the colony ROAD MAP edges that belong to the best solutions of the group of colonies. The pheromone trails on the edges of the best solutions are updated adaptively in response to determined weights, and an extra amount of pheromone has been deposited on the edges of these solutions accordingly. Here, solution denotes the trusted optimal path.

Rt avg = 1 |S| ∑ h∈S Rt h opt (9.19)
While accomplishing the final road-map of the proposed steps, the model assumes recursive solutions:

• Overall average reputation and trust Rt avg ,

• h ∈ S, where S is the optimal search solution and h is the dynamic edge value of trust or reputation for each edge of cloudlet connection.

• Rt h opt is the value of optimal trust with the dynamic edge value h.

• τ 0 , the initial amount of pheromone.

• The evaporation rate, ρ, is a parameter in the range [0, 1] that regulates the reduction of pheromone on the edges.

• Pheromone trail s ij (ij), where the 1st part is the suffix of s and other ij is the factor of s it means pheromone trail s from node i to j for suffix and next ij is the factor that is the actual numerical value of pheromone which is approximated deported or evaporated ; for factor ij part the edge will be visible if it is high, that means other ants will follow it, if not then value is less no one will follow it.

The composite mathematical expression is given in equations 9.20 and 9.21. In equation 9.21, τ 0 is finally replaced by the optimum trust, this is in denominator to ensure that optimal value is always a reduced value with power of time.

τ ij (t + 1) = (1 -ρ)τ ij (t) + ρτ 0 (9.20) τ ij (t + 1) = (1 -ρ)τ ij (t) + ρ( 1 Rt opt ) (9.21) ROAD MAP
where, τ ij is the edge value of pheromone for graph from cloudlet/mesh i to cloudlet/mesh j and Rt opt is the value of optimal trust. This expression has the influence of increasing the quantity of pheromone(represents reputation and trust) on edges associated with solutions according to the quality of trust and reputation and the current convergence state of the cloudlet information exchange.

Finally, the value of affinity (refer equation 9.22) of trust for M number of ant colonies and N numbers of cloudlets of specific cloudlet mesh can be calculated:

af f inity(M, N ) = 1 - √ ∑ x∈P (M,N ) ∑ P (x,M ) i=1 s(x,i) P (x,N ) |P I(M, N )| (9.22)
Where, the complete participation for all cloudlets in different cloudlet meshes can indicate PI(M,N), P(x, M) can indicate individual information exchange towards trust gain. P(M, N) is the total information exchange for M number of ant colonies and N numbers of cloudlets; s(x,i) is the optimal search function from the initial position of dynamic edge h and x is the part of edge which will be searched through search function .

This affinity is a probabilistic numerical value, which indicates trust gain from a base cloudlet/mesh to a destination token. The choice of affinity value is an inductive approach to demonstrate the gain of trust value for a specific location based cloudlet. If more locations and cloudlets are connected, the affinity value also becomes recursive.

Analytical Implementation Following the proposed high-level description of ant colony system and data acquisition model for cloudlet, the analytical simulations are performed.

High level description is given here (refer Algorithm 02).Initially, the proposed model uses Nepho 3 , which is a command-line tool that orchestrates the creation of complete working application stacks on virtual infrastructure. Initially targeting Amazon Web Services as well as Vagrant, Nepho abstracts data center creation, instance configuration, and application deployment into portable "cloudlets" that can be shared between developers and teams. Considering the deposition and evaporation of pheromone, the work considers false positive and true positive rate of pheromone depending on the magnitude of trust value enhancement. Analytically, which depicts the successful deposition means trusted path and thus false positive will be high. As mentioned in an earlier section that trust is ROAD MAP The trust evaluation in the previous section using fuzzy components are based on linguistics decisions of human users, whereas ant colony can inspect the performance and quality aspects of messages in cloudlet transmission. Hence, the scope of proposed algorithm and solutions, amalgamating more than one intelligent method could infer about most suitable single or multiple cloudlet operations.

Generally, the proposed architecture can be elaborated as:

- With respect to the above scheme, the value of the loss function can be formulated while combining execution time, network latency and network bandwidth. Both the computationally intelligent techniques have been used with respect to different contexts.

Conclusion

The trust evaluation is significant in any cloudlet exchange process. However, stereotype intrusion detection and associated measures cannot ensure trust and validation of multiple intelligent sensors and devices under the cloudlet. We propose an elaborated and specific hybridization of computationally intelligent measures of trust both from the perspectives of user and quality of service. In the initial section, the proposal fuzzy computation is adopted to tackle the uncertainty in human inferences while trusting a specific cloudlet.

Subsequently, the performance of network also improves the trust validation and therefore the parameters are being measured through ant colony optimization algorithm. In the next chapter, the current results are compared and it is evident that effective hybrid scheme of both fuzzy and ant colony can conceive a comprehensive intelligent measure of trust in the cloudlet paradigm.

Chapter 10

Performance Analysis

The goal of this chapter is to compare between the proposed model and the contemporary models. Regarding to the contributions, the comparison is twofold: firstly, the performance of our proposed security approach, namely Property based Token Attestation, is discussed with various well-known contemporary approaches to figure out the difference in aspect of security and energy consumption. Second, by the same fashion, the performance of relevant trust and reputation models, in terms of accuracy, path length and energy consumption, is compared with the present model to prove the robustness of the contribution.

Property based Token Attestation

In mobile computing, performance and security are two important factors that need to be addressed to figure out how much protection a security mechanism (e.g. cryptographic algorithm) can offer and how much energy consumption will be lowered by using a corresponded security mechanism. Thus, depending on the user's requirement, the trade-off between security and performance needs to be considered. The author in [START_REF] Kaufman | Network Security: Private Communication in a Public World[END_REF] proposed a trade-off function that presents a relationship between performance and security metrics:

maxU = ωP + (1 -ω)S, 0 < ω < 1 (10.1)
where ω is the weight factor to present the preferences of the user on security and performance. In this part, we analyze the performance based security by comparing our proposed solution with the others [START_REF] Zhao | A Secure and Effective Anonymous Authentication Scheme for Roaming Service in Global Mobility Networks[END_REF], [START_REF] Mun | Enhanced secure anonymous authentication scheme for roaming service in global mobility networks[END_REF], [START_REF] Memon | Enhanced Privacy and Authentication: An Efficient and Secure Anonymous Communication for Location Based Service Using Asymmetric Cryptography Scheme[END_REF], [START_REF] Alavalapati | A Secure Anonymous Authentication Protocol for Mobile Services on Elliptic Curve Cryptography[END_REF] and [START_REF] Duong | A Novel Untraceable Authentication Scheme for Mobile Roaming in GLOMONET[END_REF], which also have presented security protocols in mobile computing environment. We also use a notion N*T where T refers to CHAPTER 10. PERFORMANCE ANALYSIS types of operations (e.g. hash, encryption/decryption operation) and N mentions about how many times this operation can be used in the protocol. While other solutions have used ECC, we use RSA for key encryption, digital signature and DH exponential function. To improve the performance, most of the heavy tasks (e.g. signature generation and complex shared secrets) have been performed remotely by TTP. For example, the heaviest shared secret N T T P * N V * N M has been calculated by TTP in flows 6 and 7 (refer Chapter 8).

The difference of ECC and RSA in term of performance is represented clearly in [START_REF] Nachiketh | Analyzing the energy consumption of security protocols[END_REF].

Loosely speaking, they are differences in execution time and energy cost regarding to key generation, signature generation and signature verification. To simplify, we denote T H as an hash operation, T eDH and T eECC as exponentiation functions of Diffie-Hellman (DH), Elliptic Curve D-H (ECDH) algorithms respectively; T ECC and T RSA refer to the whole operations related to the corresponding algorithms. In this work, we only consider three parameters such as hash, modular exponentiation and asymmetric operation for discussion.

The computation cost in the proposed work calculated also the content of similarity to the others. For example, in flow 1, M has 1 Hash operation and 1 RSA operation while V has 1 RSA operation. Totally, we have 1 * T H , 2 * T RSA in flow 1.

On the other hand, depending on the methodology, approach and context, the other solutions may use additional operations such as XOR, or symmetric encryption/decryption operations. For example, besides asymmetric/hash operations, the authors in [START_REF] Memon | Enhanced Privacy and Authentication: An Efficient and Secure Anonymous Communication for Location Based Service Using Asymmetric Cryptography Scheme[END_REF] have used additional 7 XOR operations, and 6 Symmetric Encrypt/Decrypt operations or 7 XOR operations in [START_REF] Mun | Enhanced secure anonymous authentication scheme for roaming service in global mobility networks[END_REF]. Thus, the table 10.1 presents the computation cost based performance related to hash and asymmetric algorithms of different approaches.

However, table 10.1 only presents the overall cost of all the involved parties, including Reddy et al. [START_REF] Alavalapati | A Secure Anonymous Authentication Protocol for Mobile Services on Elliptic Curve Cryptography[END_REF] Memon et al. [START_REF] Memon | Enhanced Privacy and Authentication: An Efficient and Secure Anonymous Communication for Location Based Service Using Asymmetric Cryptography Scheme[END_REF] Mun et al. [START_REF] Mun | Enhanced secure anonymous authentication scheme for roaming service in global mobility networks[END_REF] Le et al. [START_REF] Duong | A Novel Untraceable Authentication Scheme for Mobile Roaming in GLOMONET[END_REF] Zhao et al. [START_REF] Zhao | A Secure and Effective Anonymous Authentication Scheme for Roaming Service in Global Mobility Networks[END_REF] Proposed

Conclusion

As this is an empirical evaluation, these values would be varied depending on the different situations such as input data or device configuration. In this contribution, we use these values as a standard scale to prove that despite of using heavy security algorithms, our proposed solution has acceptable performance consumption. As mentioned earlier, the recent challenges of mobile computing are security and energy consumption. By proposing the security protocol and considering its performance, our approach not only addresses the current challenge of mobile computing but also is more realistic than the other existing solutions.

Trust and Reputation based Intelligence

Before discussing the comparison in detail, we present briefly the well-known models related to trust and reputation management in this section.

Bio-inspired trust and reputation model (BTRM-WSN) [START_REF] Gómez | Providing trust in wireless sensor networks using a bio-inspired technique[END_REF] is an approach based on ant colony system, where ants construct paths satisfying certain conditions in a graph.

To provide trust and reputation in wireless sensor networks (WSNs), the objective of this model is to help a client, who requests a particular service over the network, for finding the most trustworthy route leading to a service provider node. In BTRM-WSN, each node maintains a trail of pheromone τ ∈ [0, 1] for each of its neighbors. Because of determining the probability of ants for choosing a certain route, this pheromone is known as the trust that a particular node delivers to the others. Considering, for instance, ant k moves from node i to node j, the pheromone value is updated as the following equation:

τ ij = (1 -ϕ) • τ ij + ϕ • Ω (10.3)
where τ ij is the pheromone value of the path between node i and j; Ω = (1 + (1 -ϕ) •

(1 -τ ij ) • η ij ) is the convergence value of τ ij ; ϕ and η ij is is a parameter to control the amount of pheromone left by ants and the heuristic value [START_REF] Gómez | Providing trust in wireless sensor networks using a bio-inspired technique[END_REF], [START_REF] Marzi | An Enhanced Bio-inspired Trust and Reputation Model for Wireless Sensor Network[END_REF], respectively. When ant k reaches a service provider node j, the trustworthy of node j is determined by the average pheromone value (avg τ ) from client to node j. With this value, ant k decides to stop and return the current solution (Sk) with a probability equal to avg τ to the client (case 1), or keeps tracking another better one based on the reputation (case 2). To make a decision, avg τ is compared with a defined transition threshold (T raT H ∈ [0, 1]). If (avg τ ) is greater than T raT H then case 1 is performed. Otherwise, ant k decides node j not meets the reputation requirements and then case 2 is considered. Once BTRM-WSN selects the trustworthy path leading to the most reputable node, here the client must perform the flowing complex tasks:

-Examine and assess the path quality of the received solution (denoted by Q(S k )) which is brought back by each ant k.

-Select a path with the highest score among the received path quality of returned ants and store this score as Current_Best (CB).

-Then compare CB with the best value Global_Best (GB), which is obtained at the previous transaction. If CB is greater than GB, then CB is stored as GB. The pheromone value of this path is updated.

-After selecting the GB solution, the transaction between the client and the specific trustworthy node is established.

-After receiving the requested service, if the client satisfies with the received service, he will give a satisfaction value (Sat) is greater than another defined threshold P unT H ∈ [0, 1]. The pheromone value is updated with a reward.

-Otherwise, the client will give Sat as less than the threshold and the pheromone value is updated with a punishment. Linguistic Fuzzy Trust Model (LFTM) [START_REF] Hassan | Performance Analysis of Dynamic Wireless Sensor Networks using Linguistic Fuzzy[END_REF] is known as an improvement of BTRM-WSN by applying the fuzzy theory for the enhancement. The following step is represented how LFTM applies its linguistic fuzzy sets and fuzzy logic to the existing BTRM-WSN model:

-BTRM-WSN selects the node to have a transaction with. -Depending on the required service attributes, the selected node can provides a service with higher, lower or equal to the expectation.

-The expected service and the received one are compared with certain subjective weights for the attributes of the services.

-The client satisfactory is assessed as presented in BTRM-WSN.

-Together with client's goodness, the punishment level is determined by the client satisfaction with the received service.

PeerTrust [START_REF] Xiong | Peertrust: Supporting reputation-based trust for peer-to-peer electronic communities[END_REF] is another effective approach for determining and assessing the trust- Where, I(u) is the total number of transactions performed by peer u with all other peers; p(u,i) refers to the other participating peer in peer u's i th transaction. S(u,i) denotes the normalized amount of satisfaction between 0 and 1 that can be computed based on the feedbacks. Cr(p(u,i)) is the credibility of the feedback submitted by p(u,i) and TF(u, i) denotes the adaptive transaction context factor for peer u's i th transaction, and CF(u) denotes the adaptive community context factor for peer u. The normalized weight factors for the collective evaluation and the community context factor denoted by α and β, respectively. However, for trust computation, the authors have used a binary feedback system where a peer rates the other peer either 0 or 1 according to whether the transaction is satisfactory. This drawback makes this model less flexible to deal with the uncertainty context.

In brief, these mentioned models are the well-known approaches to estimate trust and reputation in WSN context. Next, we discuss the difference between our approach and these models. In similar fashion, we also use fuzzy logic as well as ACO to evaluate trust and reputation in cloudlet context. However, BTRM-WSN relied mainly on the feedback of clients (e.g. satisfactory value) to decide the trustworthy of the entity by modifying the pheromone value. This can lead to the unfair rating problem. This model also asks the end-user to do a complicated computation for generating the feedback value. After selecting the trusted node by BTRM-WSN, fuzzy theory is applied to improve the performance as presented in LFTM. This improvement helps the client understand precisely the quality of received service based on linguistic scale. Thus the client can leave the accuracy feedback based on his goodness. In contrast, the feedback of users is not sufficient to calculate trust and reputation in our proposed model. Similar to the principle of PeerTrust, we also consider the quality of service as an additional element to estimate trust and reputation of cloudlets. By combining user's feedback and quality of service, the proposed model can prevent the unfair-rating problem [START_REF] Liu | A fuzzy logic based reputation model against unfair ratings[END_REF] as well as collusion attack. It also overcomes the past experience problem when new cloudlets are added on the cloudlet mesh. Once the new cloudlet is added on the mesh, the cloudlet master can rely on the reputation based quality of service of this cloudlet to estimate its trust level. In addition, fuzzy theory in this approach is applied to deal with the uncertainty factor and calculate the trust degree of the certain cloudlet based on user's feedback and QoS. As mentioned earlier, to be more dynamic and adaptive, ACO is considered to consolidate the measure of trust. For example, instead of relying on satisfactory values [START_REF] Gómez | Providing trust in wireless sensor networks using a bio-inspired technique[END_REF], we calculate and update the pheromone value based on the overall average reputation as presented in equations 9.19 and 9.21. Last but not least, by enforcing the proposed mechanism to the cloudlet master, this approach does not require the end-user to perform unexpected tasks after receiving his suitable service.

Comparison of Performance

We also use TRMSim-WSN [START_REF] Gómez | TRMSim-WSN, trust and reputation models simulator for wireless sensor networks[END_REF], which is a Java-based trust reputation models simulator, to make a comparison among discussed models. The main purpose of TRMSim-WSN is to provide an easy method to test a trust and reputation model over WSNs and also enable users to compare their own model against others. In this part, we consider CHAPTER 10. PERFORMANCE ANALYSIS comparing the proposed approach to LFTM, which includes BRTM-WSN, and PeerTrust in dynamic WSNs environment. We keep the network configuration similar to these models as presented in figure 10.1a [START_REF] Gómez | Providing trust in wireless sensor networks using a bio-inspired technique[END_REF], [START_REF] Hassan | Performance Analysis of Dynamic Wireless Sensor Networks using Linguistic Fuzzy[END_REF]. Energy Consumption. The consumption of energy is the overall energy consumed by all involved entities, such as the clients and remote nodes. The figure 10.2c shows the fact that there is the trade-off between security and performance; and the more security the models support the more energy they consume. For example, LFTM is considered as the most effective model but it consumes the highest energy. Moreover, the graph also demonstrates that our proposed model is suitable for the mobile user in mobile cloud computing environment where the mobile device is known as a resource-constraint device.

Conclusion

In short, this subsection shows the overview of the difference between our proposed approach and the most known models. Although each model has its own pros and cons, they are considered as the effective models to assess the trust and reputation. According to the comparison data, it is worth noting that our proposed approach has obtained the acceptable results in terms of accuracy, shortest path and energy consumption.

Summary

In this chapter, in order to prove the advantage of our proposed solution, we have analyzed the performance of our approaches against others. To finalize this dissertation, we draw a conclusion in the next chapter.

Chapter 11

Conclusion

The work in this Phd dissertation focuses on building trusted environment for mobile devices in the context of MCC. As an essential factor of human life, current improvement of mobile technology makes daily life more convenient and effective regardless of time and place. In fact, people have to deal with many secrets or sensitive data daily, for example: bank account, personal records or even his firm's strategies. Due to the convenience of mobile devices and well-promises of the manufacturers, people tend to use their mobile devices for their important works as well as other normal purposes. Thus, we strongly believe that trusted environment is vital for mobile devices along with the raise of challenges.

In this thesis, we presented how to secure mobile devices from the conventional type of security to the intelligence. We also investigated the real case study to address the current challenges of mobile computing which is known as resource-constraint system.

Firstly, coming along with the performance, energy efficiency of different MCC architectures are presented by examining various approaches, namely, OSGi, Cloudlet Overlay and Container based solution. We consider that energy efficiency must be addressed not only at the cloud side but also at the mobile side. The former is used to solve the existing limitation of the latter by using remote resource provider rather than processing or storing data locally.

After that, we came up with the Droplock system, which is known as the demonstration of MCC model, by introducing the service architecture towards the application of mobile devices, sensors and cloud computing.

Secondly, the primitive security function of Droplock system has inspired us to propose the novel security model, Property based Token Attestation. In this work, we proposed the token with random properties to authenticate mutually the mobile user and the involved parties. We defined in detail the token content and how it works as well as the random properties list that is generated by the application service automatically, regardless the update or back up of the system. The integrity of properties list is also ensured and verified by the TPM functionalities and the active trusted third party. Hence, our approach not only lessens the remaining demerit of remote attestation mechanisms but also adapts to the context-aware.

Last but not least, by considering everything must be smart, the conventional security solution has not satisfied us much to enhance the security level in the context of MCC. As a result, we introduced the approach to estimate the trust and reputation of MCC model that is relied on the computational intelligence (i.e. fuzzy logic and ant colony optimization).

We believe that the usage of computational intelligence in security perspective is not only restricted with intrusion, rather this contribution demonstrates certain trust decision making paradigms.

At first the energy efficiency of different MCC architectures has been investigated, in the end we used this experience to analyze the performance between our approaches and related recent models in order to prove the robustness of our contributions.

Finally, regarding future works, the research on trusted environment design for MCC has made great progress however lightweight cryptographic methods such as elliptic curve cryptography need to be investigated for enhancing the performance of PTA. To this end, our approaches have become more adaptable to the context-aware.

For the context-aware, security models can be well extended with the help of computational intelligence. As cloud computing consists of interconnected computing resources and their virtual representation could be standardized with different protocols. Hence, for heterogeneous environment, intelligence must support in context specific security applications. This means there could be possibility to incorporate hybrid intelligent algorithms for mobile cloud. In recent research [START_REF] Xia | A Novel Ant Colony Optimization Algorithm for QoS-Based Multicast Trusted Routing in Wireless Ad Hoc Networks[END_REF], it has been observed that understanding different uncertain situations across mobile cloud platform hybrid solution using fuzzy computing map has been used. Similarly, different versions of smart fuzzy architectures are available for secure coding and threats investigation models are used [START_REF] Kang | A secure-coding and vulnerability check system based on smart-fuzzing and exploit[END_REF].

Thinh LE VINH Security and Trust in Mobile Cloud Computing

Abstract:

In this thesis, we investigate the way to secure mobile devices from the primitive security level (Trusted Platforms) to the sophisticated one (bio-inspired intelligence). More precisely, after addressing the challenges of mobile cloud computing (MCC), we have studied the real-case of mobile cloud computing, in terms of energy efficiency and performance, as well as proposed a demonstration of particular MCC model, called Droplock system. Moreover, taking advantages of trusted platform module functionality, we introduced a novel schema of remote attestation to secure mobile devices in the context of Mobile-Cloud based solution. To enhance the security level, we used fuzzy logic combining with ant colony system to assess the trust and reputation for securing another mobile cloud computing model based on the cloudlet notion.

Keywords:

trusted computing, mobile cloud computing, attestation, energy efficiency, fuzzy logic, ant colony system.

Résumé :

Dans cette thèse, nous étudions la sécurité des plates-formes mobiles en passant d'un niveau de sécurité primitif qui s'appuie sur les plates-formes de confiance, à un niveau plus sophistiqué qui se base sur de l'intelligence bio-inspirée. Plus précisément, après avoir abordé les défis du cloud computing mobile (MCC), nous avons développé une étude de cas appelée Droplock pour le cloud mobile et nous avons étudié son efficacité énergétique et ses performances pour illustrer le modèle MCC. En outre, en s'appuyant sur les plates-formes de confiance (comme les TPM), nous avons introduit un nouveau schéma d'attestation à distance pour sécuriser les plates-formes mobiles dans le contexte du cloud mobile. Pour améliorer le niveau de sécurité et être adaptatif au contexte, nous avons utilisé de la logique floue combinant un système de colonies de fourmis pour évaluer la confiance et la réputation du cloud mobile basé sur la notion de cloudlets.

Mots clés :

informatique de confiance, cloud mobile, attestation, efficacité énergétique, logique floue, algorithme de fourmis.

Introduction 1 . 1

 11 Problem Statement: Trusted computing for Mobile Cloud Computing . . . 1.2 Thesis contribution . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.2.1 Contribution 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.2.2 Contribution 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.2.3 Contribution 3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.3 Thesis outline . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

9. 4

 4 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Performance Analysis 10.1 Property based Token Attestation . . . . . . . . . . . . . . . . . . . . . . . 10.1.1 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.2 Trust and Reputation based Intelligence . . . . . . . . . . . . . . . . . . . . 10.2.1 Comparison of Performance . . . . . . . . . . . . . . . . . . . . . . . 10.2.2 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.3 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . and VMs . . . . . . . . . . . . . . . . . . . . 2.1 Difference between Containers and VMs . . . . . . . . . . . . . . . . . . . . 4.1 Comparison of features of Trusted Platforms . . . . . . . . . . . . . . . . . 4.2 Difference between pTPM and vTPM . . . . . . . . . . . . . . . . . . . . . 7.1 Size and execution time of the tested programs . . . . . . . . . . . . . . . . 7.2 Consumed energy of the execution of program 1 . . . . . . . . . . . . . . . . 9.1 Degree structure of certainty elements . . . . . . . . . . . . . . . . . . . . . 9.2 Configuration of membership values . . . . . . . . . . . . . . . . . . . . . . 9.3 Trust evaluation under uncertainty . . . . . . . . . . . . . . . . . . . . . . . 10.1 Computation cost . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.2 Energy cost of asymetric algorithms . . . . . . . . . . . . . . . . . . . . . . 10.3 Performance consumption based security (mJ) . . . . . . . . . . . . . . . . 11.1 Dataset [1], [2] . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

  Par conséquent, les services d'infrastructure de cloud partagé fonctionnent comme des utilitaires: les utilisateurs disposant de leur téléphone intelligent peuvent accéder aux services dont ils ont besoin à partir de ressources hébergées à distance sur Internet et payer pour ces services. Ces services ne se mettent pas seulement à niveau automatiquement, ils évoluent également facilement vers le haut ou vers le bas. On peut voir clairement que les avantages du cloud computing ont apporté des avantages aux appareils mobiles pour surmonter les limites de la technologie mobile; à savoir le stockage de données limité, la puissance de traitement et la durée de vie de la batterie. Généralement, le terme de Mobile Cloud Computing (MCC ) vient de la combinaison des technologies de l'informatique mobile et du cloud computing. Dans cette thèse, après avoir étudié le cas réel des plateformes de confiance et des modèles de MCC, nous nous concentrons principalement sur le défi de la sécurité dans l'écosystème du cloud mobile avec le soutien de plateformes de confiance en proposant notre intérêt sur l'authentification, la confiance et la réputation dans le contexte du cloud computing mobile. Description du problème: Calcul sécurisé pour le Cloud Computing Mobile Dans le cloud computing mobile, la tendance actuelle est d'externaliser les données et le calcul des appareils mobiles vers le cloud afin d'étendre les limites de travail des Résumé de la thèse équipements à ressources limitées et de bénéficier de capacités cloud illimitées telles que le stockage. En outre, MCC doit offrir des mécanismes pour garantir la protection et la sécurité des données dans un environnement non sécurisé. Avec l'utilisation croissante des MCC, les problèmes de sécurité restent un défi. Notre travail consiste à rechercher principalement sur les plateformes de confiance existantes pour répondre aux questions suivantes: -Qu'est-ce qu'un environnement de confiance ? -Une solution de sécurité pure est-elle suffisante pour créer un environnement de confiance ? et -Comment les appareils mobiles peuvent-ils coopérer avec le Cloud pour créer un environnement de confiance ? En outre, en prenant en charge le matériel pour fournir des primitives de sécurité indépendantes des autres composants du système, le concept d'informatique de confiance n'est pas une notion nouvelle et est décrit dans de nombreuses recherches [7; 8; 9; 10]. Un exemple spécifique de technologie informatique de confiance est l'attestation à distance (Remote Attestation) qui permet à un système informatique de mesurer les propriétés d'un système distant de telle sorte qu'un système distant sera détecté s'il est compromis. Les propriétés d'une plate-forme ou d'une application peuvent être utilisées pour définir les exigences de sécurité afin de satisfaire le terme de base C.I.A (Confidentialité, Intégrité, Authentification) de la sécurité du système. Dans l'environnement Cloud, l'un des problèmes pouvant survenir est la gestion de la clé de chiffrement. Plusieurs clients du Cloud peuvent avoir leur propre méthode de cryptage et la gestion des clés de sécurité est un autre problème à résoudre dans le contexte des données cryptées [11]. En prenant en charge la protection des clés cryptographiques, la génération de nombres aléatoires, la liaison cryptographique des données à certaines configurations système, l'encapsulation des données dans la configuration de l'application et l'authentification de la plateforme/application, nous proposons d'utiliser Trusted Platform Module (TPM), supporté par le Trusted Computing Group, pour surmonter cette situation. Le module TPM (Trusted Platform Module),

contemporains♦

  Le chapitre 11 conclut et résume l'ensemble du travail et présente également la perspective première de ce travail. Avec l'expréssion «Pas de Cloud sans virtualisation», la technologie de virtualisation est largement utilisée pour partager les capacités des ordinateurs physiques en répartissant les ressources entre les systèmes d'exploitation. En 1964, le concept de machines virtuelles (VM) est utilisé dans le projet d'IBM appelé système CP/CMS. Le programme de contrôle (CP) a agi pour diviser la machine physique en plusieurs copies (VM), chaque copie ayant son propre système d'exploitation. En 1974, Goldberg et Popek ont publié un document [16] qui introduit un ensemble de conditions suffisantes pour que l'architecture informatique supporte efficacement la virtualisation du système. En 1999, la société VMware a présenté son produit VMware Virtual Platform pour l'architecture x86-32. En 2006, Intel et AMD ont proposé des extensions pour prendre en charge la virtualisation.

  Pour simplifier les techniques de virtualisation, les fournisseurs de matériel tels que Intel et AMD ont introduit de nouvelles extensions pour prendre en charge la virtualisation. Ainsi, deux fonctionnalités en mode CPU sont introduites dans Intel Virtualization Technology (VT-x) et AMDV d'AMD pour que le VMM fonctionne en mode root sous le ring 0 (c.-à -d.

  (a) Hyperviseur basé sur des machines virtuelles (b) Virtualisation basée sur les conteneurs

Figure 1 :

 1 Figure 1: Architecture de la machine virtuelle par rapport aux architectures Docker Container

  de stockage à travers la virtualisation. En offrant l'infrastructure virtualisée comprenant le matériel, le stockage, les serveurs, le centre de données et les composants réseau, les clients peuvent installer leur propre système d'exploitation, base de données et services informatiques sur les machines virtuelles provisionnées[START_REF] Sridhar | Cloud Computing -A Primer -The Internet Protocol[END_REF]. Au lieu d'acheter leurs propres Résumé de la thèse composants de matériel informatique, les clients achètent généralement des IaaS en fonction d'une base de calcul de l'utilisation ou de l'utilité, comme le temps CPU, l'espace de stockage et la bande passante du réseau. Amazon EC2, Cisco Metapod ou Google Compute Engine sont quelques exemples populaires du modèle IaaS.

Figure 2 :

 2 Figure 2: Modèles de service du cloud computing

Figure 3 :

 3 Figure 3: L'architecture MCC et ses parties prenantes importantes

  consiste à créer un Cloud avec des périphériques mobiles interconnectés pour le stockage et le traitement des données afin que les périphériques mobiles soient des fournisseurs de ressources d'un Cloud virtuel. Dans cette architecture (voir Figure5), les appareils mobiles fonctionnent comme fournisseurs de services ou consommateurs, et chaque appareil mobile peut ainsi coopérer avec ses voisins pour collecter/distribuer ses informations environnantes à des fins spécifiques telles que les informations sur le trafic, la surveillance de l'état de santé d'un patient, etc.

Figure 4 :Figure 5 :Figure 6 ,

 456 Figure 4: Modèle Server-Client

Figure 6 :

 6 Figure 6: Modèle Cloudlet

Figure 7 :

 7 Figure 7: Surcouche de VM dans l'architecture Cloudlet

  (a) Virtual machines based hypervisor (b) Virtualization based on containers

Figure

  Figure 2.1: Virtual Machine versus Docker Container architectures

  of buying their own computing hardware components, the customers usually purchase IaaS based on a per-use or utility computing basis such as CPU time, storage space, and network bandwidth. Amazon EC2, Cisco Metapod or Google Compute Engine are some the popular examples of IaaS model.

Figure 3 . 1 :

 31 Figure 3.1: Service models of cloud computing

  have been defined to cater to different use cases in mobile cloud computing. The major benefit of cloud computing for mobile devices is to enable running applications between resource-constrained devices and Internet-based Cloud. Hence, resource-constrained devices can outsource computation/communication/resource intensive operations to the cloud. Mobile cloud applications based on mobile cloud collaboration may deploy their components into different places including local smart phone, virtual machines in cloud or cloudlets. In the following, we describe the possible models for mobile cloud computing.

Figure 3 . 3 :

 33 Figure 3.3: Server-Client model

CHAPTER 3 .

 3 Figure 3.4: Virtual Cloud model

  Simanta et al. in[START_REF] Simanta | A reference architecture for mobile code offload in hostile environments[END_REF] proposed an example of implementation of the concept of cloudlets with the objective of enhancing processing and conserving battery power in the mobile devices notably in hostile environments where networks are unreliable. The key feature CHAPTER 3. ANNALS OF MOBILE CLOUD COMPUTING of the architecture is that offloaded elements are stateless. Communication between the cloudlet and the center cloud is done only during setup and provisioning. Once the cloudlet is provisioned, it works in a disconnection mode with the center cloud and in a connection mode with the mobile device. When a mobile device is connected to a cloudlet, an application overlay is offloaded from the mobile device to the cloudlet. An application overlay represents the difference between a base VM with only an operating system installed and the same VM with the application installed. The cloudlet may host multiple VMs.

Figure 3 . 5 :

 35 Figure 3.5: Cloudlet model

Figure 3 . 6 :

 36 Figure 3.6: VM Overlay in the Cloudlet architecture

Figure 3 . 7 :

 37 Figure 3.7: Elijah-cloudlet simulation

Figure 4 . 1 :

 41 Figure 4.1: Trusted Platforms

Figure 4 . 2 :

 42 Figure 4.2: Java Card Platform [3]

CHAPTER 4 .

 4 TRUSTED PLATFORMS: COMPUTING WITH TRUST security domains (SD) as in figure 4.3. A SD is assigned to one service provider (SP)and may contain one or several applications belonging to the same SP. Each Java Card application is composed of one or several Java Card applets, generally called Cardlets.

Figure 4 . 3 :

 43 Figure 4.3: Security Domain as defined in GlobalPlatform [4]

Figure 4 . 4 : NFC mobile device 4 . 1 . 2

 44412 Figure 4.4: NFC mobile device

Figure 4 . 5 :

 45 Figure 4.5: NFC card emulation without a secure element HCE supports APDU stack protocol

Figure 4 .6 6

 46

Figure 4 . 6 :

 46 Figure 4.6: Architecture of GlobalPlatform TEE

Figure 4 . 7 :

 47 Figure 4.7: Rich OS, TEE and SE positioning

Figure 4 . 8 :

 48 Figure 4.8: Architecture of Trusted Platform Module

  generates and signs an AIK certificate. The certificate of AIK is sent back to Att (Step 3). Att now can send this certificate, PCR values signed by AIK and Stored Measurement List (SML), which contain the measured value of platform state, to Chal. In the challenger side, it verifies the certificate of AIK and uses AIK to verify the signature of PCR values for recalculating the value as listed in SML. Chal compares this recalculated value with CHAPTER 4. TRUSTED PLATFORMS: COMPUTING WITH TRUST PCRs value. If the PCRs value and SML do not match, it indicates that the platform has been tampered and Chal determines that Att is an untrusted system. Otherwise, it decides to trust Att. The configuration of Att can be stored in whitelist/blacklist if it is the trusted/blacklist system.

Figure 4 .

 4 Figure 4.9: Remote Attestation

  comprehensive and robust enough to gain the confidence of service providers and end-users. f. Physical / Software attack The SE's physical protection depends on the type of chips. Most of them have strong protection. TEE, SE and TPM are designed to prevent from unauthorized software attacks. They work effectively in many use cases including e-commerce, citizen to government applications, online banking, and other fields where a high security level is required. g. Privacy In order to be against the increasing of the security threats, the TPM supports covering privacy protection and interoperability on multi-platforms including PCs and mobile devices. Hardware manufacturers can flexibly implement the architecture of TPM chips. The owner can also flexibly deploy this architecture depending on the security solutions. Regarding the software implementation of available trusted platforms, HCE, support strongly by Google, has gained some attention in the NFC technology. With SE-less, HCE faces with many security risks in comparison to SE and also requires more attention from the developer side. However, it enriches some factors; namely development costs, time to market and the need to cooperate with other parties.

Figure 4 .

 4 Figure 4.10 demonstrates the generic architecture of vTPM.

Figure 4 . 10 :

 410 Figure 4.10: Architecture of virtual TPM

  has been deployed widely in volumious mobile devices. Due to the limited access created by mobile manufacturers and the cost, hardware based TEE makes the difficulties for programming developers who want to CHAPTER 4. TRUSTED PLATFORMS: COMPUTING WITH TRUST (a) physical TPM (b) virtual TPM

Figure 4 . 11 :Figure 4 .

 4114 Figure 4.11: Example of vTPM for virtual machine relies on physical TPM's specification

Figure 4 .

 4 [START_REF] Thinh | Energy Efficiency in Mobile Cloud Computing Architectures[END_REF] represents an example of vTEE and its trusted application13 . Where the simple trusted application "hello_world" is executed its sensitive part in trusted environment and its result is displayed in Rich OS (e.g. Android OS, iOS) (a) In Rich Environment (b) In Trusted Environment

Figure 4 . 13 :

 413 Figure 4.13: Demonstration of vTEE

5

 5 out their pros and cons. Most of them have pointed out the existing drawbacks of current remote attestation mechanisms. Regarding to application attestation, the deficiencies of BA have been shown clearly in many discussed above researches. However, in term of property-based attestation, the questions that what useful properties need to be attested; and the way to generate them automatically have not been answered sufficiently by the above mentioned work. In the next chapter, we address the recent security issues related to MCC by reviewing various approaches.ChapterSecurity issues in Mobile Cloud Computing: Related WorkMMC not only takes advantage of the cloud computing facilities but also inherits the security threats of conventional cloud computing. Besides the existing challenges facing the processing of providing web service to mobile devices such as loss of connection, bandwidth/latency and limited resources, using the cloud for mobile devices also raises a challenge of security and trust issues. The current challenges of MCC can be listed here, namely malware, virus, privacy, financial fraud, content protection, enterprise data and secure space. Due to this matter, there is a rise of awareness and an acceleration of adoption of security solutions. To address the role of Trusted Platforms in MMC, we present security concerns for either the mobile devices or the cloud side.

CHAPTER 5 .

 5 SECURITY ISSUES IN MOBILE CLOUD COMPUTING: RELATED WORKthe respective1 . The combination of TEE and TPM Mobile is another typical example.Because of the advantage in on-processor technologies such as the TEE combining with the flexibility of the TPM protocols, this means it is possible to implement the TPM as an integrated solution or in firmware. As a result, the TPM Mobile functionality is implemented as a Trusted Application in the TEE.What's more, mobile apps and data must be considered to secure mobile devices. Firstly, since apps are executed in untrusted mobile devices, trusted platforms are essential to overcome security constraints. Depending on the security level that is required, apps may rely on physical or software trusted platforms. For example, Roland developed, in[START_REF] Roland | Debugging and Rapid Prototyping of NFC Secure Element Applications[END_REF], a prototype that emulates secure elements within Android platforms. Such an open emulator is used for debugging and rapid prototyping of secure element applications. The emulator is a complete Java Card API implemented within Android. Comparing to HCE of Google, the emulated secure element allows security and trust, and is proposed to replace the physical SE only for long-term testing and for showcasing of applications. Secondly, confidentiality and integrity are required to secure data stored on the mobile device and to allow transfer through the Internet. Well-established protocols such as SSL/TLS should be used for data transfer while confidentiality and integrity may be computed by the trusted platforms of the mobile device since they integrate a crypto-processor with trust storage, and implement cryptographic algorithms. Depending on data sensitivity, data may be encrypted or not and may be stored in a distinct storage memory. In fact, if data is sensitive like a PIN code, a generated security key, or a password, it can be stored in the Flash memory or the EEPROM of the trusted platform (SE or TEE). If data size exceeds the memory available in trusted platforms, data can be stored in the mobile device memory that is protected by the trusted platform like in TEE, or even outsourced if the Cloud provides a trusted environment. In case data is not sensitive, it can be stored in the untrusted mobile device or on the Cloud.

Fuzzy

  logic system (FLS) is a proved mathematical concept. It has been considered as the mathematical model of vagueness and imprecision which is originally proposed by Professor Lofti Zadeh in 1965. Its basic concept has been represented in many books[85; 86]. Moreover, there are many researchers who have applied this concept to their work to manage the uncertainties, ambiguities and incomplete information associated with the trust measurement in cloud environment[87; 88; 89; 90]. Generally, FLS is a rule based system[START_REF] Wang | A Course in Fuzzy Systems and Control[END_REF] in which a mathematical model allows to solve difficult simulated problems with variety input/output parameters. Coupled with the linguistic variables, we can mimic human decision making based on the fuzzy control rules. The figure 6.1 demonstrates CHAPTER 6. COMPUTATIONAL INTELLIGENCE: SCENARIO FOR MEASURING TRUST AND REPUTATION the global function of fuzzy inference system (FIS). The FIS begins with the process of converting the input crisp sets into fuzzy sets, which include the membership functions and linguistic values, namely fuzzification. The Fuzzy Inference applies the rule-base. This is essentially the control strategy of the system and presented as a set of IF-THEN rules, to generate the fuzzy output. Typically, the rule can be expressed as the following example:IF state(x) is Good Reputation (GP ) T HEN output(y) is High Level (HL), where state(x), output(y) are linguistic variables while GP and HL are the linguistic values. Finally, the crisp output is derived by mapping the fuzzy output to crisp input in defuzzification[START_REF] Cirstea | Neural and Fuzzy Logic Control of Drives and Power Systems[END_REF].

Figure 6 . 1 :

 61 Figure 6.1: General diagram of basic fuzzy logic functions

Figure 6 . 2 :

 62 Figure 6.2: Rectangular MF

Figure 6 . 3 :

 63 Figure 6.3: Triangular MF

Figure 6 . 5 :Figure 6 . 6 :

 6566 Figure 6.5: Trust evaluation based Performance and Security

9 )CHAPTER 6 .

 96 COMPUTATIONAL INTELLIGENCE: SCENARIO FOR MEASURING TRUST AND REPUTATIONWhere, ∆τ kbest ij is the total amount of pheromone which the elite ants deposited on the best route. To simulate ACO algorithm and understand how it works, we have used Wolfram CDF 1 as presented in figure6.7. We assume to use 20 cities and 25 ants with ρ = 0.98 and α, β equal to 1 and 3, respectively. Then, the ants travel around randomly to look for a source of food (see figure6.8a). As the increasing of pheromone on the trails over time, the shortest path is determined as demonstrated in figure6.8b.

Figure 6 . 7 :

 67 Figure 6.7: Wolfram CDF simulator

Figure 6 . 8 :

 68 Figure 6.8: Process of ACO for finding the shortest path

Figure 7 . 1 :

 71 Figure 7.1: Time in second for downloading and executing the overlay, OSGi bundle, and Docker layer

Figure 7 . 2 :

 72 Figure 7.2: Service energy consumption

Figure 7 . 4 :

 74 Figure 7.4: Service architecture for Sensor, Mobile and Cloud computing

  Data can either be sensed by smart devices and processed by the Cloud or sent by the Cloud towards the actuators. Depending on the platform, data has different roles as in the following: a. Data collection/aggregation: The basic function of a sensor is to sense data from its surrounding environment. Using the data collection/aggregation services, a mobile terminal can collect data from sensors, process and report them using the communication service. CHAPTER 7. MOBILE CLOUD COMPUTING: REAL CASE STUDY b. Data externalization from the mobile device to the Cloud: Because of their constraints in terms of energy, computational power and memory, smart devices may need to outsource their data storage and computation on the Cloud computing.

  described in Chapter 4. The existing remote attestation mechanisms currently used in trusted computing environment such as Binary Attestation (BA) and Property based Attestation (PBA) are mentioned in Chapter 4. In addition, by taking advantage of the combination of technologies and trends, such as Trusted Platform Module (TPM), Cloud Computing, and Bring Your Own Device (BYOD), we introduce Property based Token Attestation (PTA) to secure the mobile user in the enterprise cloud environment. In order

CHAPTER 8 .

 8 PROPERTY BASED TOKEN ATTESTATION : A NOVEL FRAMEWORK solutions to adapt the security of mobile device in the Mobile Cloud Computing. Generally, in our solution (See figure 8.1), the Employee (Client M) needs a valid Token provided by the Trusted Third Party (TTP) to access company's resources. To obtain this Token, she has to show her secure evidence of hardware/software platform to TTP, which provides cloud-based security. TTP has a knowledge of its provided services and clients such as Application ID, Property List etc. After evaluating client's evidence, TTP then issues the corresponding Token based on received valid evidence. The Token, in this case, works asThe Letter of Introduction. Depending on the internal policy of the Enterprise (V), TTP can provide a proof of existence for a token at an instant in time. The token is only valid within T T T P (limited time), otherwise it will be discarded automatically. With this Token, the Employee can access her specific data for a limited time. The Enterprise's role is to evaluate the received Token to enable the employee to access its resource by outsourcing its security service to the Trusted Third Party. Particularly, the Enterprise can delegate its security to a Cloud acting as a Security as a Service platform but it can be a private or a hybrid Cloud as well.

Figure 8 . 1 :

 81 Figure 8.1: Property based Token Attestation

  For instance, the application has three classes: Class A has N properties α where (α 1 , . . . , α N ) ∈ α.Similarly, Class B and C have β and γ respectively. The active TTP has a knowledge of this property collection, namely a property list (P L) = (α, β, γ). Meanwhile, Ω ∈ (α ∪ β ∪ γ) is a subset of properties; SP = {Low, Med, Hi} is a set of security levels which is defined by the enterprise security policy. Depending on the value of SP, Ω will be generated by the application service. As a result, the random property list Pi is established at run time as P i = P L\Ω. The integrity of Pi is ensured and verified by a reserved Platform Configuration Register (PCR) and the active TTP respectively. In addition, we use a recomputed Nonce of involved parties using Diffie-Hellman exponentiation function as security property as well. After receiving and verifying the evidences from the client, the TTP signs a trust credential to certify the trustworthy of the specific application. This trust credential is referred to a trust Token for the authentication of the client. The Token consists of the proof, such as Pi, Timestamp, and recomputed Nonce etc. to prove the client's trustworthiness to the enterprise.

Figure 8 . 2 : Property evidence 8 . 3 . 3

 82833 Figure 8.2: Property evidence

Figure 8 . 3 :

 83 Figure 8.3: Property based Token Attestation model

  and Hash(P KAIK , N V 1 * N T T P 1 ) respectively. Now V has the public key AIK of M/TPM. Having a proof of AIK public key, V generates a nonce N V to work with M and computes N V and received N M as N V * N M . Then, V sends the message as presented in flow 4 to M. Using its secret AIK key, M obtains the received message and then decrypts the hash value with the public key of V. To ensure the integrity of received message, M computes a shared secret nonce N V * N M by using its own N M and the received N V . The result of N V * N M is hashed together with V ID and T V to make a comparison with the value of Hash(M ID , V ID , N V * N M , T V ). If they match, then M is sure about the identity of V. FRAMEWORK In the next step, the mobile user M extends a random Pi to a reserved PCR by calling TPM_Extend() command. Note that the PCR is extended with the random Pi for each attestation. As presented in flow 5, the message in previous flow and the ML consisting of the fingerprint of Pi is sent together with an AIK signed value of the reserved PCR generated through the TPM_Quote() command. When TTP receives the message from the mobile user, it first uses the knowledge of AIK to verify and decrypt the first sub-message, (P CR, P i)S KAIK . TTP then compares this PCR value against new PCR value, which is recalculated from the fingerprint of Pi within ML by applying the PCR's extend operation.If they do not match, it implies that the integrity of application is violated. TTP should terminate the communication. In addition, Pi is always used to check if Pi values are coherent compared to PL that is held by TTP as discussed earlier. Finally, the second hash value is used to ensure that the interaction is done effectively with M.After validating the correctness of M and V's evidence, TTP decides to generate and send a token either to M or V. TTP is sure that M is authentic thanks to the hash values to verify the authentic TPM and M in flow 2 and 3, and that the app has consistent properties Pi thanks to flow 5. The token is signed by TTP to be sure that he is the issuer of the token. Only TTP has the key to perform this operation. Thus, this trust credential is composed of: (Hash(P i, M ID , V ID , N T T P * N V * N M , T T T P ))S KT T P where N T T P is a new nonce of TTP to create a shared secret nonce N T T P * N V * N M and the duration of the token is decided by T T T P . The token is only valid within T T T P , otherwise it will be discarded automatically. In flow 6 and 7, the token has been delivered to M and V. Having the essential data from previous flows, the receivers check the validity of the received token by re-computing the shared secret nonce N T T P * N V * N M . For instance, M takes the value of N V * N M obtained in flow 4 and the received N T T P to create the new shared nonce for the comparison.

Proof 4 :

 4 related to Pi. A compromised App ′ can generate a false set of properties Pi ′ sent to TTP in flow 5. Then we have two cases: -The compromised App ′ is on the compromised M ′ . It returns to the Proof 2.

  CR, P i)S KAIK1 ]P KAIK1 = Hash(P CR, P i) = y (8.25) Hash(PCR, Pi) is the Hash extend operation of PCR in TPM and CERT AIK tells that M ID has public key P KAIK1 and secret key S KAIK1 at another session. TPM FRAMEWORK has safely stored ML corresponding to M and the property Pi corresponding to valid app in M is also stored in TTP. TTP: Hash(P CR, P i) = y (8.26) From (8.25) and (8.26), TTP can check the validity and authenticity of M. 5. Now TTP can check in its EEPROM that there was a token generated at time T T T P against M ID . (a) If (T T P : T Y -T T T P ≤ σ1), then [TTP to M]: ((Hash(P i, M ID , V ID , N T T P * N V * N M , T T T P ))S KT T P , N T T P , T T T P )P KAIK1 . M: [((Hash(P i, M ID , V ID , N T T P * N V * N M , T T T P ))S KT T P , N T T P , T T T P ) P KAIK1 ]S KAIK1 = (Hash(P i, M ID , V ID , N T T P * N V * N M , T T T P ))S KT T P , N T T P , T T T P ) (8.27) So, M now has the same token (Hash(P i, M ID , V ID , N T T P * N V * N M , T T T P ))S KT T P as previous.

  (a) Cloudlet mesh master-slave model (b) Cloudlet mesh and Trusted Third Party

Figure 9 . 1 :

 91 Figure 9.1: Master-Slave and Trusted Third Party model of Cloudlet

Figure 9 . 2 :

 92 Figure 9.2: Proposed Trust based reputation model

  QoS to present the reputations based on the quality of cloudlet S at time t, denoted by R QoS1 . . . R QoSS . R QoS is composed with 3 tuples (Availability (Av), Performance (Per), and Secure Parameters (SP)) as expressed by: R QoS = ω1 × (Av) + ω2 × (P er) + ω3 × (SP ) (9.3) where -ω1, ω2, ω3 are the weight factors and ω1 + ω2 + ω3 = 1 CHAPTER 9. TRUST AND REPUTATION FOR MOBILE CLOUD COMPUTING: A ROAD MAP -Availability (Av) = Areq Nreq ; A req refers to the number of accepted requests; N req is the total number of submitted requests. -Performance (P er) = ts * bs max(bs) is the performance of a cloudlet in term of time efficiency, which is calculated by bandwidth and responded time of each cloudlet; denoted by b S and t S respectively. -Security Parameters includes the Confidentiality (C), Integrity (I), Authentication (A) and TPM's existence (T). We require each cloudlet has all security features, like C ∩ I ∩ A ∩ T to work as service provider. Thus, we consider C, I, A and T as a single parameter (SP).

5 )CHAPTER 9 . 5 Figure 9 . 3 :

 59593 Figure 9.3: Membership input functions of linguistic variables

  Degree of membership f or Time] * [Degree of membership f or Property] * [Degree of membership f or HT T P Get ] (9.10) In addition, the association rules for intrusion detection and their classification can be expressed either by normal, sudden intrusion or attacks. They are inserted to the fuzzy knowledge base. Hence, to fire a particular fuzzy association rule, the following attributes could be augmented: a. Confidence b. Support c. Selection weight of the association rule to find out the rule, that have significant input/output dependency For example, Conf idence rule (A → B) = | ∑ xp∈Class(yp) β AB (x p )| | ∑ xp∈Class(yp) β A (x p )| (9.11) Support rule (A → B) = | ∑ xp∈Class(yp) β AB (x p )| |N | (9.12) Where, ♦ |N | is the number of transactions ♦ β A (x p ) is the compatibility degree of transaction x p with the antecedent part A ♦ β AB (x p ) is the compatibility degree of transaction x p with the antecedent and consequent of the rule A → B ♦ y p represents p th of p consequent. ROAD MAP Membership Initial value Bi-selection value Terminal value Functions Low a Low = 0.0 middle Low = (a Low + b Low )/2 b Low = Low High a High = b Low -x d middle High = (a High + b High )/2 b High = 1.0 Small a Small = 0.0 middle Small = (a Small + b Small )/2 b Small = Small Large a Large = b Small -x d middle Large = (a Large + b Large )/2 b Large = 1.0

9 . 3 Proposed model with ant colony optimization 9 . 3 . 1 Context

 93931 precisely and can overcome the drawback of fuzzy logic. The bi-focal (i.e fuzzy and ACO) intelligent approach to develop trusted platforms has been demonstrated with empirical validation. Next section presents how ACO can be adapted to the proposed model for evaluating the trust and reputation of multi-cloudlets. CHAPTER 9. TRUST AND REPUTATION FOR MOBILE CLOUD COMPUTING: A ROAD MAP In the recent past, cloud storage service 2 have changed strategy to store and to share the data. Previously, data residing on one device was transferred to another by physically connecting the two or by transferring data using mass storage devices. At present, with readily available high speed internet access and cloud storage services like GoogleDrive (https://cloud.google.com/products/cloud-storage/), Live Drive (http://www.livedrive.com/) and Dropbox (https://www.drop-box.com/business/ cloud-storage-and-backup) , users are more comfortable in keeping their data on the cloud for ready access to a plethora of devices. The trend of sharing content over social media has added an emerging feature. At present, people store their photos (Flickr, https://www. flickr.com/), videos (Vimeo, https://www.vimeo.com/) and other shareable documents Cloud storage services, and share photos/clips with their friends, using one click sharing options. The need to synchronize mobile phones, laptops and PCs is more or less eliminated. Cloud storage has also been suitable for business and enterprise users. Cloud enabled services such as web cloud hosting, cloud databases, and cloud-based data backup storage are very popular among normal users, enterprises, and big-data companies. Therefore, considering the different trends of cloud and cloudlet architecture, trust evaluation has become more pertinent, contextually. Mathematical foundation of trust is discussed in next subsection.

  reputation with a dynamic time interval scale. At this outset, a loss function is obvious for cloudlet, because all cloudlet components are subjected to loss of trust measures with number of changing constraints. One way to measure the trust is to measure the minimal loss function of dynamic values of cloudlet. If the cloudlet is sequentially positioned from base cloudlet to the successive cloudlets, then degree of trust should be changing and final value of any particular time interval instant is the summation of trust value from base cloudlet to successive cloudlet divided by the total number of cloudlets. However, the loss function of trust is a dynamic function characterizing the loss of its value at time t. The loss rate function is a non-decreasing power function of time. The analogous behavior of trust is presented through ants' pheromone deposition and evaporation. The following expression 9.17 shows that ∆ j is the small amount of trust with regards to the summation CHAPTER 9. TRUST AND REPUTATION FOR MOBILE CLOUD COMPUTING: A ROAD MAP of trust value for changing time interval Ω from initial time interval scale γ.

Step 1 :

 1 Distribute the ants randomly in the solution space. Each ant in the solution space corresponds to the possible combination of the different multiple cloudlet parameters. -Step 2: Evaluate the value of the loss function -Step 3: From the Fuzzy rule base: The rule base has been formed by utilizing the past experiences. (table 9.1 and 9.2) -Step 4: Calculation of the resultant location utilizing the fuzzy rule base, evaluate to CHAPTER 9. TRUST AND REPUTATION FOR MOBILE CLOUD COMPUTING: A ROAD MAP the next best location that the ant can occupy. -Step 5: Update the ant pheromone for cloudlet nodes -Step 6: Estimate the movement of the ants -Step 7: Check if the termination criterion is reached or not. If reached, then stop the algorithm or otherwise move to step 2.

CHAPTER 10 .

 10 PERFORMANCE ANALYSIS-This node has a goodness linguistic scale, include "Very High, High, Medium, Low and Very Low".

  worthiness of peers in Peer to Peer network of e-business communities. The principle of PeerTrust is that the reputation-based trust is established in terms of the quality of services provided by peers, rather than the quality of the feedback arranged by peers. Generally, the trust value T (u) of peer u is represented in the following equation:T (u) = α * I(u) ∑ i=1S(u, i) * Cr(p(u, i)) * T F (u, i) + β * CF (u)(10.4)

Figure 10 . 1 :

 101 Figure 10.1: TRMSim-WSN configuration settings

Figure 10 . 2 :

 102 Figure 10.2: Performance of LFTM, PeerTrust and the Proposed Approach

CHAPTER 11 .

 11 CONCLUSIONIn this Phd thesis, this scope of experimental validation is restricted because of the mention diversify hardware and middleware components. However, an attempt has been made to fetch the live data in the form of context and application for different users has also accomplished. The data-set used in this work is principally synthetic data-set, which has been referred from different mobile cloud users scenarios. The middleware of different mobile devices are treated as different contexts, imprecise and dynamic, therefore the road map of the future work must envisage different adaptive protocols for security mobile cloud paradigm. In this research the modeling and validation have been emphasized. The inclusion of ant colony optimization also indicates the significant lightweight application development to identify the intrusion and related behavior in mobile cloud. The defined extension for computational intelligence with respect to mobile cloud environment should definitely encourage different independent as well as hybrid algorithms to keep the usage more secure. Several components of intelligence can help to design and adjust the security solutions, if and only if the detection of security concern can be done. The prime goal of this thesis is to detect the possibility of attacks in security, identity management scenario and thereby suggesting suitable methods to protect the information of users. Hence, the perspective of computing intelligence and decision support system should be the ideal extension of the proposed measure in this thesis.

  Para virtualization . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.1.3 Hardware-assisted virtualization . . . . . . . . . . . . . . . . . . . . 2.2 Virtualization of hardware . . . . . . . . . . . . . . . . . . . . . . . . . . . . Scenario . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.2.2 Proposed model: Trusted based Reputation . . . . . . . . . . . . . . 9.2.3 Trust based Reputation model . . . . . . . . . . . . . . . . . . . . . 9.2.4 Fuzzification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.2.5 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.3 Proposed model with ant colony optimization . . . . . . . . . . . . . . . . .

2 Virtualization: The beginning 2.1 Virtualization techniques . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.1.1 Full virtualization . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.1.2 2.2.1 Processor virtualization . . . . . . . . . . . . . . . . . . . . . . . . . 2.2.2 Memory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . CONTENTS 9.2.1 9.3.1 Context . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.3.2 Background of the proposed computational intelligent agent based system . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.3.3 Modeling trust with ant colony system: mathematical perspectives .

  Cloudlet model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.6 VM Overlay in the Cloudlet architecture . . . . . . . . . . . . . . . . . . . . Service architecture for Sensor, Mobile and Cloud computing . . . . . . . . 8.1 Property based Token Attestation . . . . . . . . . . . . . . . . . . . . . . . 8.2 Property evidence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.3 Property based Token Attestation model . . . . . . . . . . . . . . . . . . . . 8.4 Overview message exchange of PTA protocol . . . . . . . . . . . . . . . . . 9.1 Master-Slave and Trusted Third Party model of Cloudlet . . . . . . . . . .

	LIST OF FIGURES
	7.4

1 Architecture de la machine virtuelle par rapport aux architectures Docker Container . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 Modèles de service du cloud computing . . . . . . . . . . . . . . . . . . . . 3 L'architecture MCC et ses parties prenantes importantes . . . . . . . . . . . 4 Modèle Server-Client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Modèle Cloud Virtuel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Modèle Cloudlet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Surcouche de VM dans l'architecture Cloudlet . . . . . . . . . . . . . . . . . 8 Simulation Elijah-cloudlet . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.1 Virtual Machine versus Docker Container architectures . . . . . . . . . . . 3.1 Service models of cloud computing . . . . . . . . . . . . . . . . . . . . . . . 3.2 MCC architecture and its important stakeholders . . . . . . . . . . . . . . . 3.3 Server-Client model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.4 Virtual Cloud model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.5 3.7 Elijah-cloudlet simulation . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.1 Trusted Platforms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.2 Proposed Trust based reputation model . . . . . . . . . . . . . . . . . . . . 9.3 Membership input functions of linguistic variables . . . . . . . . . . . . . . 9.4 Part of membership values for different types of membership range . . . . . 10.1 TRMSim-WSN configuration settings . . . . . . . . . . . . . . . . . . . . . 10.2 Performance of LFTM, PeerTrust and the Proposed Approach . . . . . . .

  Dans la virtualisation complète, le code source du système d'exploitation invité n'est pas modifié. Ainsi, lorsqu'il est exécuté, le système d'exploitation invité n'est pas conscient d'être virtualisé. La traduction binaire (BT) est utilisée pour émuler un petit ensemble

d'instructions, c'est-à -dire que des instructions privilégiées sont capturées et sensibles mais des instructions non privilégiées sont détectées puis traduites pour montrer une fausse valeur. Le reste des instructions est directement exécuté par le CPU hôte. Il existe deux types d'hyperviseurs qui gèrent la virtualisation complète. Le type 1 correspond à un hyperviseur natif ou autonome qui s'exécute directement sur le matériel. Type 2 est un hyperviseur qui s'exécute sur le système d'exploitation hôte (comme une application ordinaire). L'inconvénient de la virtualisation complète est que le VMM doit utiliser des

Table 1 :

 1

	Résumé de la thèse
		Containers	VMs
	Require	A host OS	A hypervisor of type 1 or type 2
		Images are lightweight (for ex-	A VM hosts a guest OS that is a
	Size of images	ample, basic Ubuntu image for	very big file (for example Ubuntu
		Docker containers has 180MB)	14.04.1 has more than 1GB).
			Independent-platform: a guest
	Platform dependency	Dependent-platform: the con-tainer is viewed as a bunch of processes vis-à -vis the host OS.	OS is hosted by a VM that is man-aged by a hypervisor. A guest OS is not aware of that and behaves as an OS that has total access to
			the physical resources.
		Migration is possible only if the
		source and the destination plat-
	Migration	forms are Linux based. Even if Docker container engine is pro-vided for Windows platform for example, this engine uses Linux-	Migration is suitable for VMs viewed as files easily migratable and manageable by a hypervisor.
		specific kernel features and re-
		quires a VM.

1, contrairement aux machines virtuelles qui dé pendent d'un hyperviseur, les conteneurs sont considérés comme des applications dans le système d'exploitation hôte. Par consé quent, comme indiqué dans

[START_REF] Felter | An Updated Performance Comparison of Virtual Machines and Linux Containers-IBM Research Report[END_REF]

, les performances offertes par l'utilisation de conteneurs sont meilleures que celles des machines virtuelles, ce qui est assez é vident puisque les conteneurs n'entraînent pratiquement aucune surcharge par rapport aux machines virtuelles. La table 1 présente la comparaison entre les conteneurs et les machines virtuelles en termes de taille des images, de dé pendance à la plate-forme et de migration. Difference between Containers and VMs Au cours des dernières années, le Cloud Computing est un domaine émergent qui affecte l'infrastructure informatique, les services réseau et les applications en fournissant un cadre tel que la population d'Amazon Web Service, de Window Azure et de Google App Engine. Le cloud computing est un élément tiers avec des serveurs de stockage à grande échelle et des centres de données utilisés pour fournir des infrastructures, des plates-formes de développement de logiciels et de distribution à faible coût dans la technologie informatique. L'avantage du Cloud Computing est venu avec trois grands modèles populaires qui sont offerts aujourd'hui en tant que services. La Figure 2 représente les modèles de service populaires dans l'environnement Cloud. Logiciel en tant que service (SaaS) SaaS ou logiciel à la demande est un modèle de distribution de logiciels permettant aux clients d'accéder à des logiciels spécifiques sur Internet tels que Google App, Office 360. En mode SaaS, le fournisseur est connu sous le nom de fournisseur SaaS hébergeant l'application Plate-forme en tant que service (PaaS) Alors que SaaS fournit les fonctions fixes, PaaS offre des interfaces de programmation d'applications (API) et un environnement de programmation sur lesquels les développeurs d'applications peuvent créer leurs propres applications et les héberger sur l'infrastructure du fournisseur PaaS. En fournissant des serveurs virtualisés et des services associés, le service PaaS permet à un utilisateur d'exécuter des applications existantes, ou de concevoir, développer, tester, déployer, déboguer et héberger des applications sur la plate-forme logicielle comme cadre de développement. En outre, l'élasticité et l'évolutivité de la plate-forme matérielle et logicielle sous-jacente sont garanties de manière transparente par la plate-forme PaaS pour l'application en cours d'exécution. Le fournisseur PaaS est responsable de la surveillance de la livraison des applications. Google Application Engine (GAE), Amazon Web Services et Microsoft Azure sont des exemples particuliers de PaaS.

  Résumé de la thèse basées sur le Cloud Computing peuvent être rapidement provisionnées et libérées avec un minimum d'efforts de la part des fournisseurs de services et de la gestion[START_REF] Weber | Internet of Things[END_REF]. Cependant, le Cloud Computing Mobile ne peut pas être simplement défini comme une fusion entre les technologies mobiles et le Cloud Computing. Il existe plusieurs définitions du Cloud Computing Mobile qui doivent être prises en compte avant d'examiner ses modèles et les problèmes de sécurité restants. Selon IBM, "Le Cloud Computing Mobile est une nouvelle plateforme combinant les appareils mobiles et le cloud computing pour créer une nouvelle infrastructure, par laquelle le Cloud effectue la partie lourde des tâches informatiques et

De nos jours, l'informatique mobile est une partie essentielle de la vie humaine qui rend la vie quotidienne plus commode et efficace indépendamment du temps et de l'endroit. En offrant de manière souple des services à la demande aux utilisateurs, les applications mobiles stock des quantités massives de données. Dans cette nouvelle architecture, le traitement et le stockage des données se font en dehors des appareils mobiles". De même, Cisco Internet Business Solutions Group (IBSG)

[START_REF] Taylor | Mobile Consumers Reach for the Clouds[END_REF]

définit le Cloud Mobile comme "des services mobiles et des applications livrés depuis un centre de données centralisé (et peut-être virtualisé) vers un appareil mobile, tel qu'un smartphone. Les clients accèdent à ces services à la demande en utilisant un navigateur ou un client léger sur leurs appareils mobiles. Ce qui contraste avec les clients "plus gros" qui sont téléchargés et résident (et s'exécutent) sur l'appareil mobile. Les services de Cloud mobile sont agnostiques au type d'appareil sur lequel ils s'exécutent". Une autre définition de Techopedia estime que : "Le cloud computing mobile est une technique ou un modèle dans lequel les applications mobiles sont construites, alimentées et hébérgées utilisant les technologies du Cloud Computing. Une approche cloud mobile permet aux développeurs de créer des applications conçues spécifiquement pour les utilisateurs mobiles sans être liés par le système d'exploitation mobile et la capacité de calcul ou de mémoire du smartphone. Le cloud computing mobile est généralement accessible via un navigateur mobile depuis un serveur web distant, typiquement sans avoir besoin d'installer une application client sur le téléphone destinataire". L'architecture MCC et ses partenaires importants sont représentés dans les figures 3a et 3b respectivement.

Part II Context and State of the Art Chapter 2 Virtualization: The beginning

	Chapter 2 recalls several virtualization techniques and compares the virtualization
	based on containers with virtual machines.
	♦ Chapter 3 introduces various definitions of mobile cloud computing, including its
	structures and related models.
	♦ Chapter 4 provides a survey of existing trusted platforms and figures out how they With the term "No Cloud without Virtualization", virtualization technology is widely
	are suitable for secure mobile-users in the context of mobile cloud computing. used to share the capabilities of physical computers by splitting the resources among
	operating systems. In 1964, the concept of virtual machines (VMs) is used in the IBM's
	♦ Chapter 5 addresses the security issues related to mobile cloud computing.
	project called CP/CMS system. The Control Program (CP) acted to split the physical
	♦ Chapter 6 describes a scenario for measuring trust and reputation which also consist machine to several copies (VMs), each copy with her own OS CMS. In 1974, Goldberg and
	of the state of the art of the corresponding literature related to computational Popek published a paper [16] which introduces a set of sufficient conditions for computer
	intelligence. architecture to efficiently support system virtualization. In 1999, the company VMware
	♦ Chapter 7 presents the first contribution by addressing the recent challenges of MCC presented its product VMware Virtual Platform for the x86-32 architecture 1 . In 2006, Intel
	in terms of energy and security under real case study and experimental work. and AMD proposed extensions to support virtualization. In this chapter, we will recall the
	basic principles of virtualization.
	♦ Chapter 8 exposes the second contribution by introducing a novel framework for
	attestation, namely Property based Token Attestation, in MCC. The performance,
	including energy consumption and security, is also analyzed here to make a comparison
	between the present model and related models.
	♦ Chapter 9 delivers the last contribution of the PhD work for the trust and reputation
	management in the context of multi-cloudlets.
	♦ Chapter 10 analyses the performance between the proposed models and the other
	contemporary models
	♦ Chapter 11 concludes and draws a summary of whole work and also presents the
	prime perspective of this work.

  2.1: Virtual Machine versus Docker Container architectures in table 2.1 present the comparison between the containers 3 and virtual machines in terms of size of images, platform dependency and migration.

	CHAPTER 2. VIRTUALIZATION: THE BEGINNING
	Chapter 3
		Containers	VMs
	Require	A host OS	A hypervisor of type 1 or type 2
		Images are lightweight (for ex-	A VM hosts a guest OS that is a
	Size of images	ample, basic Ubuntu image for	very big file (for example Ubuntu
		Docker containers has 180MB)	14.04.1 has more than 1GB).
			Independent-platform: a guest
	Platform dependency	Dependent-platform: the con-tainer is viewed as a bunch of processes vis-à-vis the host OS.	OS is hosted by a VM that is man-aged by a hypervisor. A guest OS is not aware of that and behaves as an OS that has total access to
			the physical resources.
		Migration is possible only if the
		source and the destination plat-
	Migration	forms are Linux based. Even if Docker container engine is pro-vided for Windows platform for example, this engine uses Linux-	Migration is suitable for VMs viewed as files easily migratable and manageable by a hypervisor.
		specific kernel features and re-
		quires a VM.
		Table 2.1: Difference between Containers and VMs

Table 4 .

 4

	1: Comparison of features of Trusted Platforms

Table 4 .

 4

2: Difference between pTPM and vTPM a. vTPM architecture: Berger et al.

[START_REF] Perez | vTPM: Virtualizing the trusted platform module[END_REF]

designed a vTPM architecture that enables a physical TPM run on systems running parallel multiple operating systems. In this architecture, the vTPM manager is responsible for multiplexing requests and creating a guest vTPM instance corresponding to its guest VM with configured TPM support.

  5, remote attestation is one of the im-portant functionalities provided by TPM, namely Binary Attestation (BA). Many authors have used the advantage of BA to prove the trustworthiness of their research objects such

	as platforms, applications, and agents [59; 60; 61]. In other hand, some researchers argue
	that this attestation mechanism has its own shortcomings, such as privacy, flexibility and
	scalability [46; 62; 63; 64]. For this reason, the literature [48; 63; 65] proposed Property-
	Based Attestation (PBA) which is established on Binary Attestation. This mechanism
	attests not only binary values but also security properties, functions or behavior of systems
	to overcome the limitation of BA. Based on this notation, Xin et al. [66] proposed a model

of PBA oriented to cloud computing that enables users to attest the security property of cloud service platform before exchanging data or performing tasks to the cloud. Another approach is to combine the certificate of Attestation Identity Key of TPM, which is delivered by Privacy Certificate Authorization and Secure Socket Layer certificate to form Platform Property Certificate as presented in

  Due to the limitation of resources, however, mobile devices are inadequately equipped with the sophisticated security solutions compare to converting computing devices. In this part of the PhD thesis, firstly, we present, in Chapter 7, the MCC models in real case study and then the new attestation schema is proposed to secure

	Chapter 7
	Mobile Cloud Computing: Real
	Case Study
	7.1 Introduction

the mobile users in BOYD's context as well as mobile cloud environment in Chapter 8. Last but not least, in order to assess the trust and reputation of involved entities in mobile cloud environment, we propose the novel trust based-reputation model through computational intelligence (i.e fuzzy logic and ant colony optimization) as presented in Chapter 9. Finally, we demonstrate the differences between the mentioned mechanism and other contemporary approaches in Chapter 10.

Although the spread of Mobile-Cloud model, using cloudlet architecture can be a better way to externalize applications from mobile devices. Hence, in this chapter, we firstly investigate the performance of the cloudlet based architecture over energy efficiency by examining different implementations, such as Open Service Gateway initiative (OSGi), Cloudlet Overlay and Containerization in section 7.2. Secondly, Droplock system, known as the demonstration of Mobile-Cloud model, is presented in section 7.3.

Table 7 .

 7 Even though Docker container engine 2 can be installed on Windows operating system, both the mobile device and the cloudlet operated under Linux-based OS

	The OSGi framework needs to be installed in both mobile device and cloud side. The
	mobile device has a service consumer which is used to handle interaction with mobile apps
	that import and consume remote service offered by the Cloud/Cloudlet servers. A service

provider has been installed on the Cloud/Cloudlet to implement and export services. For the mobile device, the OSGi framework is installed on an emulator with the following to run Docker containers. In Docker technology, the application is isolated within a container that is managed by a container engine within the mobile device. Instead of offloading the entire container to the cloudlet, that can be heavy (600 MB in our experiments) in size and energy consuming, we offload only the layer that hosts the application.

To compare the difference among these discussed cloudlet implementations, we consider 1: Size and execution time of the tested programs calculating the execution time locally by examining four different size of programs as presented in table 7.1. We then compare these programs under OSGi, Elijah and Docker platforms to measure their execution time. In this test, communication is established via Wi-Fi to access to the cloudlet server. Figure

7

.1 presents time in seconds for downloading and launching the overlay for Elijah, OSGi bundle and Docker layer.

  A set of Cloudlets S 1 , S 2 , ..., S n need to evaluate trust level; A set of quality of service QoS i for each S i including Availability (Av), Performance (Per) and Security parameter (SP); A set of reputation based user feedback R Si ∈ (R Si ...R Sk ) for S i ; Uncertainty value R U for unknown states, R U ∈ [0, 1]. Ouput: Trust value of each S i is recommended to the user. for each S i ∈ (S 1 , S 2 , . . . , S n ) do if S i is not registered as a cloudlet, S i = F alse then remove(S i ) else Compute reputation based feedback (equation 9.2) Compute a new R QoSi with (Av i , P er i , SP i ) (equation 9.3)if new_R QoSi < old_R QoSi then remove(S i ) endif Let R U = random() and compute T rust V alue (S i ) (equation 9.4) T rust V alue (S i ) = update(T rust V alue (S i )) endif endfor i=1;Highest is a value of the previous transaction, stored in the historical record while (T rust V alue (S i ) in List(T rust V alue (S i ))if T rust V alue (S i ) > Highest then Highest = T rust V alue (S i )

	ROAD MAP
	Algorithm 01: Trust and Reputation Evaluation Algorithm
	Input: endif
	i = i + 1
	endwhile
	Scale Recommend the highest value to the user Status	Av & Per R Si SP T rust V alue
	1 Stop	< 1	Very Poor (Vp)
	2	0.75 -1.75	Poor (Pr)
	3	1.5 -3.5	Acceptable (Ac)
	4	3.25 -4.5	Satisfactory (Sa)
	5	> 4.5	Highly Satisfactory (Hs)
		Table 9.1: Degree structure of certainty elements
	In the next section, we present how fuzzy logic system (FLS) and bio-inspired intelligence
	is used to calculate the trust based reputation for cloudlet with reasonably high-ranking
	accuracy. Generally, FLS is a rule based system [91], based on a mathematical model, that
	allows solving difficult simulated problems with variety input/output parameters. Coupled
	with the linguistic variables, we present how to mimic human decision making based on
	the fuzzy control rules. FLS begins with the process of converting the input crisp sets into
	fuzzy sets. It includes the membership functions and linguistic values, namely fuzzification.

Table 9 .

 9 2: Configuration of membership values

•

  Trust values to be measured are composite in nature. It signifies that multiple sources of trust values can be referred under specific set of constraints and finally a single value should be aggregated.• It is evident that the trust value is measured with appropriate time scale, however, the dynamic value of trust may demonstrate, same static value under subsequent time unit(s) and can undergo a minor change to next time unit (refer table9.3), in some cases the values did not change. For example, t5 and t4 are sample of instances with random distribution, it is not fixed as t4 and t5. It demonstrated the degree of randomness of trust under very small time instances.

	CHAPTER 9. TRUST AND REPUTATION FOR MOBILE CLOUD COMPUTING: A
	ROAD MAP
	the investigation of entropy of trust, we have followed this principle.
	Considering a cloudlet ecosystem which contains a number m of cloudlet meshes K i , i ∈
	(1, m). For each cloudlet mesh K i consists of a number n of cloudlets. The mathematical
	notations are:
	• Discrete interval scale is chosen (γ1, γ2, γ3, γ4, γ5) to represent the value of trust
	level and also testimonials of the expressed concepts of security of cloudlets (refers
	table 9.3).
	Considering these broader perspectives of trust and reputation, there will be certain typical
	mathematical components to quantify the foundation of term trust, which apparently is an
	abstract value.
	The thesis defines the following notations and expressions to obtain the approximate
	relative values of trust for given cloudlet under different set of constraints. However,
	to establish the proof of concept and to satisfy multiple and random data sources for
	trust and reputation, a suitable entropy domain should be defined. By definition, entropy
	refers to disorder or uncertainty, and the definition of entropy pivots on the measure of
	unpredictability of the state, or equivalently, of its average information content. During

• The composite scale of trust and time is based on the mathematical induction principle and thus a maximum and minimum value is determined. All the intermediate empirical values should be included in the scale.

• The trust values are relative as well as inductive: it signifies that the multiple logical imperatives are evaluated to satisfy the either maximum or minimum referred trust value.

• The inherent uncertainty of trust or reputation of cloudlet could persist with time scale or it can be any of the intermediate incident values. It must be noted that multiple data acquisition sources are referred to evaluate the trust value and by default it is approximate value.

• For given m numbers of cloudlet meshes the trust values also differ as T 1 . . . T m .

• From T 1 . . . T m the composition of trust is T 1 (AR 1 , E 1 , M E 1 ) and T m (AR m , E m , M E m ),

where AR represents Anticipated Reputation (The computed mean value of cloud drop due to various reasons. While expected value is real time value, anticipated value is desired predictive value. These values should be close, otherwise system tend to be unreliable), E defines Entropy, ME denotes Meta Entropy. With logical additive operation, it is expressed as T = T 1 ⊕ T m (logical operations are mentioned previously).

Table 9 . 3

 93

	Level of Trust	Status	Scale	Elapsed Time
	1	Near Confidence	γ1 = 0	t 5
	2	Low Confidence γ2 = 0.25	t 4
	3	Threshold	γ3 = 0.5	t 3
	4	High	γ4 = 0.75	t 4
	5	Peak Trust	γ5 = 1	t 5

: Trust evaluation under uncertainty calculated as it is only the approximation of reputation, and anticipated reputation is falling in between the trust value of the scale.

Algorithm 02: Pheromone Measure for Trust Algorithm Input: select

  cloudlet 1 . . . cloudlet n select Colony and map of colony to cloudlet. Applying the ant heuristic to generate an initial feasible solution for all colonies set an initial value of pheromone on every edge of colonies and cloudlet set service iteration number to 1 for each ant colony.

	While termination condition is not met do
	for each cloudlet parallel do
	for k = 1 to m ants do
	Construct solution and update pheromone (equations 9.20 & 9.21
	endfor
	if exchange of cloudlet information is equal to ∆, then evaluate equation 9.17
	improve the solution by local search Rt avg
	endif
	increment for next service iteration
	endfor
	endwhile
	Display the optimal value of affinity for Trust/Reputation
	Stop
	an abstract index, therefore the measured value will be analyzed statistically.

Table 10 .

 10 1: Computation cost mobile client (poor resource) and remote servers (rich resources), of those solutions. Thus, it is not evident to demonstrate the performance based security of mobile devices, which are considered as resource-constraint devices. In this step, we analyze the energy cost (in mJ) and execution time (in ms) of the client side by extracting data from [148]. Potlapally et al. measure a wide analysis on the expenses of launching symmetric and asymmetric cryptographic algorithms on a mobile device (HP IPAQ3670), which is equipped with Intel SA-1110 StrongARM processor clocked at 206 MHz, 64 MB SDRAM, 64 kB Cache, 950 mAh Li-On Battery and OS Linux. In our work, we extract only data related to RSA (1024), ECC (160) and Diffie-Hellman (DH), Elliptic Curve D-H (ECDH) key-exchange algorithms (refer table10.2). For hash operation, we take data from[START_REF] Rifà | Computational and Energy Costs BIBLIOGRAPHY of Cryptographic Algorithms on Handheld Devices[END_REF], that perform a similar work with Potlapally but measure SHA-256 instead of SHA-1. Thus, we have

	Approach

Table 10 .

 10 2: Energy cost of asymetric algorithms 728mJ for hashing 1MB data in 1000ms. To reduce the complexity, we calculate an average value of each algorithm to figure out T RSA , T ECC , T eDH and T eECC . For example, Similarly, we have T ECC ≈ 186(mJ), T eDH ≈ 961(mJ) and T eECC ≈ 220(mJ). Consequently, table 10.3 presents the performance consumption based security for the mobile device of mentioned approaches in table 10.1.

	(10.2)	T RSA =	Key generation + Sign + V erif y 3	≈ 860(mJ)
	Reddy et al. [67]	Memon et al. [146]	Mun et al.[145]	Le al.[147]	et	Zhao et al.[144]	Proposed Approach
	10T H + 3T ECC	10T H		5T H 1T ECC	+	7T H 2T ECC	+	7T H 1T eECC	+	3T H + 4T RSA + 1T eDH
	7838(mJ) 7280(mJ)		3826(mJ) 5468(mJ) 5316(mJ)	6585(mJ)

Table 10 .

 10

3: Performance consumption based security (mJ)

  : number of accepted job N req : number of submitted job SP: Security level of each resource (i.e cloudlet) InputdegreeC -: correct negative opinions which entity (i.e cloudlet) taken from other entities (i.e cloudlets, users) InputdegreeC + : correct positive opinions which entity (i.e cloudlet) taken from other entities (i.e cloudlets, users) Throughput(Per): the performance of a cloudlet Table11.1: Dataset[START_REF] Yoon | CRAWDAD dataset wisc/wiscape (v.2012-08-03)[END_REF],[2]

	Resource No A req N req	SP	Input degreeC -	Input degreeC + Throughput(Per)
	01	12	18	0.0781 28	3	838.62
	02	15	21	0.648 94	83	833.85
	03	13	24	0.1825 80	2	840.95
	04	14	19	0.621 33	37	868.95
	05	13	23	0.756 74	17	1032.12
	06	14	22	0.246 57	50	822.78
	07	18	21	0.0891 1	50	836.79
	08	14	20	0181	42	87	814.54
	09	14	25	0.537 2	57	838.53
	10	15	23	0.835 79	17	860.47
	11	14	20	0.475 99	91	809.86
	12	18	22	0.646 69	67	866.52
	13	15	25	0.055 78	50	810.15
	14	15	19	0.552 60	83	860.14
	15	17	19	0.421 28	29	832.17
	16	14	19	0.151 75	88	813.17
	17	14	20	0.995 70	53	811.21
	18	17	23	0.861 44	9	857.94
	19	14	23	0.842 42	48	843.59
	20	14	19	0.847 15	32	825.95
	A

req

ACKNOWLEDGEMENTS

Dans les solutions basées sur la virtualisation, la planification de l'hyperviseur fonctionne à deux niveaux, comme expliqué ci-dessous. La première planification se produit au niveau de l'hyperviseur où les machines virtuelles sont planifiées et le second au niveau de la machine virtuelle où le système d'exploitation invité planifie les processus. En prenant cela en compte, il est évident que cette approche crée un surcoût significatif. Une autre approche de virtualisation, basée sur des conteneurs, a été proposée pour réduire significativement ce surcoût, et ainsi fournir de meilleures performances, notamment en termes d'élasticité et de densité au sein d'un data center faible.ConteneursDans la virtualisation basée sur conteneur, la planification se produit uniquement à un niveau. Les conteneurs contiennent des processus, tandis que le noyau et les bibliothèques sont partagés entre les conteneurs. Par conséquent, le planificateur est utilisé uniquement pour planifier les processus. Le comportement est similaire à un système d'exploitation classique; la seule différence est que, dans la virtualisation par conteneur, les processus sont

https://github.com/cmusatyalab/elijah-cloudlet

https://www.geany.org/

http://www.cisco.com/assets/sol/sp/vni/forecast highlights mobile/

VMWare Inc, Introducing vmware virtual platform, technical white paper(February 1999)

https://www.vmware.com/techpapers/2007/understanding-full-virtualization-paravirtualizat-1008.html

https://docs.docker.com/installation/windows/

https://www.ibm.com/blogs/cloud-computing/2013/06/mobile-cloud-computing/

https://www.techopedia.com/definition/26679/mobile-cloud-computing-mcc

https://github.com/cmusatyalab/elijah-cloudlet

https://www.geany.org/

https://www.trustedcomputinggroup.org/wp-content/uploads/TCG_Glossary_Board-Approved_12.13.2012.pdf

https://www.globalplatform.org/specifications.asp

https://nfcforum.org/

https://developer.android.com/guide/topics/connectivity/nfc/hce.html

http://simalliance.org/

https://www.globalplatform.org/mediaguidetee.asp

https://www.trustonic.com/

https://www.globalplatform.org/mediaguidetee.asp

https://www.cisco.com/c/en/us/about/press/internet-protocol-journal/back-issues/table-contents-57/153-internet.html

Virtual Trusted Platform-XEN. http://wiki.xenproject.org/wiki

https://xenbits.xen.org/docs/unstable/man/xen-vtpm.7.html

https://www.globalplatform.org/mediaguidetee.asp

https://wiki.linaro.org/WorkingGroups/Security/OP-TEE

https://globalplatform.org/specifications.asp

https://trustedcomputinggroup.org/tcg-storage-architecture-core-specification/

http://www.wolfram.com/

https://www.systutorials.com/docs/linux/man/1-xdelta3/

https://www.docker.com/what-container

https://trustedcomputinggroup.org/tpm-main-specification/

http://www.infoworld.com/article/2871290/cloud-computing/understanding-cloudstoragemodels.html

https://pypi.python.org/pypi/nepho

http://www.dataset12.expertcloud.ir/

Acknowledgements

LIST OF TABLES

The overall of this approach has described as the following: first, the user is aware of receiving a product and uses his mobile phone to authorize the delivery office to access to his mailbox, thanks to an android application that interacts with a cloud application.

He obtains, by his smartphone, a virtual key from this cloud application. Then, the same Android mobile device makes a Bluetooth connection with the arduino board hosted within the box. As a result, a communication is made between the arduino board and this mobile device. Third, the mobile device presents the virtual key received from the cloud and gives this key to the arduino board. Then, the smartphone sends a notification to the cloud and thus, the cloud informs the delivery man and sends him the key to his smartphone.

When the delivery man needs to access to the secure mailbox to deliver the product, he uses his Android mobile device to connect to arduino board by providing the key. The arduino board compares the key presented by the delivery man, and the one given by the owner of the mailbox. If they are equal, the arduino board unlocks the mailbox.

The delivery man deposits the product, closes the door of the mailbox and informs the CHAPTER 8. PROPERTY BASED TOKEN ATTESTATION : A NOVEL FRAMEWORK

because we assume that there is only one correspondence between the public and the private keys, P ′ KAIK has the correspondence only with private key S ′ KAIK . We here ignore the fact that multiple public keys can be associated with one private key, because it is a very rare case. So, R now knows V ID , N V , T V . But knowing only these values does not fulfil the purpose of R, because it does not yet know original M ID , N M , T M . It even does not know P KAIK of M. So, R cannot be able to compromise the message in flow 1.

8. Now R poses as V to the original M and therefore sends the following to M: R to M: ((

KAIK

When M tries to decrypt the message using its secret key S KAIK , the combination of S KAIK and P ′ KAIK will not match, thereby producing a garbage value. But, as M does not know V ID , N V , T V , M will not be able to identify whether the message has come from R, after decrypting the message with S KAIK . M:

Again, M calculates the value of Hash function in reverse way

with its own M ID , N M .

M:

Now, M is sure that the message did not come from the original V. So, M discards the message and does not establish connection with V and TTP in this session. Thus,

CHAPTER 8. PROPERTY BASED TOKEN ATTESTATION : A NOVEL FRAMEWORK

Man in the Middle attack also could not occur in case 2. Therefore, message in flow 1 is not vulnerable to Man-in-the-Middle attack.

R: ((P CR

As, R does not have the secret key S KT T P of TTP, R cannot be able to decrypt the message. Now, R tries to build the message generating M ′ ID (which may be a valid ID), P CR ′ , M L ′ , P i ′ , N ′ M . R may know V ID (as shown previously). R has its own secret key S ′ KAIK and may know the value of (Hash

10. R to TTP:

11. TTP:

ID has public key P ′ KAIK and secret key

TTP: Corresponding to M ′ ID , we assume that the corresponding ML that is stored in TPM is ML1 and from ML1, the obtained PCR value is PCR1. [ If R knows a valid M ′ ID , it is not possible for it to know the corresponding ML and PCR value, that are stored securely in TPM. Also, the property Pi' of R will not match with one in PL corresponding to M ′ ID that is held by TTP. Let the original property of device

Security Discussion

To address the common threats in section 8.2.2, we analyze the security of our proposed protocol while using Scyther tool for verification of security protocol. In this part, we discuss the following security concerns.

1. Security based hardware. To lessen the well-known vulnerability with regard to the resource-constraint, each TPM is equipped with a special set of registers (PCRs)

and cryptography unit which is a couple of public/private key pair (RSA) at manufacturing time. This can provide security functions like secure storage, attestation of platform state and identity by performing cryptographic algorithms of encrypting, authenticating and attesting data. The mobile users can take advantage of benefits of TPM's functionality, especially the remote attestation, as a virtual anti-virus application (Threat 1 ). Furthermore, the design of TPM is to offer hardware protection for cryptographic keys. It means that the private part of key pair is stored in the Non-Volatile memory of TPM; and never leaves the TPM. As a result, the secret still remains safe even if the system is compromised like Rooting/Jailbreaking (Threat 4 ).

2. Software Token. In our work, security and privacy depend mainly on the proposed Token. This token defines the security policy for its owner by either the quantity of random property or matched properties (Pi). It prevents malicious application/user to use a valid token to access enterprise data illegally (Threats 2 and 3 ). To obtain a valid token, the client application has been examined to get its own appropriate confidence level. The user is only permitted to access enterprise data with limited privilege. In addition, depending on the policy of the enterprise, the finite time (T) of token is set for each access session. This turns the token into One Time Ticket to access specific data in a specific environment for preventing damage of malware (Threat 3 ). , and the confidence of association rule is the [133; 134]. Where n(X) is the number of transactions and N is the total of the transaction in database. X and Y are item-sets which contain different attributes. A and B are the fuzzy sets associated with the corresponding attributes in X and Y. For example, considering the pairs of attribute and value as: (Performance, Very Poor), (Security, Poor) or (Availability, Acceptable).

Depending on the internal policy of cloud/cloudlet, the particular attributes are considered to generate the rules. Here, we consider, for example, Time, Property and HT T P Get are the members of attribute set of a specific cloud/cloudlet. The association rule is presented as the following:

"IF [(Time is Low) and (Property(i) is Small) and (HT T P

Where O(i) represents the status of the participating clients such as Trust, Not-trust or Safe, Unsafe. Hence, for each fuzzy association rule, the weight ω, which is assigned to

Appendix A

The cloudlet is considered as resource-rich, well-connected and powerful computer installed in the public infrastructure with the connectivity to Cloud server. It can be implemented thanks to Wi-Fi hotspot servers. Thus, a cloudlet also inherits the features of the Cloud in term of Quality of Service, security. In this work, we extract the data from the dataset of Expert Cloud 1 , which is a new class of cloud systems to search trustworthy entities in order to benefit from their knowledge and skills [START_REF] Mrabet | A new trust evaluation approach for cloud computing environments[END_REF]. To simplify, we only take A req (number of accepted jobs), N req (number of submitted jobs ), SP (Security Parameter), the correct negative/positive opinions which entity takes from the others (InputdegreeC - /InputdegreeC + ) (refer table 11.1). Another key fact is that the cloudlet is notably useful for the proximate mobile device to distribute its workload while ensuring low delay and high bandwidth. For this reason, we use another dataset from [START_REF] Yoon | CRAWDAD dataset wisc/wiscape (v.2012-08-03)[END_REF] which measures the throughput when downloading a 1MB file over a Wi-Fi hotspot. For example, we take a row 1 to adapt to the mentioned formulas 9.2 & 9.3. We have: