Security 191
solutions have imposed themselves on the market, depending on the
requirements. For example, only the message headers can be fed back,
which dramatically reduces the flows to be examined, but brings with
it the risk of missing encapsulated bits.
The second example is that of firewalls. Once again, the world of
Cloud computing fundamentally changes these modules, deporting
their software to datacenters with numerous advantages. The first
advantage is to have specialized virtual firewalls for each application.
With DPI, we detect the nature of the application and send the flow in
question to the corresponding firewall. The firewall has processing
capability to examine all details of the flow. The low-powered firewall
dealing with all flows is replaced by a set of very powerful,
specialized firewalls. The disadvantage relates to the flows, which
need to be sent to the specialized firewall and must then be returned to
the company, although there is the possible advantage of being able to
hide firewalls in order to prevent denial-of-service attacks on them.
The third example is a secure element server which, as we shall see
in this chapter, can be used to secure access to sensitive services such
as mobile payment. These secure-element servers can contain
thousands, or even millions, of secure elements such as smartcards,
which may be reached by secure channels requiring high-security
services.
Also, for inclusion in the Cloud of security, we could cite
numerous servers such as authentication servers, identity management
servers, encoding servers (although these have the peculiarity of
having to be very near to the user), intrusion detection servers, etc.
7.1. Secure element
Strictly speaking, this chapter does not discuss security in the
conventional sense at all, but rather a new generation which has
gradually been being established over the past few years. This new
generation uses secure elements as a basis. Indeed, high security
cannot be satisfied simply by software, which can always be broken
by a memory dump and good knowledge of the position of the keys
www.it-ebooks.info
solutions have imposed themselves on the market, depending on the
requirements. For example, only the message headers can be fed back,
which dramatically reduces the flows to be examined, but brings with
it the risk of missing encapsulated bits.
The second example is that of firewalls. Once again, the world of
Cloud computing fundamentally changes these modules, deporting
their software to datacenters with numerous advantages. The first
advantage is to have specialized virtual firewalls for each application.
With DPI, we detect the nature of the application and send the flow in
question to the corresponding firewall. The firewall has processing
capability to examine all details of the flow. The low-powered firewall
dealing with all flows is replaced by a set of very powerful,
specialized firewalls. The disadvantage relates to the flows, which
need to be sent to the specialized firewall and must then be returned to
the company, although there is the possible advantage of being able to
hide firewalls in order to prevent denial-of-service attacks on them.
The third example is a secure element server which, as we shall see
in this chapter, can be used to secure access to sensitive services such
as mobile payment. These secure-element servers can contain
thousands, or even millions, of secure elements such as smartcards,
which may be reached by secure channels requiring high-security
services.
Also, for inclusion in the Cloud of security, we could cite
numerous servers such as authentication servers, identity management
servers, encoding servers (although these have the peculiarity of
having to be very near to the user), intrusion detection servers, etc.
7.1. Secure element
Strictly speaking, this chapter does not discuss security in the
conventional sense at all, but rather a new generation which has
gradually been being established over the past few years. This new
generation uses secure elements as a basis. Indeed, high security
cannot be satisfied simply by software, which can always be broken
by a memory dump and good knowledge of the position of the keys
www.it-ebooks.info