Browse Books

Reviewer: Martin William Sachs

Ubiquitous computing is a vision of a world filled with millions, or billions, of intercommunicating small processors, powering everything conceivable, from kitchen appliances, to automotive engine computers, to smart cards, to cellular phones. Today, many of these processors are so small and underpowered (the author calls them peanut processors) that normal computer security techniques, such as public-key encryption, cannot be used with them. Stajano’s book is an introduction to computer security for technical people. It focuses on the unique challenges imposed by the world of ubiquitous computing. The book begins with an overview of ubiquitous computing. Security is a major issue for ubiquitous computing, because just about any device that contains a processor may hold or convey information that is of interest to an adversary. The security topics covered in the book are confidentiality (including a discussion of various digital encryption approaches), integrity, availability, authentication, and anonymity. The emphasis is on the cryptology mechanisms used to achieve security. Privacy issues are discussed extensively, although in the introduction the author points out that there is little difference between privacy and confidentiality. While this is true from a technology viewpoint, the author has missed the point that an important component of privacy is privacy policy: what a service provider promises about guarding the confidentiality of private information. This does not have a technological solution, since the service provider is in control of its technology. The author warns that ubiquitous computing has the potential to turn into ubiquitous surveillance. This has a direct bearing on privacy policy issues. An appendix discusses existing security solutions. The book would have benefited from inclusion of a survey of the current work on security in standards bodies such as the World Wide Web Consortium and OASIS. This ongoing work includes XML encryption, XML digital signatures, access control, key management, and privacy policies. Much of this work will be relevant to ubiquitous computing. The author has an interesting way of drawing on totally unrelated domains of knowledge to make his points clear. For example, he uses the analogy of a newly hatched duckling bonding to its mother to help explain how a device can be associated with its owner. Overall, the book conveys a large amount of information in a light, highly readable, style, which requires minimal prior knowledge of security matters. Online Computing Reviews Service