首页 > 最新文献

2012 ASE/IEEE International Conference on BioMedical Computing (BioMedCom)最新文献

英文 中文
S*FSM: A Paradigm Shift for Attack Resistant FSM Designs and Encodings S*FSM:抗攻击FSM设计和编码的范式转换
Pub Date : 2012-12-14 DOI: 10.1109/BIOMEDCOM.2012.22
M. Borowczak, R. Vemuri
While hardware design focuses on creating minimally-sized circuits, this paper proposes that security-centric designs require a departure from this mentality. The need for built-in protection mechanisms at all levels of design is paramount to providing cost-effective secure systems. We focus on the high-level design of sequential circuits by targeting Finite State Machines (FSMs) and their vulnerability to non-invasive, side channel based, attacks. The unconventional paradigm shift needed is justified by showing that conventional, minimalism-based, FSM synthesis and encodings allow direct correlation between state/transitions and Hamming Models. A two-fold method, involving structural modifications and specific encoding strategies, is proposed for side-channel secure FSM (S*FSMs). Preliminary high-level simulations show the effectiveness and potential for security driven S*FSM synthesis methods to mitigate the relationship between attack models and underlying hardware implementations.
虽然硬件设计的重点是创建最小尺寸的电路,但本文提出以安全为中心的设计需要摆脱这种心态。在所有级别的设计中都需要内置保护机制,这对于提供具有成本效益的安全系统至关重要。我们专注于顺序电路的高级设计,针对有限状态机(FSMs)及其对非侵入性,基于侧信道的攻击的脆弱性。通过显示传统的、基于极简主义的、FSM合成和编码允许状态/转换与汉明模型之间的直接关联,证明了所需的非常规范式转换是合理的。针对侧信道安全FSM (S*FSMs),提出了一种包含结构修改和特定编码策略的双重方法。初步的高级仿真显示了安全驱动的S*FSM综合方法的有效性和潜力,以减轻攻击模型和底层硬件实现之间的关系。
{"title":"S*FSM: A Paradigm Shift for Attack Resistant FSM Designs and Encodings","authors":"M. Borowczak, R. Vemuri","doi":"10.1109/BIOMEDCOM.2012.22","DOIUrl":"https://doi.org/10.1109/BIOMEDCOM.2012.22","url":null,"abstract":"While hardware design focuses on creating minimally-sized circuits, this paper proposes that security-centric designs require a departure from this mentality. The need for built-in protection mechanisms at all levels of design is paramount to providing cost-effective secure systems. We focus on the high-level design of sequential circuits by targeting Finite State Machines (FSMs) and their vulnerability to non-invasive, side channel based, attacks. The unconventional paradigm shift needed is justified by showing that conventional, minimalism-based, FSM synthesis and encodings allow direct correlation between state/transitions and Hamming Models. A two-fold method, involving structural modifications and specific encoding strategies, is proposed for side-channel secure FSM (S*FSMs). Preliminary high-level simulations show the effectiveness and potential for security driven S*FSM synthesis methods to mitigate the relationship between attack models and underlying hardware implementations.","PeriodicalId":146495,"journal":{"name":"2012 ASE/IEEE International Conference on BioMedical Computing (BioMedCom)","volume":"41 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-12-14","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126171322","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 13
READ -- A Resolution and Abduction Based Approach for Policy Comparison in Organizational Collaboration READ——一种基于决议和溯因的组织协作政策比较方法
Pub Date : 2012-12-14 DOI: 10.1109/BIOMEDCOM.2012.24
Xiaofeng Xia
The policy compliance problem is one of the categories of inconsistency problems existing between access control policies. One of the ways to cope with it is called policy comparison. In this paper we develop and use our approach to perform policy comparison, i.e. when newly specified access control policies for the resources are provided to be compared with certain original policy, we are able to ensure that the noncompliance problem between these newly specified policies and the original policies on the resources will be found. In this paper we propose the READ (Resolution and Abduction based) algorithm to be an approach of finding policy noncompliance. Our approach is based on the resolution and abduction work for Data log rules, and the evaluation of compliance is performed through set implication by Satisfiability Modulo Theories (SMT) Z3 prover. We will illustrate the implementation of READ algorithm with two examples from existing work and one example based on role based access control model.
策略遵从性问题是访问控制策略之间存在的不一致问题之一。应对的方法之一是政策比较。在本文中,我们开发并使用了我们的方法来执行策略比较,即当为资源提供新指定的访问控制策略与某些原始策略进行比较时,我们能够确保发现这些新指定的策略与资源上的原始策略之间的不遵从问题。在本文中,我们提出了一种基于READ (Resolution and溯因)算法作为发现策略不合规的方法。我们的方法是基于数据日志规则的解析和溯因工作,并通过可满足模理论(SMT) Z3证明的集合隐含来评估遵从性。我们将使用两个来自现有工作的示例和一个基于基于角色的访问控制模型的示例来说明READ算法的实现。
{"title":"READ -- A Resolution and Abduction Based Approach for Policy Comparison in Organizational Collaboration","authors":"Xiaofeng Xia","doi":"10.1109/BIOMEDCOM.2012.24","DOIUrl":"https://doi.org/10.1109/BIOMEDCOM.2012.24","url":null,"abstract":"The policy compliance problem is one of the categories of inconsistency problems existing between access control policies. One of the ways to cope with it is called policy comparison. In this paper we develop and use our approach to perform policy comparison, i.e. when newly specified access control policies for the resources are provided to be compared with certain original policy, we are able to ensure that the noncompliance problem between these newly specified policies and the original policies on the resources will be found. In this paper we propose the READ (Resolution and Abduction based) algorithm to be an approach of finding policy noncompliance. Our approach is based on the resolution and abduction work for Data log rules, and the evaluation of compliance is performed through set implication by Satisfiability Modulo Theories (SMT) Z3 prover. We will illustrate the implementation of READ algorithm with two examples from existing work and one example based on role based access control model.","PeriodicalId":146495,"journal":{"name":"2012 ASE/IEEE International Conference on BioMedical Computing (BioMedCom)","volume":"19 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-12-14","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123287577","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 1
A Framework for Model Checking of Large Scale Disease Spread Models 大规模疾病传播模型的模型检验框架
Pub Date : 2012-12-14 DOI: 10.1109/BIOMEDCOM.2012.16
Krishnendu Ghosh
The state explosion problem in model checking is a challenge for large scale models of disease spread. An efficient formalism is created for a disease spread model. Two model reduction mechanisms are described for efficiency in model checking. Queries by variants of temporal logic on the formalism are also stated.
模型检验中的状态爆炸问题是对大规模疾病传播模型的一个挑战。为疾病传播模型建立了一种有效的形式体系。为了提高模型检查的效率,介绍了两种模型缩减机制。时间逻辑的变体对形式主义的查询也作了说明。
{"title":"A Framework for Model Checking of Large Scale Disease Spread Models","authors":"Krishnendu Ghosh","doi":"10.1109/BIOMEDCOM.2012.16","DOIUrl":"https://doi.org/10.1109/BIOMEDCOM.2012.16","url":null,"abstract":"The state explosion problem in model checking is a challenge for large scale models of disease spread. An efficient formalism is created for a disease spread model. Two model reduction mechanisms are described for efficiency in model checking. Queries by variants of temporal logic on the formalism are also stated.","PeriodicalId":146495,"journal":{"name":"2012 ASE/IEEE International Conference on BioMedical Computing (BioMedCom)","volume":"15 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-12-14","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123958766","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Towards an Optimizing Model for Older People at Risk of Falls 对老年人跌倒风险的优化模型
Pub Date : 2012-12-14 DOI: 10.1109/BIOMEDCOM.2012.15
Ahmad Albu-Shamah, J. Zhan
Falls represent a problem associated with elder people. Statistics show that the percentage of people who are aged 65 years and older, get a serious injury when they fall is increasing in a very rapid way. When an elderly person falls, the cost will be high since the fall might cause in bone fractures and sometimes even death. This paper aims to detect the possible fall event by monitoring two parameters that will be put into a mathematical formula, in order to predict whether a fall is going to occur or not so we can avoid getting a long term serious injury.
跌倒是与老年人有关的一个问题。统计数据显示,65岁及以上的老年人在跌倒时受到严重伤害的比例正在迅速增加。当老年人跌倒时,成本将很高,因为跌倒可能导致骨折,有时甚至死亡。本文的目的是通过监测两个参数来检测可能发生的跌倒事件,并将其放入数学公式中,从而预测是否会发生跌倒,从而避免长期的严重伤害。
{"title":"Towards an Optimizing Model for Older People at Risk of Falls","authors":"Ahmad Albu-Shamah, J. Zhan","doi":"10.1109/BIOMEDCOM.2012.15","DOIUrl":"https://doi.org/10.1109/BIOMEDCOM.2012.15","url":null,"abstract":"Falls represent a problem associated with elder people. Statistics show that the percentage of people who are aged 65 years and older, get a serious injury when they fall is increasing in a very rapid way. When an elderly person falls, the cost will be high since the fall might cause in bone fractures and sometimes even death. This paper aims to detect the possible fall event by monitoring two parameters that will be put into a mathematical formula, in order to predict whether a fall is going to occur or not so we can avoid getting a long term serious injury.","PeriodicalId":146495,"journal":{"name":"2012 ASE/IEEE International Conference on BioMedical Computing (BioMedCom)","volume":"191 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-12-14","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124238058","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 3
Introducing Security Building Block Models 介绍安全构建块模型
Pub Date : 2012-12-14 DOI: 10.1109/BIOMEDCOM.2012.28
A. Rein, C. Rudolph, J. Ruiz, M. Arjona
In today's software development process, security related design decisions are rarely made early in the overall process. Even if security is considered early, this means that in most cases a more-or-less encompassing security requirement analyses is made; Based on this analysis best-practices, ad-hoc design decisions or individual expertise is used to integrate security during the development process or after weaknesses are found after the deployment. This paper introduces Security Building Block Models which are used to build security related components, namely Security Building Blocks. These Security Building Blocks represent concrete security solutions, so called Security Properties, introduced in other publications of the SecFutur project [1]. The goal of this approach is to provide already defined and tested security related software components, which can be used early in the overall development process, to support security-design-decision already while modeling the software-system. The paper shortly describes this new Security Engineering Process with its requirement analysis and definition of Security Properties and how the Security Building Block Model fits into this approach. Additionally the Security Building Block Model is presented in detail. All artifacts and relationships of the model are described. Short examples finish up the paper to show the creation of the Security Building Blocks and their interactions with other software components.
在今天的软件开发过程中,很少在整个过程的早期做出与安全性相关的设计决策。即使在早期考虑安全性,这也意味着在大多数情况下会进行或多或少的安全性需求分析;基于此分析最佳实践,在开发过程中或在部署后发现弱点之后,使用临时设计决策或个人专业知识来集成安全性。本文介绍了用于构建安全相关组件(即安全构建块)的安全构建块模型。这些安全构建块代表了具体的安全解决方案,即所谓的安全属性,在secfuture项目的其他出版物中介绍[1]。此方法的目标是提供已经定义并经过测试的与安全性相关的软件组件,这些组件可以在整个开发过程的早期使用,以便在对软件系统建模时支持安全性设计决策。本文简要地描述了这种新的安全工程过程及其需求分析和安全属性的定义,以及安全构建块模型如何适应这种方法。此外,还详细介绍了安全构建块模型。描述了模型的所有工件和关系。本文最后用一些简短的例子来展示安全构建块的创建以及它们与其他软件组件的交互。
{"title":"Introducing Security Building Block Models","authors":"A. Rein, C. Rudolph, J. Ruiz, M. Arjona","doi":"10.1109/BIOMEDCOM.2012.28","DOIUrl":"https://doi.org/10.1109/BIOMEDCOM.2012.28","url":null,"abstract":"In today's software development process, security related design decisions are rarely made early in the overall process. Even if security is considered early, this means that in most cases a more-or-less encompassing security requirement analyses is made; Based on this analysis best-practices, ad-hoc design decisions or individual expertise is used to integrate security during the development process or after weaknesses are found after the deployment. This paper introduces Security Building Block Models which are used to build security related components, namely Security Building Blocks. These Security Building Blocks represent concrete security solutions, so called Security Properties, introduced in other publications of the SecFutur project [1]. The goal of this approach is to provide already defined and tested security related software components, which can be used early in the overall development process, to support security-design-decision already while modeling the software-system. The paper shortly describes this new Security Engineering Process with its requirement analysis and definition of Security Properties and how the Security Building Block Model fits into this approach. Additionally the Security Building Block Model is presented in detail. All artifacts and relationships of the model are described. Short examples finish up the paper to show the creation of the Security Building Blocks and their interactions with other software components.","PeriodicalId":146495,"journal":{"name":"2012 ASE/IEEE International Conference on BioMedical Computing (BioMedCom)","volume":"4 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-12-14","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121617675","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 4
Security Engineering and Modelling of Set-Top Boxes 机顶盒的安全工程与建模
Pub Date : 2012-12-14 DOI: 10.1109/BIOMEDCOM.2012.25
J. Ruiz, A. Rein, M. Arjona, A. Maña, A. Monsifrot, M. Morvan
This paper presents a security engineering process for the development of secure systems focusing on the specification and development of the Set-top Boxes. The paper describes the Set-top Box characteristics and functionalities and, using the process and its secure artefacts, models what we call a Domain Security Metamodel that defines all the security properties of that domain and implements them using Security Building Blocks. This security artefact can be used by system engineers when modelling their system model in order to fulfil its security requirements and, as a result, create a secure system that has security naturally integrated in its architecture and functionality.
本文以机顶盒的规格和开发为重点,介绍了安全系统开发的安全工程流程。本文描述了机顶盒的特征和功能,并使用流程及其安全工件,建立了我们称之为域安全元模型的模型,该模型定义了该域的所有安全属性,并使用安全构建块实现它们。系统工程师可以在建模他们的系统模型时使用此安全性工件,以满足其安全性需求,并因此创建一个在其体系结构和功能中自然集成了安全性的安全系统。
{"title":"Security Engineering and Modelling of Set-Top Boxes","authors":"J. Ruiz, A. Rein, M. Arjona, A. Maña, A. Monsifrot, M. Morvan","doi":"10.1109/BIOMEDCOM.2012.25","DOIUrl":"https://doi.org/10.1109/BIOMEDCOM.2012.25","url":null,"abstract":"This paper presents a security engineering process for the development of secure systems focusing on the specification and development of the Set-top Boxes. The paper describes the Set-top Box characteristics and functionalities and, using the process and its secure artefacts, models what we call a Domain Security Metamodel that defines all the security properties of that domain and implements them using Security Building Blocks. This security artefact can be used by system engineers when modelling their system model in order to fulfil its security requirements and, as a result, create a secure system that has security naturally integrated in its architecture and functionality.","PeriodicalId":146495,"journal":{"name":"2012 ASE/IEEE International Conference on BioMedical Computing (BioMedCom)","volume":"23 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-12-14","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114889005","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 9
Emerging Infectious Disease: A Computational Multi-agent Model 新发传染病:一个计算多主体模型
Pub Date : 2012-12-14 DOI: 10.1109/BIOMEDCOM.2012.11
Hong Qin, A. Shapiro, Li Yang
In today's global society there exists a need to understand and predict the behavior of vector-borne diseases. With globalization, human groups tend to interact with other groups that can have one or multiple types of viruses. Currently, there are many mathematical models for studying patterns of emerging infectious diseases. These mathematical models are based on differential equations and can become unmanageable due to many parameters involved. With this in mind, we design and implement a simple spatial computational multi-agent model that can be used as a tool to analyze and predict the behavior of emerging infectious diseases. Our novel computational agent-based model integrated with evolution and phylogeny to simulate and understand emerging infectious diseases, which enables us to prevent or control outbreaks of infectious diseases in an effective and timely manner. Our multi-agent spatial-temporal model contributes to epidemiology, public health and computational simulation in several folds: First, our simulation offers an effective way to train public policy decision-makers who will respond to emergent outbreaks of infectious diseases in an appropriately and timely manner. Second, our model has the potential to aid real-time disease control and decision making. Third, our model uniquely takes evolution of viruses into account. Evolution of viruses means their genomic DNA/RNA sequence can mutate and compete for subpopulations of hosts (human, birds/pets). Our implementation provides graphical representation of the results by conducting a set of experiments under various settings.
在当今的全球社会中,有必要了解和预测媒介传播疾病的行为。随着全球化,人类群体倾向于与可能携带一种或多种病毒的其他群体互动。目前,有许多数学模型用于研究新发传染病的模式。这些数学模型基于微分方程,由于涉及到许多参数,可能变得难以管理。考虑到这一点,我们设计并实现了一个简单的空间计算多智能体模型,可以用作分析和预测新发传染病行为的工具。我们新颖的基于计算主体的模型结合了进化和系统发育来模拟和理解新发传染病,使我们能够有效和及时地预防或控制传染病的爆发。我们的多智能体时空模型对流行病学、公共卫生和计算模拟有几个方面的贡献:首先,我们的模拟提供了一种有效的方法来培训公共政策决策者,他们将以适当和及时的方式应对突发传染病。其次,我们的模型具有帮助实时疾病控制和决策的潜力。第三,我们的模型独特地考虑了病毒的进化。病毒的进化意味着它们的基因组DNA/RNA序列可以发生突变,并争夺宿主亚群(人类、鸟类/宠物)。我们的实现通过在不同设置下进行一组实验来提供结果的图形表示。
{"title":"Emerging Infectious Disease: A Computational Multi-agent Model","authors":"Hong Qin, A. Shapiro, Li Yang","doi":"10.1109/BIOMEDCOM.2012.11","DOIUrl":"https://doi.org/10.1109/BIOMEDCOM.2012.11","url":null,"abstract":"In today's global society there exists a need to understand and predict the behavior of vector-borne diseases. With globalization, human groups tend to interact with other groups that can have one or multiple types of viruses. Currently, there are many mathematical models for studying patterns of emerging infectious diseases. These mathematical models are based on differential equations and can become unmanageable due to many parameters involved. With this in mind, we design and implement a simple spatial computational multi-agent model that can be used as a tool to analyze and predict the behavior of emerging infectious diseases. Our novel computational agent-based model integrated with evolution and phylogeny to simulate and understand emerging infectious diseases, which enables us to prevent or control outbreaks of infectious diseases in an effective and timely manner. Our multi-agent spatial-temporal model contributes to epidemiology, public health and computational simulation in several folds: First, our simulation offers an effective way to train public policy decision-makers who will respond to emergent outbreaks of infectious diseases in an appropriately and timely manner. Second, our model has the potential to aid real-time disease control and decision making. Third, our model uniquely takes evolution of viruses into account. Evolution of viruses means their genomic DNA/RNA sequence can mutate and compete for subpopulations of hosts (human, birds/pets). Our implementation provides graphical representation of the results by conducting a set of experiments under various settings.","PeriodicalId":146495,"journal":{"name":"2012 ASE/IEEE International Conference on BioMedical Computing (BioMedCom)","volume":"218 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-12-14","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133584164","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 4
2TAC: Distributed Access Control Architecture for "Bring Your Own Device" Security 2TAC:“自带设备”安全的分布式访问控制架构
Pub Date : 2012-12-14 DOI: 10.1109/BIOMEDCOM.2012.26
Sean Chung, S. Chung, T. Escrig, Yan Bai, B. Endicott-Popovsky
Mobile devices, specifically smartphones, have become ubiquitous. For this reason, businesses are starting to develop "Bring Your Own Device" policies to allow their employees to use their devices in the workplace. However, due to emerging attacks and limitations in device resources, it is difficult to trust these devices with access to critical proprietary information. To mitigate this problem we propose a novel architecture called 2-Tier Access Control (2TAC), which uses double layer access control along with device security profiles, anti-virus/malware scanners, and social networking.
移动设备,特别是智能手机,已经无处不在。出于这个原因,企业开始制定“自带设备”政策,允许员工在工作场所使用自己的设备。然而,由于新出现的攻击和设备资源的限制,很难信任这些设备访问关键的专有信息。为了缓解这个问题,我们提出了一种新的架构,称为2层访问控制(2TAC),它使用双层访问控制以及设备安全配置文件,反病毒/恶意软件扫描程序和社交网络。
{"title":"2TAC: Distributed Access Control Architecture for \"Bring Your Own Device\" Security","authors":"Sean Chung, S. Chung, T. Escrig, Yan Bai, B. Endicott-Popovsky","doi":"10.1109/BIOMEDCOM.2012.26","DOIUrl":"https://doi.org/10.1109/BIOMEDCOM.2012.26","url":null,"abstract":"Mobile devices, specifically smartphones, have become ubiquitous. For this reason, businesses are starting to develop \"Bring Your Own Device\" policies to allow their employees to use their devices in the workplace. However, due to emerging attacks and limitations in device resources, it is difficult to trust these devices with access to critical proprietary information. To mitigate this problem we propose a novel architecture called 2-Tier Access Control (2TAC), which uses double layer access control along with device security profiles, anti-virus/malware scanners, and social networking.","PeriodicalId":146495,"journal":{"name":"2012 ASE/IEEE International Conference on BioMedical Computing (BioMedCom)","volume":"32 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-12-14","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128117793","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 23
A Modular Testing Environment for Implementation Attacks 实现攻击的模块化测试环境
Pub Date : 2012-12-14 DOI: 10.1109/BIOMEDCOM.2012.21
L. Judge, M. Cantrell, C. Kendir, P. Schaumont
Implementation attacks, including side-channel, fault, and probing attacks, have received significant attention in both research and commercial communities. Successful attacks have been demonstrated against standard cryptographic algorithms implemented on a wide variety of common platforms. In order to protect against these attacks, designers must incorporate complex countermeasures into the implementation of sensitive operations. Validating the effectiveness of implementation attack countermeasures requires specialized expertise and techniques not commonly used in other types of security and functional testing. We propose a modular testing environment for use in verifying the implementation attack resistance of secure systems. The proposed environment is an open-source solution that allows implementation attack testing to be independent of the system platform, implementation details, and type of attack under evaluation. These key features make the environment suitable for use with an implementation attack security standard in which standard test procedures are published openly and used to evaluate cryptographic systems. We use the proposed test environment to demonstrate a successful side-channel attack on AES, which illustrates the practical usefulness of our design for analyzing implementation attack security. Our open-source design is available at url{http://rijndael.ece.vt.edu/iameter}.
实现攻击,包括侧信道攻击、故障攻击和探测攻击,在研究和商业社区中都受到了极大的关注。针对各种通用平台上实现的标准加密算法的成功攻击已经被证明。为了防止这些攻击,设计人员必须将复杂的对策纳入敏感操作的实现中。验证实现攻击对策的有效性需要在其他类型的安全性和功能测试中不常用的专门知识和技术。我们提出了一个模块化的测试环境,用于验证安全系统的实现抗攻击能力。所建议的环境是一个开源解决方案,它允许实现攻击测试独立于系统平台、实现细节和评估中的攻击类型。这些关键特性使该环境适合与实现攻击安全标准一起使用,其中公开发布标准测试过程并用于评估加密系统。我们使用提议的测试环境来演示对AES的成功的侧信道攻击,这说明了我们的设计在分析实现攻击安全性方面的实际用途。我们的开源设计可以在url{http://rijndael.ece.vt.edu/iameter}上找到。
{"title":"A Modular Testing Environment for Implementation Attacks","authors":"L. Judge, M. Cantrell, C. Kendir, P. Schaumont","doi":"10.1109/BIOMEDCOM.2012.21","DOIUrl":"https://doi.org/10.1109/BIOMEDCOM.2012.21","url":null,"abstract":"Implementation attacks, including side-channel, fault, and probing attacks, have received significant attention in both research and commercial communities. Successful attacks have been demonstrated against standard cryptographic algorithms implemented on a wide variety of common platforms. In order to protect against these attacks, designers must incorporate complex countermeasures into the implementation of sensitive operations. Validating the effectiveness of implementation attack countermeasures requires specialized expertise and techniques not commonly used in other types of security and functional testing. We propose a modular testing environment for use in verifying the implementation attack resistance of secure systems. The proposed environment is an open-source solution that allows implementation attack testing to be independent of the system platform, implementation details, and type of attack under evaluation. These key features make the environment suitable for use with an implementation attack security standard in which standard test procedures are published openly and used to evaluate cryptographic systems. We use the proposed test environment to demonstrate a successful side-channel attack on AES, which illustrates the practical usefulness of our design for analyzing implementation attack security. Our open-source design is available at url{http://rijndael.ece.vt.edu/iameter}.","PeriodicalId":146495,"journal":{"name":"2012 ASE/IEEE International Conference on BioMedical Computing (BioMedCom)","volume":"115 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-12-14","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133531742","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 6
A Misuse Pattern for Retrieving Data from a Database Using SQL Injection 使用SQL注入从数据库检索数据的误用模式
Pub Date : 2012-12-14 DOI: 10.1109/BIOMEDCOM.2012.27
E. Fernández, E. Alder, R. Bagley, S. Paghdar
SQL injection attacks represent a serious threat to any database-driven site and they are one of the most frequent types of attacks. We present here a misuse pattern for retrieving data from a database using SQL injection, which describes the essential and typical characteristics of this type of attack. A misuse pattern describes from the point of view of the attacker, how a type of attack or misuse is performed (what units it uses and how), looks at the selection of the methods available to the attacker, analyzes the way of stopping the attack, and describes how to trace the attack once it has happened by appropriate collection and observation of forensic data.
SQL注入攻击对任何数据库驱动的站点都是一个严重的威胁,它们是最常见的攻击类型之一。我们在这里提出了一种使用SQL注入从数据库检索数据的误用模式,它描述了这种类型攻击的基本和典型特征。滥用模式从攻击者的角度描述了一种类型的攻击或滥用是如何执行的(它使用什么单元以及如何使用),查看了攻击者可用方法的选择,分析了阻止攻击的方法,并描述了如何在攻击发生后通过适当的收集和观察取证数据来跟踪攻击。
{"title":"A Misuse Pattern for Retrieving Data from a Database Using SQL Injection","authors":"E. Fernández, E. Alder, R. Bagley, S. Paghdar","doi":"10.1109/BIOMEDCOM.2012.27","DOIUrl":"https://doi.org/10.1109/BIOMEDCOM.2012.27","url":null,"abstract":"SQL injection attacks represent a serious threat to any database-driven site and they are one of the most frequent types of attacks. We present here a misuse pattern for retrieving data from a database using SQL injection, which describes the essential and typical characteristics of this type of attack. A misuse pattern describes from the point of view of the attacker, how a type of attack or misuse is performed (what units it uses and how), looks at the selection of the methods available to the attacker, analyzes the way of stopping the attack, and describes how to trace the attack once it has happened by appropriate collection and observation of forensic data.","PeriodicalId":146495,"journal":{"name":"2012 ASE/IEEE International Conference on BioMedical Computing (BioMedCom)","volume":"29 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-12-14","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114579174","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 5
期刊
2012 ASE/IEEE International Conference on BioMedical Computing (BioMedCom)
全部 Acc. Chem. Res. ACS Applied Bio Materials ACS Appl. Electron. Mater. ACS Appl. Energy Mater. ACS Appl. Mater. Interfaces ACS Appl. Nano Mater. ACS Appl. Polym. Mater. ACS BIOMATER-SCI ENG ACS Catal. ACS Cent. Sci. ACS Chem. Biol. ACS Chemical Health & Safety ACS Chem. Neurosci. ACS Comb. Sci. ACS Earth Space Chem. ACS Energy Lett. ACS Infect. Dis. ACS Macro Lett. ACS Mater. Lett. ACS Med. Chem. Lett. ACS Nano ACS Omega ACS Photonics ACS Sens. ACS Sustainable Chem. Eng. ACS Synth. Biol. Anal. Chem. BIOCHEMISTRY-US Bioconjugate Chem. BIOMACROMOLECULES Chem. Res. Toxicol. Chem. Rev. Chem. Mater. CRYST GROWTH DES ENERG FUEL Environ. Sci. Technol. Environ. Sci. Technol. Lett. Eur. J. Inorg. Chem. IND ENG CHEM RES Inorg. Chem. J. Agric. Food. Chem. J. Chem. Eng. Data J. Chem. Educ. J. Chem. Inf. Model. J. Chem. Theory Comput. J. Med. Chem. J. Nat. Prod. J PROTEOME RES J. Am. Chem. Soc. LANGMUIR MACROMOLECULES Mol. Pharmaceutics Nano Lett. Org. Lett. ORG PROCESS RES DEV ORGANOMETALLICS J. Org. Chem. J. Phys. Chem. J. Phys. Chem. A J. Phys. Chem. B J. Phys. Chem. C J. Phys. Chem. Lett. Analyst Anal. Methods Biomater. Sci. Catal. Sci. Technol. Chem. Commun. Chem. Soc. Rev. CHEM EDUC RES PRACT CRYSTENGCOMM Dalton Trans. Energy Environ. Sci. ENVIRON SCI-NANO ENVIRON SCI-PROC IMP ENVIRON SCI-WAT RES Faraday Discuss. Food Funct. Green Chem. Inorg. Chem. Front. Integr. Biol. J. Anal. At. Spectrom. J. Mater. Chem. A J. Mater. Chem. B J. Mater. Chem. C Lab Chip Mater. Chem. Front. Mater. Horiz. MEDCHEMCOMM Metallomics Mol. Biosyst. Mol. Syst. Des. Eng. Nanoscale Nanoscale Horiz. Nat. Prod. Rep. New J. Chem. Org. Biomol. Chem. Org. Chem. Front. PHOTOCH PHOTOBIO SCI PCCP Polym. Chem.
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
0
微信
客服QQ
Book学术公众号 扫码关注我们
反馈
×
意见反馈
请填写您的意见或建议
请填写您的手机或邮箱
×
提示
您的信息不完整,为了账户安全,请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
现在去查看 取消
×
提示
确定
Book学术官方微信
Book学术文献互助
Book学术文献互助群
群 号:481959085
Book学术
文献互助 智能选刊 最新文献 互助须知 联系我们:info@booksci.cn
Book学术提供免费学术资源搜索服务,方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。
Copyright © 2023 Book学术 All rights reserved.
ghs 京公网安备 11010802042870号 京ICP备2023020795号-1