The di.erence might be explainable because, in the absence of program-speci.c rules, the tool is doing a better job of understanding one program compared to the other.

whilst we accept some range of di.erence is to be expected and is unlikely to be signi.cant, we seek to understand the range ofissuedensities anddetermineif extremely large di.erences are signi.cant.


The identi.er mapping functionality is very relevant to Pseudonym Service in WS-Federation and Identity Mapping functionality in Liberty ID-FF in that the authority brokers trust relationships between di.erent entities, and issues the appropriate name identi.er unique to the particular entity.

the assertion composition functionality is very relevant to STS (Security Token Service) in WS-Trust in that the AA converts an original security token into a required one.


This shows how the release of h affects the requirement of the low-equality of the memories from the two related runs: after h is released, traces that disagree on the value of h at the point of release are automatically accepted by the de.nitions.

traces that agree on the value of h are still required to be related, in order to avoid leaks through other variables.


As a result, least privilege [43] has been adopted as the security goal for integrity protection in commodity systems [33, 31, 27, 54].

di.erent deployments imply di.erent privileges, so commodity systems try to accommodate this through mechanisms to compute permissions requested by processes [38, 31, 3] and by providing runtime con.guration options to specify permissions for options.


What makes it possible for our return channels to be reused is the guarantee (based on the semantic security of ElGamal encryption) that two recipients can not determine whether their return channels are the same or not, and therefore do not know whether they are replying to the same person.

reply blocks based on Chaum s technique can not be reused with di.erent players for if they were these players could simply compare their reply blocks and learn that they are communicating with the same person.


This is the typical scenario for the vast majority of systems in use today.

the IPF can also be used to rate I&A technologies where no network is used for authentication.


They require that the adversary is able to modify the price information, either at the source, during transmissions, or at the smart meters.

these attacks in a cyber environment are certainly feasible and credible, and it would be wrongfully complacent to ignore their possibility.


We formalize rGURA as a state transition system and show that the reachability problems for its general cases are PSPACE-complete.

we do .nd polynomial-time solutions to reachability problems for limited versions of rGURA that are still useful in practice.


[27] describes methods to safely extend role-based access control schemes with delegation primitives.

role-based access control is only one particular scheme, and delegation is only one particular capability that may be desirable in an access control environment.


In all cases, the utilization will all optimizations is higher than for the baseline.


They also compared embedded training to security notices delivered via email.

the security notices did not include the same content as the embedded training materials [15].


The program onthispathfollows a di.erent control path(going through the else-block), andgenerates aquery whose structureisquite unlike thequery structure obtainedbypursuing the if-block.

substituting vc in the symbolic expression exp yields Q2: SELECT * FROM employdb WHERE name= aaaaaaaaaa which is indeed the correct query structure on pursuing the if-block.


Clearly, in network attacks the noise (caused by network delay times) may be much larger, and hence an attack may become impractical even if it is feasible for an interprocess attack under the same environmental conditions.

this aspect is not speci.c for our improved variant but a general feature that a.ects BB-attack as well.


It is difficult to formalize the resulting intensities because there are many other electronic devices around the experimental setup and the emanation source might not be approximated by a reduction model of near EM fields based on an ideal antenna structure.

we can estimate the boundary of near and far EM fields from the results, where the intensity fell exponentially up to 50 cm comparable to the wavelength of the leakage frequency, and then reduced linearly from greater distances.


Moreover, Intel proposed a hardware service called Processor Measured Application Protection Service (P-MAPS) [21] to o.er runtime memory isolation.

there is insuf.cient detail about its ability to provide multi-core isolation.


(3) An attacker who has a full scan capability (i.e., can set up a binary value to all of the internal flip flops) can have a distinct advantage of breaking the system.


For the purpose of setting up rules and detection procedures we have de.ned a simple set of instructions based on the XML format.

one future direction is to support the scripting and the interaction with other well-known IDS such as snort5 and/or bro6 .


As for re-watermarking, it is simple to show that the ex-pected value of ~V(X, k) for [2] drops by a factor of x/2 for ev- ery watermark added.

our experiments suggested that the detection scores and PSNRs tend be a little better than for the re-watermarking algorithm.


For this policy, we formalize the PUK as high-entropy system-generated password value that requires no inherent replay protection.

as shown by the PIN handling in the main policy, the PUK could equally well be modelled like the PIN, with the same replay-protection setup.


Usually they assume group members have admitted the prospective member.

the assumption is simply incorrect because if group members can't control the admission for new members, it will let invalidated users join the process of group key agreement and invalidated users will obtain the same information as validated group members do.


Hence, if forgery and modification of warnings were the only threats, digital signatures might be an effective mitigation.

this approach is problematic for several reasons.


An attacker can try to recover kd using k and data from previously recorded runs of the protocol (e.g., the n pairs of messages (Re 1k, R2ek,...,Rek) and signatures (R1kd , R2kd ,..., Rnkd )).

now, the nattacker can recover the various Rei by multiplying a message with k-1 mod N. the attacker is unable to isolate kd from the signatures.


In comparison with the only known unidirectional PRS with private re-signing keys (suggested in section 3.4.2 of [5]), this one features shorter second level signatures that must include a Schnorr-like [30] proof of knowledge in addition to 3 group elements in [5].

signatures of [5] are strongly unforgeable unlike ours.


In addition, the practices we study are broadly alluded to recently released privacy agendas by the FTC [9], the White House Technology Office [23], and the European Union [8].

these developments stand in contrast to the relatively modest investments by the policy and research communities to study their effectiveness and practical implications.


4.2 Application to all interaction patterns We already took the example of publish/subscribe systems to describe how the problem could appear.

other interaction patterns may suffer from the same information leak issue on context changes.


All recipients in G know that Alice is the sender of the protected message based on information provided by the sharing platform, but they should not .nd out the identity of other recipients in G. In a straightforward solution, Alice could perform the steps described earlier for each recipient U in G, using shared keys kAU and hkAU .

this solution results in poor performance for large groups of recepients, because Alice must encrypt the message m for each recipient, and then compute and register di.erent (hd, elc) values with HD.


DroidBarrier does not directly detect the payload that is downloaded to install malicious applications.

droidBarrier is designed to prevent such installations by means of detecting their unauthenticated processes, thereby foiling this form of attack.


The same threshold might generate the same set of inferring privacy features (both the number and the features are the same), e.g., t = 0.17.


User 1 placed her elbows on her knees and also operated the device in a very relaxed way.

user 3 tightly pressed her upper arm against the upper body and held the device very .rmly in her hand while entering the digits with the index .nger.


On the other hand, QR Pal did not download any of these malware with its default setting.

it could download all these six malware if its default Built-in browser setting in the general settings was turned off, which could be easily done by users who just followed the instructions displayed by the app, upon receiving the download request from the users.


5.2.2, condition C1 alone can happen to hold true during the execution of random code, although rarely.

the heuristic can be strengthened based on the following observation.


Note that Prot assertions do not describe multiple-step, transitive .ows over multiple processes, but rather describe direct, one-step .ows between pairs of processes.

a programmer can typically de.ne policies using only a few Prot assertions by de.ning the Prot assertions over process templates that correspond to program points reached immediately before a process writes or reads any information.


If data is encrypted using FHE, anyone can perform a computation on it (with knowledge of the public key), while the result of the computation can be decrypted only using the secret key.

the secret key allows decrypting all data encrypted under the corresponding public key.


An action is compliant with a privacy policy if it is both weakly and strongly compliant.

their de.nitions of compliance are restricted to only propositional linear temporal logic (pLTL), which cannot feasibly specify HIPAA.


A corner is the intersection of two edges, and a centroid is the center of an object or its segment.

the corner detection used in [16-18] tends to detect excessive corners, such as weak corners of small and irregular structures, which people unlikely select as click-points.


There was a trend that, with increasing stress, participants were able to maintain high accuracy when the star rating of the correct app was high.

when the star rating was low, performance declined more as stress increased.


On the one hand, SMC belief tracking is clearly more precise than belief sets for the simple reason that Pi s estimate of the gain in the other principals beliefs can consider their secret values exactly without fear that rejection will reveal any information.


Finally, for the last comparison results to a regular transition from I to S. The most common modi.cation to adopt the AC algorithm in a multi-threaded environment is to split the text T in multiple chunks and assign one chunk per thread.

this creates problems when the text contains patterns across two chunks.


One limitation of these schemes is that self-healing key distribution is restricted to m sessions.

we note that the technique that extends the lifetime of the methods in [27] is also applicable to ours.


In cases where abnormal activities have been locally identi.ed, a smartphone may also submit a report immediately to the proxy.

the proxy performs joint analysis on the received reports and detects any single-device or system-wide viral behaviors.


Factor Acolor (or A r ) is larger than 1 and thus boosts M-index (i.e., less memorable) if the point is in a less dissimilar region and thus less likely distinguishable from other points in its neighborhood.

the factor is smaller than 1 and thus lowers M-index (i.e., more memorable) if the point is in a more dissimilar region and thus more likely distinguishable from other points in its neighborhood.


3.2.1, since the number of ads from which the client picks one is small (= k).

the server s task to select a set of k ads from A that maximize the expected revenue given only the generalized context c of the user is much more demanding.


That is, technology is assumed to evolve according to its own internal logic, and thus attempts to bring social and ethical concerns into the actual design of technology are doomed to fail.

recent work in the field of Science and Technology Studies (STS) challenges this assumption.


The mobile computing research communityhaslong recognized the need for stationary proxies to augment the capabilities of mobile devices.

the question of proxy ownership has been largely unexplored.


Since pages 1, 2, and 4 remain unchanged, the memory deduplication mechanism should have merged them with their counterparts.

pages 3, 5, and 6 have been modi.ed by the sender, and hence they are not deduplicated.


Similarly, the sophisticated framework TaintDroid [14] tracks the propagation of tainted data from sensible sources (in program variables, .les, and IPC) on the phone and detects unauthorized leakage of this data.

it is limited to tracking data .ows and does not consider control .ows.


In an enterprise context, researchers talk about security policy and education campaigns; some studies try to look at how this carries over into home computer security.

it is much harder to collect data the di.erent kinds of information that home computer users have access to.


This is because the way to protect the assets is different.

this may be in a very early stage in some organizations because most of the times are spent for risk assessment.


Finding more bartering opportunities requires modi.ed choking policies designed for fairness and clustering; interestingly, the currency overhead aligns greater fairness, through barter, with reduced computational burden.

achieving these results in practice may be more di.cult: we do not simulate node churn, failure, nor do we attempt to integrate currency budgets or debt-reckoning at certain intervals into the choking policy.


An implied interpretation is that people associate different memorability levels to different points.

we go several steps forward from the state of the art.


NeST [6] provides uni.ed access to grid storage through a variety of protocols.

chirp is a particularly interesting platform in which to explore identity boxing because it has a fully virtual user space.


Thus, the optimum implementation approach is dependent on the nature of the dependencies.

from a worst-case standpoint, the monolithic graph implementation is superior.


This approach has the advantage thatthe reference template (training sample) and test sample canbe accurately aligned.

the accuracy comes with a price paidon convenience: in security scenario, the user is forced to performacertain task which becomes both learned and easily distracting.


The fragment we consider can have more than one free variable for subformulas of form .1 S.2 (non-monadic ) [34].


designed both active and passive attacks to break the privacy of SN users.

since the attacks in [1] leverage the success of a sybil attack before actual anonymized data publication, they are less practical.


Z - rP = sP 2RA 4) T= E[-r]*E[-s+s+r] PKG2PKGARA2D[T*E[s]]=s-s PKGPKGPKGA Figure 9: Secured Version of Step 4 of Registration Protocol One can claim that the registration protocol is complicated and maytake quite a long time.

this complication canbe tolerated since it is executed only once for each user initially or in case of secret share refreshment which occurs notveryfrequently.


Thus, for maximum policy accuracy, the policy module should wait to dispatch events until all other events on which a policy may depend have arrived.

waiting too long to dispatch an event may be unacceptable, as in an augmented reality system providing real-time feedback in a heads-up display.


XACL [10] integrated security features such as authorization, non-repudiation, con.dentiality and an audit trail for XML document.

above four related works disregard the pressing need for interoperation and information sharing among databases, especially the semantic-related heterogeneous data sources.


4.2.2 Multiple Permission Security Rules Voice and location eavesdropping malware requires permissions to record audio and access location information.

legitimate applications use these permissions as well.


Errors are handled in the similar way as well.

a subject should also be able to revoke a right it has delegated to another.


In the database s case, the .gure shows that there is not a signi.cant difference between using multiple processes or the hybrid approach; both techniques saturate the database (more than 100% CPU utilization).

in the proxy s case, the hybrid approach uses less CPU time than multiple processes.


These complexities result in such approaches suffering from state-space explosion problem.

these approaches do have the advantage of generating a counterexample corresponding to the attack, when a security property is not satisfied.


Previous mathematically founded analyses abstract the Tor network by ignoring characteristics of Tor, such as the path selection algorithm, the varying entrusted bandwidth of different Tor nodes, or the user s requested ports [6, 15 18, 21].

these real-life characteristics of Tor signi.cantly in.uence a user s anonymity, which renders the previously proven bounds inaccurate.


This involves many calls to the gcc compiler as well as opening and closing many small .les.

the gcc compiler itself is relatively computation intensive.


A user s digital identity plays a very crucial role in determining which services and data can be accessed by that user and thus is a corner stone in the security building blocks of any system.

what is often overlooked are the issues surrounding data identity, which also plays a crucial role as there is a need to ascertain that the user has the correct access permissions for a unit of digital data.


Under normal conditions, this JSON object would be generated and signed by the remote Play Store server.

since we are not really performing a purchase and are only making the victim app believe that the purchase has been successful, we need to generate this JSON object ourselves.


For instance, if the application requires counting bins with a maximum counter up to 255 then an array with bins of size 8 bits will su.ce to represent the counters.

this causes an increase in the storage by a factor of 8 compared to the space required for a standard Bloom .lter.


Translated into the cluster hierarchy, this means that corresponding clusters would have to have permissions in common.

the chosen algorithm does not yet support this.


IP spoo.ng is a well-known, yet unsolved security threat to the wired Internet [14].

different from the Internet, cellular MDC is still vulnerable even with user authentication!


to the issuer that an online credential can never provide.


Similarly, R4A was willing to share highly sensitive .les such as .nancial information and photos with her boyfriend, but did not want to grant him write access to any .les.

a read-only system would not be suf.cient for some participants, who see value in allowing others to edit their .les sometimes.


proposed the .rst CP-ABE construction [1].

the construction [1] is only proved secure under the generic group model.


Accordingly, the pattern matching block in NIDSes consists of a header and a payload inspection units.

[2] reported that payload inspection consumed up to 70% of the total execution time in SNORT, an open source NIDS [3].


In practice, however, the user does not have a choice and a fixed size of key and number of rounds are employed.

we leave this question to be addressed in future.


Indeed, the read privilege is the most important privilege to consider data retrieval from heterogeneous sources.

we are extending our model with the write privilege and model the related collaborative issues, i.e., information .ow, task .ow.


1.1 State of the Art For high speed NIDS/NIPSes, the de facto standard approach is to employ regex (regular expression) based matching engines.

vulnerability signatures [9, 10, 29] have been proposed, but still have not been used in NIDS/NIPSes due to the low matching ef.ciency.


In [36], a quad tree spatial decomposition technique is used to achieve differential privacy in a database with location patter mining capabilities.

dewri [37] proposes a combination of di.erential privacy and k-anonymity for the purposes of hiding the location of a single individual.


On the one hand, if the correct plaintext has enough redundancy that it can be recognized by inspection of the candidate list, then the resulting attack by the server will be completely o.ine, and there is nothing one can do about it except pick an encryption password that is su.ciently hard to guess.

if the correct plaintext is not recognizable by mere inspection, then its appearance on a short list of possible candidates may not be very helpful, since the attacker still has to separate the correct plaintext from the other candidates.


That would shift the problem to that of securing the operating system, and allow the secure use of standard mutual authentication techniques, such as the previously mentioned PAKE protocols.

in the absence of such a solution, alternative approaches (such as ours) are necessary.


In fact, A3 alone cannot achieve that goal.

the crumple zones do make attacks on the application that make use or exploit the storage and network channels more difficult to actually affect the application.


It is reminiscent of information-.ow type systems, and we discovered that it has similarities with DCC (of which Garg and Pfenning were not aware).

unlike DCC, that logic is not de.ned as a type system for a programming language.


In the script runtime, the interface function for name querying is InvokeByName, which is responsible for mapping an object name string to a dispatch-ID.

the script runtime does not have the knowledge about the dispatch ID table, so the name query is passed into the HTML engine (mshtml.dll), where the function GetDispatchID performs the actual lookup.


Most research on defense techniques has focused on securing existing legacy applications written in general-purpose languages, such as Java and PHP.

recent and emerging applications have widely adopted web templating frameworks that have received little attention in research.


EXPERIMENTAL EVALUATION As noted previously, if the host sets the quota to be larger than the workload s requirement, then on-demand mapping achieves a steady state where the workload s pages are mapped and no DMA remapping is needed, i.e., we achieve maximal performance from the point of view of DMA mapping.

if the workload size is equal to the entire guest memory size, then we might as well use persistent mapping.


We also stress that auditability is an important property of a logging scheme, since the relationship between the log server and the data processor is a fragile one: the data processor trusts the log server to log as instructed, for the correct user, while the log server trusts the data processor to encrypt for the correct user.

both trusted hardware and auditability are outside the scope of this paper.


Before drive-by download attack emerged, researchers [41, 29, 28] had found some viable methods to identify malicious network .ows by detecting the plain text or lightencoded shellcode within these .ows.

in drive-by download attacks, by utilizing the powerful capacities provided by the script engine of browsers or their plug-ins, attackers can encode their shellcode in much more variable ways during transfer, and then decode them just before the exploitation.


When combining policies (rather than rules), PDP does not know the source of an error and hence XACML chooses P > D > IN > NA, one of the two orderings used in Permit-overrides RCA.

one could argue that P > IN > D > NA is a more natural choice.


In the original design of MoCFI, PiOS [14] is used to resolve Objective-C calls.

as our experiments revealed, the static analysis performed by PiOS is not always able to retrieve the used Objective-C structures.


The three Feitian devices correctly limit C_SetAttributeValue so thata sensitivekey can never be changed into nonsensitive.

this is of no use, since these tokens let any user directly access sensitive and unextractablekeys (see attacks a3 and a4), disregarding the standard.The Sata and the Gemalto SafeSiteClassicV2 devices are the only ones which allow the sensitive attribute to be unset with no limitation; this is in a perverse sense coherent, as just like the Feitian devices, they let any user access sensitive/unextractable keys.


Among all studies on binary analysis, protocol reverse engineering work, such as [8 10, 21, 39], is also closely related to AUTO PROB E. We adopt similar approach as in [6] to .gure out the semantics meanings of malware s request.

one difference between AUTO PROB E and existing work is that AUTO PROB E does not attempt to understand the complete protocol of malware s communication, and AUTO PROBE uses many other different techniques to aid the generation of .ngerprints.


However, in pretty much all work thus far, the burden of sanitizer placement has fallen on the developer.

sanitizer placement in large-scale applications is di.cult, and developers are likely to make errors, and thus create security vulnerabilities.


Another option,as discussedin[22],isto associateone MerkleTreeandonchip secure root per process.

managing multiple Merkle Trees results in extra on-chip storage and complexity.


For example, we characterize City, and ZipCode as PUB-LIC because they pose no threat.

when StreetAddress is added, the composite data element is collectively named Address, which we characterize with an SPI meta-tag because it uniquely identi.es a patient s physical address.


RELATED WORK The existing literature does not include extensive work on remotely discovering the security policy of a firewall or on attacking network firewalls using low rate DoS attacks.

there exist firewall analysis tools to optimize and detect misconfiguration in the firewall security policy as reported in [2,3].


Privacy-Friendly Planning of Energy Distribution in Smart Grids Tassos Dimitriou Ghassan O. Karame Computer Technology Institute NEC Laboratories Europe Athens, Greece Heidelberg 69115 Kuwait University, Kuwait Germany tassos.dimitriou@ieee.org ghassan.karame@neclab.eu ABSTRACT The smart-grid is gaining increasing attention nowadays, owing to its premise to o.er increased reliability, performance, and a balanced utilization of energy.

the current design of smart-grids raises serious concerns with respect to the privacy and anonymity of users.


Thus, mouse dynamics generally and our .ne-grained angle-based approach in particular, are very robust against online forgery.

how vulnerable mouse-dynamicsbased approaches are to o.ine attacks, especially generative attacks which create concatenative synthetic forgeries [3], is still an open question and will be investigated in our future work.


informatik.tudarmstadt.de ABSTRACT Research on Physically Unclonable Functions (PUFs) has become very popular in recent years.

all PUFs researched so far require either ASICs, FPGAs or a microcontroller with external components.


However A gets at most t(t +1)+ t = t2 +2t values from t wires, controlled by it in top band.Hence A lacks one value implying m = Q(0, 0) s perfectly security.Moreover if A controls at least one wire in the bottom band, then during Phase II A will know the information corresponding to the con.ict graph.

this information will not give any extra information to interpolate Q(x, y)and retrieve m. D lemma 1.


On the one hand, this mechanism can be push-based if the attacker sends the command, e.g., to all bots within an IRC channel.

the infected machines can periodically pull for new commands and send requests to the attacker.


On one hand, this can be dismissed: Babel targets the networks of the future more so than the present.

there are a number of optimizations that can be employed to bring this future a little closer.


4.1 AnOverviewofArchitecturalSupporton Itanium To hide the high latency of memory operations, Itanium is built with the supportfor control speculation, which allowsinstructions to be speculatively executed before knowing whether they need to be executed or not.

executing such speculative instructions might cause exceptions, which might not belong to the normal behavior of the program.


(ii) Non-repudiation: Based on the identi.cation algorithms, the accused traitor with index h has found to have   at least l1/w many matchings with the pirate codeword at the outer level.

this does not necessarily mean that the traitor was actively using its private input in all of these l1/w a.liated pirate inner codewords.


Hence, phishing attacks are bound to fail.

this property only holds, if the password is entered only in BetterAuthenabled input .elds (see Sec.


{Converge, Diverge, Restrict, Extend, Shu.e}be similarity values.

if pm speci.es Permit Override and pn speci.es Deny Override , the policy similarity between pm and pn is computed as follows: RPermit Deny {Converge,E xtend ,Ri }= Extend RPermit Deny {Diverge ,Ri }= Diverge RPermit {Restrict,Shuffle,Ri Deny }= Shuffle if pm speci.es Deny Override and pn Permit Override , the policy similarity between pm and pn is computed as follows: RPermit Deny {Converge,Restrict ,Ri }= Restrict RPermit  {Diverge ,Ri Deny }= Diverge RPermit  {E xtend,S huf f le,Ri Deny }= Shuffle .


Content-dependent access control, such as [1], tries to enforce access control to objects in digital libraries based on the content of objects, described as concepts associated with authorization objects.

it has to have some mechanism in place to extract concepts from documents and build a conceptual hierarchy.


Thus, our aim is analogous to that of the MAC targeted policy, where services should be con.ned from having permissions that enable host compromise.

the same challenges arise here, as services are responsible for making decisions over the creation and use of security-critical resources, such as VLANs and VMs.


If the learners identify the benefits of attaining the knowledge being taught, then they would be happy to learn about it.

if the learners do not see how the educational content would benefit them then they would be irritated when education is forced upon them.


As we do not perform any automatic input generation based on the taint information the correctness of the chosen type is not critical.

the type of in.uence an attacker has is used in prioritizing results and thus it does have some importance.


[4] who propose a secure blocking scheme to reduce costs.

their approach works only for a speci.c comparison function, whereas ours can be used with several such functions.


The true oracle gets the decryption envelope r)aa)r key K by dividing e by da =(g =(g .

in a)r our simulation for key g, g a we will have divided e by (g and then performed the same authenticity checks.


AES-GCM is approved up to Top Secret level in governmental and military use when appropriately implemented [24].

the security of AES-GCM is widely seen as brittle [5, 6, 25, 27, 33].


The above step completely identi.es all sensitive operations that access resources that are managed by the underlying operating systems.

there are other forms of sensitive resources that are purely manged by the Java virtual machine.


The solution is trivial: the cost of the faulty device is evaluated against assurance requirements and the administrator may proceed to an update/upgrade.

the policies become more and more contextual and, consequently, more complex.


We conducted preliminary tests and noticed that the press signal is evident in laptop keyboard recordings.

the release audio signal either had very low volume or was not noticeable at all in the recorded signal.


There are also some works [27, 9, 17, 5, 32] that these authors employ to prove AND, OR and NOT statement about attributes, e.g., a user has attribute a OR b, basically by showing that some committedvalue equalsagivenvalueOR some othergivenvalue.

we achieve such proves by showing that some given attribute value (encoded as a prime) divides (or does not divide) a committed value, which turns out to be much more ef.cient (of course to show that such relations hold we employ some of the mentioned techniques).


How these dynamic IPs are able to attain minimum support remains an open question.

it is clear this area demands more research.


Although this approach is not the most general strategy to specify an obligatee,ouraccountability decisionprocedurerequires every obligation to have an individual user statically associated with it.

in the Role expression scheme multiple users can satisfy the role expression speci.ed in the obligation policy rule.


Opaque objects have minimal memory overhead because the only additional storage is a 32-bit taint tag.

transparent objects have their .elds interleaved with taint tags and so the object size is almost doubled.


We point out that ARBAC97 explicitly mentions using RBAC to administer RBAC as a design goal.

the interpretation of using RBAC to administer RBAC is different from ours.


Changing one s identity raises certain concerns since finding another descriptive name for an individual may be difficult per se.

the more important point is the complicated infrastructure (e.g.


This is possible because an anti-malware kernel module can scan third party drivers and processes as they are being loaded.

if a signature for the malware is not known or the malware installs itself through an undocumented interface (e.g.


The receiver of a signed document can verify the signature to ensure that the document is signed by a group member.

no one except the trusted group manager can recover the exact identity of the signer.


The richer the auxiliary information is, the better it can enable the generation of a precise CFG.

richer auxiliary information implies more analysis time is needed for generating and merging the information and for producing a CFG from the information.


CONCLUSIONS AND FUTURE WORKS Facing the high-dimensional and correlated data, the traditional way to manually assign a set of semi-id features is not able to protect data privacy from being deduced.

most of existing privacy preserving algorithms seldom study this issue.


The Internet has become just like real world: both good and malicious individuals have access to it.

unlike the real world, it has become increasingly di.cult to identify and trace Internet users.


Our initial expectation at the beginning of the project was that porting a browser plug-in that is written for Firefox to IE could not be too dif.cult; after all, browser plug-ins are conceptually similar.

creating an anti-phishing browser plug-in for the IE proved to be much more challenging than expected.


This decision provided that port scanning, by itself, does not create a damages claim (i.e., that direct harm must be shown to establish damages under the CFAA).

we are also sensitive to the ethical issues resulting from the perception of a threat, especially when no greater good is achieved, and thus we are careful to restrict our network probes to services that are designed to be publicly facing TCP port 80 (the standard port for HTTP Web service) and TCP port 443 (the standard port for HTTPS Web service).


Studying a technical subject or working in a technical .eld were not correlated to having an Android phone.

if technical features are an important factor for the choice of the smartphone, the person is signi.cantly more likely to have an Android phone (variable Technical features, p < 0.001).


Similarly, in case of over.ow, y is always less than r. The above observation is clear from the fact that y = x + r if there is no over.ow.

if there is an over.ow, then y = x + r - N .


An important flawed assumption in these security devices is that users are trustworthy and unlikely to breach security.

this is proven false by the high incidence of successful social engineering attacks that lead to security breaches.


Benign samples do not interfere with the process of these inputs.

network sni.ers and stealth backdoors access these inputs for di.erent purposes.


In particular, researchers have proposed designs for secure processors which utilize hardware-based memory encryption and integrity veri.cation to protect the privacy and integrity of computation even from sophisticated physical attacks.

currently proposed schemes remain hampered by problems that make them impractical for use in today s computer systems: lack of virtual memory and Inter-Process Communication support as well as excessive storage and performance overheads.


Once one of these devices is cracked, the whole system will be compromised.

by actual implementation, we found that batch veri.cation is not as e.cient as they argue.


4.7 UnifyingRule/PolicyCombiningAlgorithms Problem: Inthe sequentialrange rule representation, there is onlyone rule combining algorithm, whichis First-Applicable.

xACML supportsfour rule(orpolicy) combining algorithms: First-Applicable, Only-One-Applicable, Deny-Overrides, and Permit-Overrides.


Apparently, the scheme only with frequency-domain adaptation can reduce the receiver complexity and still preserve common performance.

frequency-domain adaptive equalization shows a worse BER performance if Ng =0 (no CP extension).


5.2 Wrapper The wrapper[11], by itself, does not evaluate feature subsets.

it runs any arbitrary (according to the setup) classi.er and uses it as the evaluation criterion.


Demo Overview: Privacy-Enhancing Features of IdentiDroid Daniele Midi Oyindamola OluwatimiBilal Shebaro Purdue University Purdue University Purdue University dmidi@cs.purdue.edu ooluwatimi@cs.purdue.edu bshebaro@cs.purdue.edu Elisa Bertino Purdue University bertino@cs.purdue.edu ABSTRACT As privacy today is a major concern for mobile systems, network anonymizers are widely available on smartphones systems, such as Android.

in many cases applications are still able to identify the user and the device by means di.erent from the IP address.


In summary, through analytical and simulation results, we can see that our protocol does not add much overhead compared to the hop-by-hop aggregation approach, but is more secure.

as the no-aggregation approach, our protocol provides security, but with much less communication overhead.


Since only principals with quota can execute these commands, and all quota ultimately comes from Llamabox, this creates no danger of allowing unauthorized sliver creation.

the ping of death command shutdown can only be issued by the Llamabox central of.ce principal L,which is typically a role of the OTA authority.


For example, information for establishing vertical trust in an entity can be gathered from digital certi.cates such as X.509 credentials, LDAP directories operated by trusted organizations, quasi-certi.ed attribute data in social networking pro.les, or public databases (e.g., voter registration databases).

information gathered from reputation/recommendation systems, informal polls run by various web sites, logs generated by intrusion detection systems, or historical QoS data can be used as a basis for establishing horizontal trust in an entity.


For systems in which our assumption does not hold, robust fuzzy extractors [43, 44] are able to detect helper data manipulations.

the proposed robust fuzzy extractors require additional decoding e.ort, PUF bits and helper data.


Where the necessity of avoiding con.icts is highest, technical controls could be used to enforce the elimination of such normative con.icts.

these approaches are expensive and have implicit usability issues.


Also, using Intent to deliver user information is not always the best choice for application developers; 3) modifying target applications to log down user data can avoid the decryption.

this approach is subject to scalable problem since we need to rewrite speci.c modules for di.erent applications, which is tedious and pleonastic.


CONCLUSION  The notion of using a trusted device to secure transactions on a less trusted terminal is well-known [27][28][29] .

these methods propose their own protocols/frameworks, making it difficult to interoperate with other identity systems.


Thus, low variation is still an issue in static settings.

for nonadaptive wormholes to remain undetected, RSSIW A,i should be similar to RSSIW B,i for all i.


If a car switches it s pseudonym, an attacker can correlate new and old pseudonym based on the cars Figure 3 Example Blackboard Interactions location.

not all applications require such accuracy, which motivates flexible data aggregation mechanisms.


When acting in I-mode, s must be able to satisfy a client s request completely by acting alone.

when acting in C-mode the agent s acts with other server agents of the e-collective to satisfy a client s request to perform action a.


The underlying assumption is that if a credential is not disclosed, information in that credential will not be known by others.

depending on the way two parties interact with each other, one s private information may .ow to others in various forms.


Several articles target issues related to developing security education within the scope of full scale educational programs, see, e.g., [7, 13], but detailed information on secu rity courses of various kinds also exist, see, e.g., [8, 9, 12].

speci.c information regarding courses with similar prerequisites as the one described herein, i.e., a short course especially tailored towards military o.cers with limited computer knowledge, has not been published widely.


A Practical Property-based Bootstrap Architecture René Korthaus1 Ahmad-Reza Sadeghi1 Christian Stüble2 rene.korthaus@rub.de ahmad.sadeghi@trust.rub.de stueble@sirrix.com * 1,3  Jing Zhan jingzhan_whu@yahoo.com.cn 1Horst Görtz Institute for IT-Security 2Sirrix AG security technologies 3Computer School Ruhr-University Bochum, Germany Germany Wuhan University, China ABSTRACT Binary attestation, as proposed by the Trusted Computing Group (TCG), is a pragmatic approach for software integrity protection and veri.cation.

it has also various shortcomings that cause problems for practical deployment such as scalability, manageability and privacy: On the one hand, data bound to binary values remain inaccessible after a software update and the veri.er of an attestation result has to manage a huge number of binary versions.


His intended policyfor whom he will allow to have access tothelabisfairly restrictive, withonlyafew staffmembers given access.

if an incident occurs (e.g.,a.re)he trustsamuchlarger numberofpeopleto enter the lab (e.g., in order to shut down expensive equipment).


They view obligations as state machines and can express pre-obligations, post-obligations, statefulobligations, etc.

they do not consider obligations requiring authorizations and in turn do not concentrate on deciding accountability.


While it is understood that W.X is not foolproof [26, 10, 11], it was thought to be a suf.ciently strong mitigation that both Intel and AMD modi.ed their processor architectures to accommodate it and operating systems as varied as Windows Vista [13], Linux [25, 21], Mac OS X, and OpenBSD [17, 18] now support it.

in 2007 Shacham demonstrated that W.X protection could be entirely evaded through an approach called return-oriented programming [23].


Thus the jump is not executed in the checked program.

using signals and interrupts is deprecated on iOS and not supported by Objective-C. Inline assembly.


[18] found that the PassFaces scheme with user-chosen faces, which is the proposed standard, is quite insecure: user s choices of faces are very biased, basically towards the user s race and towards female faces.


LIMITATIONS AND FUTURE WORK One of ClickMiner s primary applications, as demonstrated in Section 8, is the after-the-fact replay of user-browser interactions before and up to the occurrence of a security incident.

potential attackers could seek to thwart our analysis by reducing the ability to replay the recorded incidents.


4.1 Boot-time Entropy Hole of LPRNG LPRNG is designed to be supplied with external entropy when system events such as a disk I/O operation, user input, and IRQ occur by calling the following functions: add_disk_ randomness(), add_input_randomness(), and add_interrupt_ randomness().

we found that add_interrupt_ randomness() is not used in an Android device, which was already reported for other Linux platforms [11, 24].


5.4.1 Theoretical Fastest Time for a Proxy Attack In an Ethernet-based proxy attack, to explore the best case for the attacker,we assume thatboth theperipheral and the proxy helper need no time to prepare the network packets.

the packets used in a proxy attack must go through the hardware Ethernet MAC (physical serial communications port) of the NIC.


For example, at the cutoff, basic20 and basic16 are the third and fourth strongest conditions, respectively.


Several approaches have been proposed that de.ne a substrate for de.ning logics with the aim of making these different logics interoperable [3, 23].

the substrate itself typically imposes constraints that can severely restrict the design of logics that are de.ned in it.


The main purpose of a location hidden service is to remain anonymous while serving its clients.

we show that when a Tor relay o.ers a location hidden service, it becomes susceptible to attacks.


Among the full.edged multi-user schemes we surveyed, SDE [19] is the most e.cient for encrypted search.


The basic technology which underlies this infrastructure seems solid enough: the system uses a proper PKI with smartcards for authentication of (registered) health professionals, it uses decentralized storage of patient records at the source rather than a potentially more risky centralized approach, and it uses a central infrastructure to control access to those patient records, including access by patients8 .

in its details the current system s architecture falls short.


The chosen con.guration gives measurements with very little focus on how setting up new connections within the different protocols perform.

it is very common that a user sends a multitude of requests to a server.


The watermark must be sensitive to malicious attacks.

at the same time, it also has to be insensitive to allowed modifications.


It may seem more natural to implement range checks to identify stale pointers rather than using tag bytes.

in general a stirred binary may consist of many separate modules, each of which has undergone separate stirring, and which freely exchange stale 1Some x86 instructions lengths can change when .


[18], discuss a new security language to express access control requirements over concepts in ontologies.


Since these certificates can form any sort of topology, this seems a very flexible system.

this form of delegation is extremely limited, since the issuing CA can only delegate authority over concisely representable portions of the namespace.


CONCLUSIONS AND FUTURE WORK The need for high-assurance architectures that implement multi-domain information protection mechanisms is widespread and growing.

such architectures will not be adopted unless they provide users with currently required functionality, the ability to easily incorporate new applications and software updates, and a familiar interface.


544 packages in our mal ware datasets were signed with it.

1948 innocuous packages in our Carat dataset (several of them used to be in Google Play) were also signed with the same key.


Their algorithm uses a host of classi.ers that leverage the aforementioned image properties like color distribution and semantic features.

only one of their classi.ers makes sense to apply to line drawings: the support vector machine (SVM) based on edge detection histograms, for which they used the technique of Wang and Zhang [21].


First, it means the group of potential signers is restricted to being static: it must be decided and .xed before signing can start, and new signers cannot be added later.

in practice the potential set of signers is dynamic and may not be known ahead of time, and we would like to be able to add potential signers at will.


Note that on both datasets, AUTO PRO BE can generate .ngerprints for all the malware, even those with no response, for which CYBERPROB E cannot.

this demonstrates a clear advantage of AUTO PROB E. For the samples with a response in Dataset II, CYBERPROB E is able to generate a .ngerprint similar to AUTO -PROB E. for 57% of those, AUTO PROBE produces probes construction functions with variable .elds rather than concrete probes in CYBERPROB E. Thus, AUTO PROB E probe construction functions are potentially more accurate.


Policy languages in our view should allow for more structured and compositional approach to speci.cation that allows for the analysis of con.icts, information-.ow and other high-level properties.

for studying the e.ect that the enforcement of a policy has on mutable attributes the abstraction level is indeed suitable.


After these attacks, most of the wa termark energy still exists in the host image.

in order to detect it, synchronization of the whole image or a subimage is necessary.


By de.nition, a fast spreading worm will start to infect others as soon as it successfully infects one host and thus will always be contained by WormTerminator.

a few normal network applications may exhibit a similar tra.c pattern as that of a fast worm, and special care is needed to di.erentiate such tra.c from the worm tra.c.


[20] develops a sophisticated static analysis to automate the identi.cation of function pointers that could be hijacked for this purpose, and the same techniques could be applied here.

in practice, we have found that persistent interposition attacks require very few functions to be interposed, and those can be easily identi.ed by dynamically tracing the sequence of function calls made by the victim application.


{0, 1} * and each message is either fully shared or not shared at all with a user.

a graph G(V, E) is a set of nodes and edges, where each node may be represented by x, and a user may have access to one or more subgraphs instead of the complete graph.


3.3 Scalability and Availability There are well-known and proven design architectures for creating highly-scalable and highly-available software systems for servers.

most of the work in creating such software requires addressing basic infrastructure requirements such as authentication, authorization, logging, performance management, scheduling, persistence, etc.


These services often ask users to authenticate using text passwords; this requires typing on mobile devices.

modern mobile device are heavily graphic-oriented and touchscreens are often the primary input method even for typing.


Similar ideas have been proposed in [20] and [21] to detect code injection attacks.

our study indicates that this event is e.ective for detecting not only code injection attacks but also the other two types of stack over.ow attacks.


s scheme and slightly higher than Tseng et al s scheme in terms of the first three phases (registration, login, and authentication).

the proposed scheme has advantage over both the existing schemes as the former has better security features.


Private classi.cation considers the scenario where the training data is divided between two or more parties with possibly con.icting interests, so that they are not willing to reveal their data.

the parties are willing to train a common classi.er provided that none of them can use it without others and that their data remains private.


Heuristic search can be used only when the modulus is known in advance and a preprocessing step is thus possible.

many algorithms are known, which can guarantee shorter sub-optimal addition chains, such as: binary methods (RL-algorithm, LRalgorithm), M-ary methods, Power Tree, etc.


For each cost multiplier c, we plot the fraction of static sensors contained in the approximate solution, as well as the demand-weighted error incurredby this solution.For c =1, only static sensors are selected.

even for c =2, only a small fraction of static sensors are selected, which indicates that the mobile sensors very quickly become more cost-effective.For c = 4, no static sensors are selected.


They assume the existence of a set of private databases that should be opened up for queries from others without giving complete access to the raw data a common scenario in business relationships.

we present a scheme for directly sharing information across a covert channel, without other parties being aware of this fact.


Tremendous research have been carried out in this field, especially focusing on various scheduling algorithm for users quality of service (QoS).

it is hard to fulfill multiple QoS parameters because these algorithms aim for focusing on satisfying a certain QoS parameter.


Our code was added to OpenSER s authentication module.

it was also necessary to modify OpenSER s core components to enable batch requests.


SCA prescribes access control by only allowing objects within the Domain Manager process space to use the resolve() and list() functions to restrict access to object references outside the Domain Manager process space [SCA].

once an object has the reference, there are no further authentication checks when a method is invoked using this reference.


Other work provides implementations of this .le chooser widget for both Windows and Solaris [10, 22].

their implementation only handles explicit authorization for one speci.c widget type.


The use of master device is on the one hand less cumbersome for the user, since he only has to introduce the new device to the master device.

a centralized component although usually of.ine  was introduced, which could become the primary target of an attack.


Many other proposals for host-based anomaly detection may be found in the literature [3, 2, 8, 26, 21, 5, 14, 15, 4, 26, 12, 13, 17, 27].

pH is fairly typical, in the sense that many host-based IDS s rely on recognizing attacks based on the traces they produce, be it traces of system calls, BSM audit events, or Unix commands.


In this paper we rendered models only with a simple line drawing style.

there are many styles available, even within the realm of line drawings (Figure 7).


In some cases it may not be feasible to take down identi.ed C&C servers in a timely manner.

even in such cases a blacklist of C&C servers, such as the ones provided by FIRE [20] or Zeus Tracker1, can be extremely useful.


In fact, as we will present in Section 6, the heuristic works with all real applications that NativeGuard has been tested on (around 30 applications).

the drawback is that the approach does not support native code that requires privileged access to the devices.


With an abstract view of the hardware such as CPU registers, memory, and I/O devices, it enables down-to-byte comprehensive infection diagnosis by auditing the emulated hardware.

the semantic gap [5] really exists because it lacks the meaningful information of operating system semantics.


There may be one STS for the domain, and establishing trust between all of them provides the baseline for validating subsequent crossdomain interactions.

the same service can be offered in several different collaborations at the same time.


In RBAC1, users u1 and u2 are assigned to roles r1 and r2.

in RBAC2 user u1 is only assigned to role r1 and user u2 only to r2.


Hence, the password for establishing a secure channel cannot be stolen by a malicious application.

the methods discussed in this paper would still help to secure the data path between application and applet after password entry.


After changing to v1.5, EIA3 does not su.er such attacks any more.

it is still not immune to our new attack, which will be presented in Section 3.


For example, the permission to use Microsoft Word is not very speci.c and will therefore not distinguish any role.

access rights for a geo-information system, a database of telecommunication lines, and certain transactions in an ERP system may well identify a speci.c engineering role in a Tele-Communications company.


The results of our study are mixed: In line with previous work, the system attains a high detection rate of 93% if applied to manually veri.ed data.

in a fully automated setting it identi.es only 67% of the malicious code in webpages irrespective of the used features and learning methods.


PASSWORD RECOVERY ATTACK ON MD4(P || C) This section will propose a password recovery attack on authentication protocol MD4(P || C), which is a differential collision attack.

instead of utilizing real collision of MD4, we will propose a new pseudo collision of MD4, which will greatly reduce the complexity.


For instance, [19] proposes an access control model for replicated databases.

authorizations are timestamped and hence the solution could not be applied in a P2P context.


The .rst signature scheme provably secure in the standard model was proposed by Goldwasser, Micali and Rivest [15] in 1988.

their construction was only theoretical and impractical.


The user has to listen sequentially to each clip in order to identify his or her clip.

we have to offer a decent number of alternatives in order to provide an acceptable level of security.


The abovementioned ThSS schemes consider splitting the secret s among n users by giving each of them one share.

we might have di.erent levels of trust for di.erent users or we might want to make some of the users more important than the others.


3.1 Finding Convergence Usage Data An ideal investigation of any alternate CA proposal would include an empirical study of its usage in the wild, but this is presently impossible for Convergence due to a lack of users and infrastructure.

through consultation with a major university s network services, we overcame this obstacle we obtained anonymized net.ow data of HTTPS tra.c from the university s network gateway, which we then used to synthesize a realistic Convergence workload at university scale.


However, since with increasing polynomial order the false positives increase, the cloud has to perform the PEES computation more number of times to retrieve the key.

this number is of the order of 10 computations as opposed to 290 for the attacker.


There are many performance and complexityrelated challenges to building such hardware, including multiple levels of address translation, privileged instructions and virtual devices.

if it were available, we suspect that a Haven-like shield module would be a suitable architecture to protect unmodi.ed guest VMs from a malicious hypervisor, since the same trust issues addressed by Haven in the OS also arise in VM interfaces.


We show in Figure 5 that the performance of the .-system allows for deployments in real-world scenarios.

corner cases exist that could impact an actual deployment, if the di.erence between the base and current version of a web site is partic ularly large.


Clearly, such an adversary would succeed, as the data passed between the PUF and the CC occurs in the open.

this attack model is so extreme that only the most dedicated and motivated adversaries would undertake such a task.


Two basic safety properties that all software fault isolation systems enforce is memory safety, which guarantees that a module can only access memory that it owns or has legitimate access to, and control .ow integrity, which guarantees that a module can only execute its own isolated code and external functions that it has legitimate access to.

memory safety and control .ow integrity are insuf.cient to provide API integrity, and the rest of this section describes other safety properties enforced by LXFI.


sj, i (1) Likewise, at the decryption side, the it h byte of cipher block is XORed with the it h byte of key-stream sw j, i to recover the it h byte of the plain block mw j, i : w ww mj, i = cj, i .

sj, i (2)  3GPP adopted till now three pairs of standards for DC and DI; (EEA1, EIA1), (EEA2, EIA2) and (EEA3, EIA3).


Thus nodes are encouraged to upload to their neighbors, since doing so o.ers the possibility of faster download rates.

there are still opportunities for sel.shness [42, 34] and free-riding [29, 35].


Using a linear decay function, tightness of the optimal + operator as de.ned in Equation 7 is given by: From Figure 12 we observe that a value function that consists of 100 piecewise linear functions can be approximated with only 4% overestimation (tightness = 0.04) using a cubic spline over 10 control points.

it is harder to approximate exponential decay functions; a cubic spline over 10 control points approximates the exponential decay function (see Figure 13) with about 21% overestimation (tightness = 0.21).


This suggests something good about Bishop s enforcement mechanism when compared to the Brewer-Nash enforcement mechanism: the *-rule is not overstated.

a closer examination of our counterexample shows a somewhat peculiar behaviour by the system.


In a distributed setting like that for HAIL, it is possible to obtain such check values from the collection of service providers itself.

distributed protocols for checking .le availability are largely underengineered: Lacking robust testing and reallocation, they provide inadequate protection against mobile adversaries.


Traditional Global Positioning Systems (GPS) [10] are effective in general purpose location reporting.

it is not a suitable option in terms of security and indoor tracking.


To ensure di.erential privacy, the standard technique is to add Laplace noise to query answers.

network data can be very sensitive to relatively small changes in the network structure.


Only in the third scenario, all code is in place to runthe .attenedprogrampart.

duetothenature of opaquepredicates, the attackeris challenged toprove that the generated label value (and thus the execution as well) will always be the same.


In this case, the 4-tuple (ej, "g, r, TEj ,-~7~), if present in a set of IST~C, should be removed from the set.

if this set becomes empty, the update of ~.ak is rejected.


However, once an attacker manages to get access to these systems, the negative impact will eventually be high; for instance, shutting down a primary substation node could a.ect whole city districts.

security breaches targeted on decentralized components, which are deployed typically in the Functional Buildings and Customer Premises domain, are much more likely as attackers can easily get hold of these components.


North bridge con.guration registers can be accessed by any core on any node.

each processor core has its own general-purpose registers, MSRs, APIC, and two  Memory Control Hub Memory Control Hub (North Bridge) 0 (North Bridge) 1 -Configuration -Configuration registers registers -I/O space register -I/O space register -L3 cache -L3 cache Figure 3: General multi-core processors architecture levels of cache.


Cryptography practitioners usually assume that parties have access to perfect randomness.

quite often this assumption is not realizable in practice and random bits in protocols are generated by a Pseudo-Random Number Generator (PRNG).


Figure 4: Example of Policy Tree, where bold nodes are used for mail.a.com policy s presence proof.

the structure of the policy tree also has a drawback: the size of a log proof is not quite logarithmic in the number of nodes.


For the device key, we don t consider physical attacks that fall outside the defense capabilities of TrustZone technology.

if the device key is compromised by physical attacks, we can deploy a new one by running the key update protocol, which mitigates physical attacks on the device key.


Secondly, the transition score of hi to hj shows that for an attacker in hi, hj is an easy and attractive target.

if hj is not in Ki, or it is within the same WCC as hi, the new mapping is determined using the random mutation.


Itis likelythattheearly adoptersofSpySaver will not seeadirectbene.t.

each single adopter forges tens of fake Web users, so even a modestdeployment shouldgenerate a signi.cant amount of counterfeitinformation.


ag@path[nl, n] for certain u such that 1 = u = l - 1.

then there is a path from nl to nu associated with p. DS.PaPB.


Furthermore, it is computationally quite inef.cient too.

liu and Terzi [5] de.ne a graph to be k-degree anonymous if for every node v, there exist at least k-1 other nodes in the graph with the same degree as v. The .nal anonymized graph is constructed by using a k-anonymous degree sequence computed from the original degree sequence.


However, existing ICT-related risk management processes are not directly applicable to the smart grid domain as the technology and the security requirements are signi.cantly di.erent.

readily available smart grid security guidelines such as the Protection Pro.les [3, 4] developed by the German Federal O.ce for Information Security (BSI) merely focus on smart metering and thus do not map to the entire smart grid architectures deployed.


This means that naively limiting the search space can damage the e.ectiveness of symbolic execution.

guided by event-space constraint graph, normally less than two hours are needed to explore the limited exploration space, and extract app inputs corresponding to the sensitive data transmission, without sacri.cing the code coverage.


The security of the management software in Xen[12]is also improvedby moving thedomain(i.e., VM)building utilitiesintoaseparatedomain[44].

thesesystems aim at protecting the virtualization layer from external attacks to the VM stack, but without considering possible attacks that leverage legal maintenance operations from the cloud operators, which is a new requirement in multi-tenant cloud.


This technique is also used and implemented in the so-called horizon charts, which properties has also been compared in [7] against line charts.

using color to represent the value, restricts the further usage of color for highlighting critical or suspicious segments, which is an important feature in our system.


Federated identity solutions such as Liberty Alliance Project [23] and Shibboleth [20] enable cross-domain single sign-on.

to provide a higher level of identity assurance, these solutions require pre-established trust relationships and agreements between organizations in the federation, which making them hard to scale on the Web.


The implied assumption is that systems do not change after accreditation, and if they do, manual re-accreditation is necessary.

today s agile, interconnected IT landscapes blur that boundary between design time and runtime: IT landscapes dynamically evolve, i.e.


If X ' = X then, by non-malleability, the value R ' is unrelated to the random key R and hence the value s ' = MACR' (µA) will not help the adversary produce a valid tag s under the key R not even to authenticate Alice s actual message µA!

if X ' = X then R ' = R and hence we can rely directly on the security of the MAC to ensure that µB = µA.


A may also control one or more DMA-capable peripherals.

we assume A cannot gain control over the hypervisor or the underlying hardware (e.g., chipset, TPM).


End Figure 2: Pseudo cede for the generation of a transaction token 6.3 Resynchronization of Card Holder and Card Issuer The authentication scheme described on section 6.2 is based upon the synchronization of grammar and history set between the card issuer and the cardholder.

there is a possibility that a cardholder generates a disposable credit card number and later decides not to use it or the number is garbled by noise on the communication line.


Tenants can control log sizes by selecting the number of tagged form .elds.

the actual workload can affect log sizes beyond tenant control.


Therefore, the number of cumulative new IP addresses that we saw over time increased linearly, as shown in Figure 7.

the aggregate numberof new bots observed decayed quickly.


Particularly, the car owner O can authenticate the user U based on a visual contact, while both platforms can use a secure channel based on a key established via NFC3 .

3Note that the NFC link is commonly assumed not being NFC proximity cannot be used to securely enter context-aware access control policies.


The 2006 CDF is virtually a straight line, indicating no signi.cant hot-spot activity in this tra.c.

starting in 2008 a knee starts to form in the CDF which indicates the emergence of hot-spot activity.


Thus, all applications run by a user have access to all .les by all other applications run by the same user, and the user s personal .les.

android assigns UIDs on a perapp basis [1].


Intrusion Detection In recent years, intrusion detection systems for wireless sensor networks have become a major research issue and several approaches have been proposed.

to our best knowledge, the only countermeasure applied so far was to (logically) exclude malicious nodes.


7.2 Reasoner Any reasoner that supports SWRL rules can be used to perform the inferences described in this paper.

we chose SweetRules4 because it interfaces with JENA and has a rule-based inference engine.


7.7 Preventing Arbitrary Rating Fluctuations In the Math Garden case, it can be reasonably assumed that there are no rapid major changes in the populations of children and problems that cause major variations in the ratings.

in case of threats, a very successful virus (say), may suddenly become very unsuccessful after a patching round.


Being equipped with this features, the SIM card appears to be a good basis for providing MTM functionality.


Existing evidence clearly reenforces the common wisdom that embedded devices are generally less secure then general purpose computers and are often trivial to exploit.

the available literature tends to focus on speci.c vulnerabilities or vulnerable devices.


,N}, he sends packing reduces the communications cost, it also introduces them to Alice.

we can deploy data packing as in an extra computational burden to Bob.


One of our criticisms of traditional security systems has been their "all or nothing" approach.

there has been some work that attempts to characterize degrees of security provision, as embodied by the idea of "quality of security service."


For privacy, on the other hand, the only information that an active adversary might possibly get about W and which depends on Xkey, is the tag s ' = MACR ' (Xkey).

s ' is independent of W auth when conditioned on R ' Therefore, the keys RA,RB are auth.


ripal Nathuji Microsoft Corporation 1 Microsoft Way Redmond, WA ripaln@microsoft.com  Paul England Microsoft Corporation 1 Microsoft Way Redmond, WA pengland@microsoft.com forms, decoupling the service provider (SP) from the platform owner or the cloud infrastructure provider (CIP).Such a model has potential for huge cost savings for service providers as they avoid the signi.cant .nancial overheads associated with deploying, maintaining, and managing datacenter environments, and instead pay just for the usage of these re-sources.this bene.t comes at a price -the separation of service and infrastructure providers implies that the service provider has less control over the service deployment, and must trust the CIP to uphold the guarantees provided in the service level agreement (SLA).An SLA works as a contract between CIP and service provider, and provides guarantees either in terms of low level resource provisioning, e.g., X number of CPUs with some computational capacity and Y Mbps network throughput, or in terms of higher-level goodput value(s) for the service, such as Z ops/second.


in sensor networks, this may provide an adequate level of security.


In this paper, we focus on how a BitTorrent-like .lesharing system might use endorsed e-cash, because the dynamics of BitTorrent are better understood than less popular peer-to-peer systems.

we believe that e-cash is more widely applicable, and outline how to apply endorsed e-cash to applications such as distributed lookup, computation, storage, and onion routing.


Our Troubles with Linux and Why You Should Care Ashif S. Harji Peter A. Buhr Tim Brecht Cheriton School of Computer Science University of Waterloo Waterloo, Canada asharji,pabuhr,brecht@uwaterloo.ca Abstract Linuxprovides researchers with afull-.edged operating systemthatiswidely used and opensource.

duetoits complexity and rapid development, care should be exercised when using Linux for performance experiments, especially in systems research.


In legacy VMs, Qemu is granted full access to the VM physical memory to emulate DMA accesses.

since Qemu is located in the legacy host, SICE prevents it from directly accessing the memory of the isolated environment.


Thus, those nodes that service a certain port have no protection and do not trigger the SHT.

iDSes used in practice are much better than the one we use and will help in detecting a more sophisticated attack.


SiRiUS [7] was designed for use over a range of storage technologies, includingpeer-to-peer overlays.

it does not address the problem of continued operation in the face of malicious nodes.


Many other architectures have been proposed to protect the more important kernel part against failures of less important kernel parts [8, 31].

our approach has a completely different goal: SP3 aims to protect the user applications running in the least privileged ring against operating system compromises.


Finally, these approaches can only control the bytecode of an application.

applications can load at runtime malicious native code bypassing the injiected security monitor.


One approach to resource assignment would be to uniformly distribute the critical resource among all credit classes.

this design could lead to under-utilization, in cases when most users lie in low or middle credit ranges.


[23] propose the corresponding return-less kernels to defeat Return-Oriented Rootkits.

rOP is recently extended to use return-less gadgets to achieve the same effect [7, 5].


Ine.ective instructions that are context insensitive never change anything regardless of the execution context, e.g., .

context sensitive ones only possess the ine.ectiveness property in some particular execution context, e.g.,  is ine.ective when .ag CF is not in use.


In order to prevent unauthorized access to these services, passwords have been pervasively used in user authentication.

password-based authentication has intrinsic weakness in password leakage.


Note that the newer Ajax technology allows connections to be opened using XMLHttpRequest objects, but with the constraint that the domain of the URL request destination must be the same as the one that serves up the page containing the script [3].

the attacker can easily leak out the information by modifying the URL of a (hidden) image embedded in the page so that the web browser requests this image from a web server under the attacker s control.


Within this school, many recent approaches work essentially by reasoning about all possible traces of a security protocol.

the ways of talking about the traces and their properties vary greatly.


It may seem that if an SSoD policy is satis.ed, then the corresponding SoD policy is also satis.ed.


In closed credential platforms enrollment to services typically happens via the centralized control point.

the exact details of service enrollment process depend on the agreement and the technical implementation between the credential issuer and the control point.3 After service enrollment the control point may provision user-speci.c credentials to the TEE.


White-Box AES which is proposed by Chow is robust White-Box attack when it is combined with other techniques like MEDUSA.

it has some disadvantages that are lower performance and inefficient key update problem.


In each scenario, a di.erent 1For this case study we only require one-dimensional position as will become clear in the next paragraph.

our approach could easily be applied to multidimensional measurements.


Most of these applications require the users to specify security and privacy policies.

ordinary users are typically not interested in (and not capable of) understanding and setting policies.


Partitioning can be done in many ways for example, by utilizing business information, following some other rule of thumb, or even at random.

it has been shown that using business information is typically preferable to the others since it generates more meaningful roles [5].


With outsourced services, the data owner can greatly reduce the cost in maintaining computing infrastructure and data-rich applications.

the service provider, although honestly processing queries, may be curious about the hosted data and received queries.


This is for two reasons: Industrial projects are looking for ways to implement RBAC in large companies and are struggling hard with the transformation process.

role engineering techniques will hopefully be of help in the effort of standardizing RBAC.


Evaluatingthe suitability ofthe content ofthe OSVDB and NVD for our purpose,we found considerable differencesin the lifecycle information they contain.Neitherdatabasecontainspatch dates; and only OSVDB provides exploit dates.

both databases provide a comprehensivelist of external referencesfor each vulnerability.


they provide little empirical data that would demonstrate its feasibility and e.ectiveness.


This was expected; the control dictionary is three times larger than the mnemonic dictionary, and it has been tailored to crack real passwords.

the control passwords fared better than we had anticipated  Klein cracked 24% of passwords with a 63,000-word permuted dictionary, and Yan et al.


Due to such threats, the domain of mobile security has been getting a considerable amount of attention.

current approaches have failed to consider key di.erences and their practical impact on the security of modern platforms when adopting techniques from non-mobile (or .xed ) environments.


In a recent work, Reisted and Toft [13] proposed the .rst constantround linear solution for the SBD problem under arbitrary setting.

we observe that their protocol is still inef.cient (requiring O(K) secure multiplications).


INTRODUCTION Much of the world seems to think that cryptography provides a complete computer security solution.

cryptography is only one piece of the computer security puzzle, a puzzle that becomes increasingly complex as time and technology advance.


In the previous section, we gave an example of a fault analysis attack where some calculation was done on the code, and also an example of a timing attack where a loop was executed a number of times based on the value of the code.

an attacker might have some other way to leak information.


For example, if a machine is lost or stolen and its disk connected to another system where the active protection mechanism cannot be trusted to enforce existing access controls, the data remains inaccessible without the necessary decryption key.

such applications of cryptography in operating system security to date have had signi.cant limitations.


When an emergence or infrastructure failure occurred, a secure and quick communication path to empower VNET in performing the above tasks are very important especially when potential human lives are involved.

in the exceptional situations, many functions of SAT architecture are greatly challenged as well as traditional VNET protocols.


The latter property is important for avoiding unexpected deanonymization, a signi.cant worryinpractice(asNet.ix recentlydiscovered[27]).

applying differential privacy to queries over network statistics poses some fundamental challenges.


For example, if the estimated CSI at a client is encrypted by the AP s public key before sending it to the AP, other concurrent clients cannot decode the CSI and forge CSI based on that information.

this method requires the modi.cation of CSI feedback protocol in both clients and the AP.


Further, all instructions participating in simulating a call or a return may not be contiguous in the code; they may be distributed intermixed with other instructions.

call (ret) instructions may be employed for purposes other than making (returning from) a procedure call.


Most FPGA-based approaches are successful in keeping pace with line speed by exploiting the high degree of parallelism and recon.gurable hardware characteristics.

hardware resource consumption linearly increases as the number of patterns and the number of characters to be stored increase.


In CompleteMiner s static prioritization [19], the priority of a permission set P depends on the number of exact matches, and assignable users.

in all data generation algorithms, multiple roles are assigned to a user.


It may seem straightforward to implement software-based cloaking of Overshadow or SP3 on the secure processor substrate to achieve the same security goal of SecureME.

the fundamental incompatibility in their attack models makes it hard or even impractical to combine them directly.


In the basic DSD-DSSS, the receiver will try all possible paths shown in Figure 9.

the content-based code subset selection scheme can constrain the paths between two seeds (dashed lines) during despreading.


TPM RESOURCES Every TPM can hold only a limited number of sessions, contexts, authentication sessions, and keys.

each TPM vendor implements di.erent limits.


Putting this in another way, that means the security is only maintained when all other key shares are fully share after a certain subset of the shares are fully compromised.

side-channel attacks like power analysis demonstrate that such assumption may not hold in the real world.


LWFS[23] also assumes a secure transport layer allowing it to ignore potential replay and eavesdropping of capabilities.

most real-world systemsdonot employ strong network ortransport security.


That is to say, smart phones are unstable at lying posture.

it does not decrease of accuracy of personal identification since postures can be distinguished with values of the average among three postures.


Here we show the relative time stamp with respect to the start of the logging event.


Most of the observed variation is due to artifacts of Java, such as garbage collection, and thus not under our control.

despite the observed variation, the numbers reported here allow us to reliably quantify the cost of access control.


Each attacker chooses its own target subset independently of the other, along with their target coordinate value.

the target subset size is .xed and equal for all attackers.


Governments and the state are the ones responsible, directly or indirectly, to design policies and oversee the implementation of development agendas and programmes.

this process, which might be complex in some situations, does not necessarily involve the participation of non-state actors.


To encourage adoption by RPs, Web SSO systems have to rely on demand from users as the driving force (line C in Figure 1).

users have no urgent need for SSO as they could use a password manager as a limited version of a personal identity manager [42].


At .rst glance, enabling interrupt delivery while KVM runs may only require setting up the IDT (Interrupt Descriptor Table).

one quirk of the x86 architecture makes this more complicated than it should be: when an interrupt happens, the CPU will save the current state (such as EIP, ESP, and EFLAGS) to the stack so that it can resume the execution of the interrupted task.


We found that skewness in access requests does not affect mean access time for the access matrix and CPOL SDPs.

the number of access requests made in a session has a strong in.uence on SDP performance especially of CPOL with larger access times observed for shorter sessions, which we attribute to not reaching the best steady-state phase fast enough.


We assume that it is not possible to prevent attacks on defense mechanisms that offer these capabilities, just as much as it is not possible to prevent the attacks on the application that these mechanisms aim to protect.

we have showed that the attacker's acqui- sition of privilege can be prevented or slowed down earlier, which makes such attacks on the capabilities more difllcult and time consuming.


In the context of IA-DHKE, one natural interpretation for two sessions ( B, X, Y )and ( A, Y, X ) tobematchingis A, B, that: the players A and B should have matching roles in the two sessions, i.e., if A is the initiator (resp., responder) then B is the responder (resp., initiator) in both of the two sessions.

as the basic (H)MQV is role-independent, for two sessions between the same pair of players A and B but with the opposite order of DH-component exchange (which may be made by a cross-message attack [25]),4 player A (resp., B) thinks it is interacting with a responder B (resp., A), while the session-key outputs in these two sessions are the same.


Since the TCG makes statements about the initial state of the platform only, it is crucial that this state cannot be (maliciously) manipulated after startup, otherwise a veri.er cannot rely on the information provided by the attestor.

currently available operating systems (e.g., Windows, Linux) can easily be manipulated by exploiting security bugs or by changing memory which has been swapped to a harddisk.


It is widely accepted that it is useful to have conditional branching in work.ow speci.cations [20, 22].

there is very little prior work on the work.ow satis.ability problem, or its complexity, for conditional work.ows.


By doing so, in addition to providing identity information, an adversary needs also to provide hardware conforming to a host speci.cation before the identity can be registered.

this indirectly incurs extra cost to both the adversary and the user.


A trusted third party might be able to compute winners and payments to prevent such manipulations.

an auctioneer is unlikelyto reveal the CTRs of all bidders to such a third party, since the method for calculatingCTRs contains important proprietary information.


Note that malicious apps could post shortened URLs that point back to Facebook, thus potentially making our external link counts over-estimates.

we .nd that malicious apps rarely do so.


The system we propose allows for the user to have complete control over their security policy.

some users may prefer delegating the management to a trusted authority, such as an anti-virus company or ISP.


We show that, although any attacker with access to d stored on S P can tell that Alice and Bob are communicating, he cannot tell that there is a hidden message behind d. An attacker cannot link d published on S P to the ciphertext c stored in SS because he cannot compute hd.

s P , HD, and SS might keep logs, record users IP addresses and requests, which could be used by an attacker to match requests made by the same user.


For example, it is required to do Fast Fourier Transform on recorded response in order to generate audio stimulus, so with some code analysis, it is possible to detect the existence of such suspicious operations though it can be hidden into the equalizer processing as if it is enhancing the audio quality.

if an application s original function include FFT operation, then the detection problem is still dif.cult to handle.


5.2 Rabin Function The Rabin function is unfortunately not a permutation.

for particular moduli we can limit its domain and co-domain to convert it into a bijection.


Note that the assigned users and permissions might change as we generate the hierarchical policy, because some assigned users and permissions might become inherited instead.

the authorized users and permissions of each role r never change, always remaining equal to authU0(r) and authP0(r), respectively.


In all these cases, all associated users may be desired to specify privacy policies to control over who can see this photo.

current online social networks, such as Facebook and Google+, only allow the data owner to fully control the shared data, but lack a mechanism to specify and enforce the privacy concerns from other associated users, leading to privacy con.icts being largely unresolved and sensitive information being potentially disclosed to the public.


There may be millions of jump instructions between two system calls and the program path between two system calls can be tampered without being detected under system call sequence based scheme.

checking the whole program path imposes too much cost in terms of both storing normal paths and runtime checking.


The precision issues can be addressed as in [24].

the argument used in [24] to show that pseudorandom-generators can be used rather than a fully random oracle needs to be slightly massaged for our purposes.


The fact that all participants revealed their name or a pseudonym while in the o.ce, combined with the signal strength indication, proved su.cient.

identifying socially relevant encounters in a larger and denser environment with many unlinkable devices is an open challenge.


For a lossy function, the encrypted matrix M is the allzeros matrix M = 0.Then for every input x,the value f(x) is an entry-wise encryption of the all-zeros vector, so f intuitively loses x.

this alone is not enough to ensure lossiness, because the output ciphertexts still carry some internal randomness that might leak information about the input.


Therefore, when the credential is shown, the service provider does not need to recheck those certi.cates, as long as it trusts the top level CA.


4.1.5 Checking System Calls Monitoring theuseof tainteddataincritical operationsis the same as in the whole-system emulator.

being in user-space o.ers us the chance to expand operations that are monitored to include certain system calls.


Privacy-enhanced revocation also allows for subjective judging [26], where SPs can re voke users at their discretion since the privacy of users is not at risk.

tTP-free schemes such as e-cash [4] and k-Times Anonymous Authentication (k-TAA) [25] support accountability in only narrowly de.ned applications where misbehaviors can be mapped to too many authentications (such as double spending a digital coin).


Most research on passive steganalysis has focused on detecting steganography in still images [1, 2, 3, 4, 5, 16, 17].

given the high levels of redundancy present in video, we believe that there is tremendous potential for creative data hiding and inspired steganalysis that extend to multimedia sensor networks.


Parts of our implementation have CPU architecture-dependent components.

as demonstrated by our effort to port to OpenWrt, porting SP L I T KER N E L builds to other architectures is possible.


Context switch in software-based isolation is more ef.cient.

uPro bringsafewextra categoriesofoverhead than process isolation.


Our current prototype relies on NICKLE to signal the execution of kernel rootkit code.

if a kernel rootkit modi.es kernel data directly from user-space using a memory access device such as /dev/kmem, PoKeR will not be able to pro.le it.


The AWSS schemes of [6, 5] are based on the idea of sharing the secret using a bi-variate polynomial F (x, y)of degree at most t in x and y and requires T(n 2) invocations of the underlying AICP to generate IC signatures on n 2 distinct points on F (x, y).

we design AWC based on the Shamir secret sharing, where a univariate polynomial f(x)ofdegree at most t is used to share the secret and only n instances of AICP are invoked to generate IC signatures on n distinct points on f(x).


= 0.8, then SYS is 0.8-survivable given any compromise rate below 0.13 (i.e., r2 = 0.13) as long as the recovery rate is maintained at least at 0.19 (i.e., r1 = 0.19).

if the recovery rate can only be 0.16 or less, then 0.8survivability cannot be maintained.


Generating the RIM certi.cates for applications requires a corresponding PKI inside the company.

almost all companies today have integrated a PKI into their IT infrastructure.


It may be argued that a mnemonic in our scheme is exactly a role as perceived in such schemes.

there are some important differences between such schemes and our scheme.


Therefore, even if a server is hijacked by attackers, they can only perform operations authorized to the server processes.

it is dif.cult to introduce and maintain a secure OS because of the complexity of its security policy con.guration.


A general approach to build a tc api for Android platform from an existing one (e.g., c-based tss or Java-based jtss [17]) would be to derive the complete set of functionality provided by these apis.

our proposed api is not aimed to replace any of these apisinall of their functionality because some of the methods speci.ed in the tss are not relevant with our api.


Note that such a sanitizable signature scheme does not yet exist.


The input rate is 40 Gbps with innocent and malicious traf.c regardless of the input load.

pSIO allows a NAPI-like functionality in the user level and it blocks when there is no packet to process.


When several domains wish to federate, the administrators agree on this and exchange their own tokens, which subsequently allow them to validate and control any cross-enterprise interactions via PEP interceptions.

this basic model does not allow for fine-grained separation of different collaborations.


The constraint checker can easily detect this violation, but it is unlikely to know how to optimally transfer the responsibility for managing the customer email list, since workload information, employee preferences, and other external considerations are rarely encoded into the systems hosting an access control policy.

a human policy administrator is likely to have access to such information and can easily select between the employees who could be assigned to that task.


On the AVR the following instructions can modify the control .ow: Branch and Jump (JMP) instructions update the control .ow.

as the destination address is provided as an immediate constant value, they are not vulnerable to manipulation and no return address is stored on the stack.


If the same devcert is used to sign malware as well as benign packages, the  approach may lead to an over-estimate of infection rate.

it could serve as a way to detect previously undetected malware, as Barrera et al.


Thus, the impact scores and ß coef.cients, used to compute the II, should be set by the administrator according to the application requirements.

we assume that these con.guration parameters are changed infrequently over the network lifetime.


We want tags to reveal their identity to authorized RFID readers (e.g., those owned by the library), so that the library can track books as they are checked in and out.

for privacy, the tag must not disclose its identity until the reader has been authenticated; thus, the reader must authenticate itself to the tag before doing anything else.


In principle, all threats and all controls would then be rated on the same scale.

for particular types of threats, such as storms, commonly used scales may already exist.


We believe this application of our proposal has the potential to simplify some important aspects of public-key infrastruc- tures (PKI's) for digital signatures, specifically for PKrs intended to adequately address the difficult related issues of key revocation and potentially undetected signature pri- vate key compromise.

5 an important issue, with respect to signatures intended to provide the property of non-repudiation, is that a user (or organization) must be prevented from repudiating a signature by simply deleting the corresponding posted corroborating information from a site they control.


Our preliminary investigation of the implementation of such a system revealed that dependence tracking need not be complex.

there is clearly more to do in this direction.


The straightforward approach to de.ne such a theory of interaction is to de.ne a .nite state machine and use related techniques developed in theoretical computer science.

the drawback of such an approach is that the theory of interaction is not related to the theory of argumentation.


Wide SIMD machines, also known as vector processors,offer the required compute power.

the available parallelism is constrained to SIMD operations.


Originally, a standard sample size calculation was computed' for each major TCP type to insure that common types are adequately represented [27].

results from the standard sample size equation tended to yield samples that under-represented the less variable types and over represented the more variable types.


Liddell s study used students as participants and it must be noted that most students are young and have few memory dif.culties.

older users are plagued by memory problems and will probably be more willing to accept some inconvenience in return for increased memorability.


4.4 Hot-Link Attack The roundabout attack described in the previous section attacked the latency aspect of interconnect performance.

another important metric is bandwidth since the channel bandwidth is a resource that is shared by the di.erent nodes and impact overall interconnection network throughput.


For example, this approach would properly work if the SP provides a web mail account as a service, where the user has to type frequently.

there are also other behavioral biometrics approaches that could meet requirements of other SPs (e.g.


We can use ARMlock to sandbox the library together with the zlib it depends on.

this will lead to many inter-module calls because libpng has a fairly .ne-grained interface.


For example, when another user issues an interest in these contents that have been previously served to a user on the same path, the interest is ful.lled from the near-by cache.

the way ICN interest ful.llments work pose a great privacy risk.


This time, CPU throws a double fault instead of more page faults.

the stack pointer remains invalid for the double fault handler.


the scheme is not scalable in that the size of the network is restricted by a function of number of preinstalled keys.


The larger the value of the threshold, the less false positive alarms is generated.

smaller threshold will cause more false positive alarms, and in turn obtain a higher detection rate.


In particular, gaining domain administrator ('~root") privilege does not guaran-tee application-level privilege; this will be explained shortly.

an attacker with application-level privilege would find it easy to control, and thus corrupt, an application.