41933588
Trusted Component Sharing by Runtime Test and Immunization for Survivable Distributed Systems
As information systems became ever more complex and the interdependence of these systems increase, the survivability picture became more and more complicated. The need for survivability is most pressing for mission-critical systems, especially when they are integrated with other COTS products or services. When components are exported from a remote system to a local system under different administration and deployed in different environments, we cannot guarantee the proper execution of those remote components in the currently working environment. Therefore, in the runtime, we should consider the component failures (in particular, remote components) that may either occur genuinely due to poor implementation or the failures that occurred during the integration with other components in the system. In this paper, we introduce a generic architecture and mechanisms for dynamic component-failure detection and immunization for survivable distributed systems. We have also developed a prototype system based on our approaches as a proof of our ideas.
14631475
RBAC on the Web by Secure Cookies
Current approaches to access control on Web servers do not scale to enterprise-wide systems, since they are mostly based on individual users. Therefore, we were motivated by the need to manage and enforce the strong access control technology of RBAC in large-scale Web environments. Cookies can be used to support RBAC on the Web, holding users’ role information. However, it is insecure to store and transmit sensitive information in cookies. Cookies are stored and transmitted in clear text, which is readable and easily forged. In this paper, we describe an implementation of Role-Based Access Control with role hierarchies on the Web by secure cookies. Since a user’s role information is contained in a set of secure cookies and transmitted to the corresponding Web servers, these servers can trust the role information in the cookies after cookie-verification procedures and use it for role-based access control. In our implementation, we used CGI scripts and PGP (Pretty Good Privacy) to provide security services to secure cookies. The approach is transparent to users and applicable to existing Web servers and browsers.
17152003
WLAN Security: Current and Future
Wireless LAN deployment improves users' mobility, but it also brings a range of security issues that affect emerging standards and related technologies.
17648841
Role-based access control on the web
Current approaches to access control on the Web servers do not scale to enterprise-wide systems because they are mostly based on individual user identities. Hence we were motivated by the need to manage and enforce the strong and efficient RBAC access control technology in large-scale Web environments. To satisfy this requirement, we identify two different architectures for RBAC on the Web, called user-pull and server-pull. To demonstrate feasibility, we implement each architecture by integrating and extending well-known technologies such as cookies, X.509, SSL, and LDAP, providing compatibility with current web technologies. We describe the technologies we use to implement RBAC on the Web in different architectures. Based on our experience, we also compare the tradeoffs of the different approaches.
42838112
Trusted Identity and Session Management Using Secure Cookies
The concept of federated identity management is increasingly coming to use in order to bring Service Providers closer to customers. Users are being provided an enriched experience while carrying out business on the Web at reduced overhead and improved customer service. The idea of maintaining a single profile and gaining access to multiple services has been accepted well by the customers. However, the benefits of breaking through just one set of credentials to gain access to multiple services has made the concept of Federated Identity Management of high interest to malicious users. In this paper, we analyze the structure of a generic Federated Identity Management System and explore the .NET Passport framework in depth. We explore the current security mechanisms adopted by the .NET Passport and identify potential security weaknesses. We then propose our new approaches to enhance the security services in .NET Passport by using Secure Cookies. Our approaches are transparent to and compatible with the current .NET Passport server. Finally, we prove the feasibility by implementing our ideas in a real system.
18041119
Component integrity check and recovery against malicious codes
With the rise in usage of software components in distributed computing applications, the importance of safeguarding these components has assumed great significance. In trying to ensure the survivability of these components, we enable a mission-critical application to detect malicious codes in a component downloaded from a remote location and recover the original functionality of the compromised component. In our work, we use digital signatures to ensure the integrity of software components in a large distributed system. By detecting unauthorized add-ons to the original components we can ensure that only legitimate software components are allowed to execute in a protected software environment. We also explore techniques to recover the original functionality of the component under attack by removing the affected portion from the component. In this paper we introduce the system architecture and the support mechanisms for our proposed approaches
3768369
Efficient Data Mining for Path Traversal Patterns
The authors explore a new data mining capability that involves mining path traversal patterns in a distributed information-providing environment where documents or objects are linked together to facilitate interactive access. The solution procedure consists of two steps. First, they derive an algorithm to convert the original sequence of log data into a set of maximal forward references. By doing so, one can filter out the effect of some backward references, which are mainly made for ease of traveling and concentrate on mining meaningful user access sequences. Second, they derive algorithms to determine the frequent traversal patterns-i.e., large reference sequences-from the maximal forward references obtained. Two algorithms are devised for determining large reference sequences; one is based on some hashing and pruning techniques, and the other is further improved with the option of determining large reference sequences in batch so as to reduce the number of database scans required. Performance of these two methods is comparatively analyzed. It is shown that the option of selective scan is very advantageous and can lead to prominent performance improvement. Sensitivity analysis on various parameters is conducted.
14381469
Using lexical similarity in handwritten word recognition
Recognition using only visual evidence cannot always be successful due to limitations of information and resources available during training. Considering relation among lexicon entries is sometimes useful for decision making. In this paper we present a method to capture lexical similarity of a lexicon and reliability of a character recognizer which serve to capture the dynamism of the environment. A parameter, lexical similarity, is defined by measuring these two factors as edit distance between lexicon entries and separability of each character's recognition results. Our experiments show that a utility function considering lexical similarity in a decision stage can enhance the performance of a conventional word recognizer.
16063217
Dynamic Bit-width Adaptation in DCT: Image Quality versus Computation Energy Trade-off
We present a dynamic bit-width adaptation scheme in DCT applications for efficient trade-off between image quality and computation energy. Based on sensitivity differences of 64 DCT coefficients, various operand bit-widths are used for different frequency components to reduce computation energy in DCT operation. Numerical results show that our DCT architecture can achieve power savings ranging from 36 % to 75% compared to normal operation
6256815
Cryptanalysis of the Public-Key Encryption Based on Braid Groups
At CRYPTO 2000, a new public-key encryption based on braid groups was introduced. This paper demonstrates how to solve its underlying problem using the Burau representation. By this method, we show that the private-key can be recovered from the public-key for several parameters with significant probability in a reasonable time. Our attack can be mounted directly on the revised scheme mentioned at ASIACRYPT 2001 as well. On the other hand, we give a new requirement for secure parameters against our attack, which more or less conflicts with that against brute force attack.
16813459
Scenario-based multitasking for real-time object-oriented models
Abstract Contemporary embedded systems quite often employ extremely complicated software consisting of a number of interrelated components, and this has made object-oriented design methodologies widely used in practice. To implement an object-oriented model in given target hardware, it is imperative to derive a set of tasks from the designed objects. This process of determining tasks and the events they handle greatly influences the real-time performance of the resultant system including response times and real-time guarantees. However, the innate discrepancies between objects and tasks make this exceedingly difficult, and many developers are forced to find their task sets through trial and error. In this paper, we propose Scenario-based Implementation Synthesis Architecture (SISA), an architecture consisting of a method for deriving a task set from a given object-oriented model and the development tools and run-time system architecture to support the method. A system developed with SISA guarantees the optimal response time for each event while deriving the smallest possible number of tasks. We have fully implemented SISA by extending the RoseRT development tool and applied it to an existing industrial PBX (private branch exchange) system. The experimental results show that SISA outperforms the best known conventional techniques by reducing maximum response times an average of 30.3%.