5116030
Automated Recovery in a Secure Bootstrap Process
Integrity is rarely a valid presupposition in many systems architectures, yet it is necessary to make any security guarantees. To address this problem, we have designed a secure bootstrap process, AEGIS, which presumes a minimal amount of integrity, and which we have prototyped on the Intel x86 architecture. The basic principle is sequencing the bootstrap process as a chain of progressively higher levels of abstraction, and requiring each layer to check a digital signature of the next layer before control is passed to it. A major design decision is the consequence of a failed integrity check. A simplistic strategy is to simply halt the bootstrap process. However, as we show in this paper, the AEGIS bootstrap process can be augmented with automated recovery procedures which preserve the security properties of AEGIS under the additional assumption of the availability of a trusted repository. We describe two means by which such a repository can be implemented, and focus our attention on a network-accessible repository.
642671
A secure and reliable bootstrap architecture
In a computer system, the integrity of lower layers is typically treated as axiomatic by higher layers. Under the presumption that the hardware comprising the machine (the lowest layer) is valid, the integrity of a layer can be guaranteed if and only if: (1) the integrity of the lower layers is checked and (2) transitions to higher layers occur only after integrity checks on them are complete. The resulting integrity "chain" inductively guarantees system integrity. When these conditions are not met, as they typically are not in the bootstrapping (initialization) of a computer system, no integrity guarantees can be made, yet these guarantees are increasingly important to diverse applications such as Internet commerce, security systems and "active networks". In this paper, we describe the AEGIS architecture for initializing a computer system. It validates integrity at each layer transition in the bootstrap process. AEGIS also includes a recovery process for integrity check failures, and we show how this results in robust systems.
10989722
Practical Problems with a Cryptographic Protection Scheme
Z is a software system designed to provide media-transparent net- work services on a collection of UNIX® machines. These services are comprised of file transfer and command execution; Z preserves file own- ership on remote transfer, and more significantly, owner and group iden- tity when executing commands remotely. In order to secure known vulner- abilities in the system, enhancements were made. In particular, a cryptographically-derived checksum was added to the messages. After the initial implementation of the checksumming scheme, several iterations of performance improvement occurred. The result was unsatisfactory to the user community, so the checksum was removed. Instead, vulnerabilities were reduced by improved monitoring and maintenance procedures.
33249562
The Transfusion Medicine Tutor: Using Expert Systems Technology to Teach Domain-Specific Problem-Solving Skills
This study provides data regarding the effectiveness of the expert system-based Transfusion Medicine Tutor (TMT) when used by medical technology students to learn an important problem-solving task, the identification of alloantibodies in a patient's blood for the purpose of finding compatible blood for transfusion. The results show that the students who were taught by an instructor using TMT to provide the instructional environment went from 0% correct on a pre-test case to 87%–93% correct on post-tests (N=15). This compares with an improvement rate of 20% by a control group (N=15) who used a passive version of the system with the tutoring functions turned off. The results also demonstrate the importance of relying on objective performance data rather than questionnaire data to evaluate systems, as there was no difference in the subjective responses of the students to these two different versions of the system.
41376288
Instruction Level Distributed Processing
Within two or three technology generations, processor architects will face a number of major challenges. Wire delays will become critical, and power considerations will temper the availability of billions of transistors. Many important applications will be object-oriented, multithreaded, and will consist of many separately compiled and dynamically linked parts. To accommodate these shifts in both technology and applications, microarchitectures will process instruction streams in a distributed fashion - instruction level distributed processing (ILDP). ILDP will be implemented in a variety of ways, including both homogeneous and heterogeneous elements. To help find run-time parallelism, orchestrate distributed hardware resources, implement power conservation strategies, and to provide fault-tolerant features, an additional layer of abstraction - the virtual machine layer - will likely become an essential ingredient. Finally, new instruction sets may be necessary to better focus on instruction level communication and dependence, rather than computation and independence as is commonly done today.
14058785
ImpACT: An Alternative to Technology Readiness Levels for Commercial-Off-The-Shelf (COTS) Software
The use of Technology Readiness Levels (TRLs) as a tool in assessing acquisition and development program risk has steadily increased over the past several years. There is considerable evidence to support the utility of using TRLs as part of a risk assessment, but there are some difficulties in using TRLs with software, especially Commercial-Off-The-Shelf (COTS) software technology and products. These difficulties take several forms, including “blurring-together” various aspects of COTS technology/product readiness; the absence of some important aspects of readiness; COTS product “decay;” and no mechanism to account for changes in the relative importance of the contributors to technology/product readiness over time. This paper briefly examines these issues, and proposes an alternate methodology—ImpACT—for assessing COTS software technology and product readiness which considers these factors.
1278902
Conceptual modeling of audio-visual content
The explosive growth of applications involving digital audio-visual material is driving the need for more rich content description. The authors present a design process for audio-visual content description. The process involves constructing a conceptual model in which entities, attributes and relationships important for content description are identified and modeled. The procedure provides special handling of different types of spatio-temporal relationships important for audio-visual content modeling. The authors describe the audio-visual content description conceptual modeling methodology in the context of the MPEG-7 description schemes.
14227060
Visualization of design knowledge component relationships to facilitate reuse
Within the software development process, reuse at the requirements level has become an increasingly more compelling notion. Following a human-centric approach, this work focuses on both requirements and design solution reuse using a design knowledge repository. In recent years, many improvements have been made to increase reuse through design knowledge repositories, but retrieval of knowledge in the context of design activities continues to be a formidable challenge. We propose a new system, called CERVi, to browse a repository through visualization by exploiting relationships between units of knowledge (in our case, claims). These relationships are key to finding the most appropriate reusable knowledge based on design conditions. Testing shows that CERVi enhances the design knowledge selection process and helps users proceed through structured design decision making. Our approach would be most useful to those interested in unlocking the potential of design knowledge reuse.