Search

Mobile devices (e.g., laptops, PDAs, cell phones) are increasingly relied on but are used in contexts that put them at risk of physical damage, loss or theft. This paper discusses security considerations that arise in the design of a cooperative backup service for mobile devices. Participating devices leverage encounters with other devices to temporarily replicate critical data. Anyone is free to participate in the cooperative service, without requiring any prior trust relationship with other participants. In this paper, we identify security threats relevant in this context as well as possible solutions and discuss how they map to low-level security requirements related to identity and trust establishment. We propose self-organized, policy-neutral mechanisms that allow the secure designation and identification of participating devices. We show that they can serve as a building block for a wide range of cooperation policies that address most of the security threats we are concerned with. We conclude on future directions. [ABSTRACT FROM AUTHOR]

Database management systems (DBMS), which are the ultimate layer in preventing malicious data access or corruption, implement several security mechanisms to protect data. However these mechanisms cannot always stop malicious users from accessing the data by exploiting system vulnerabilities. In fact, when a malicious user accesses the database there is no effective way to detect and stop the attack in due time. This practical experience report presents a tool that implements concurrent intrusion detection in DBMS. This tool analyses the transactions the users execute and compares them with the profile of the authorized transactions that were previously learned in order to detect potential deviations. The tool was evaluated using the transactions from a standard database benchmark (TPC-W) and a real database application. Results show that the proposed intrusion detection tool can effectively detect SQL-based attacks with no false positives and no overhead to the server. [ABSTRACT FROM AUTHOR]

Third-party software certification should attest that the software product satisfies the required confidence level according to certification standards such as ISO/IEC 9126, ISO/IEC 14598 or ISO/IEC 25051. In many application areas, especially in mission-critical applications, certification is essential or even mandatory. However, the certification of software products using common off-the-shelf (COTS) components is difficult to attain, as detailed information about COTS is seldom available. Nevertheless, software products are increasingly being based on COTS components, which mean that traditional certification processes should be enhanced to take COTS into account in an effective way. This paper proposes a mean to help in the certification of component-based systems through an experimental risk assessment methodology based on fault injection and statistical analysis. Using the proposed methodology the certification authority or the system integrator can compare among components available the one that best fit for the system that is assembling a component that provides a specific functionality. Based on the results it is also possible to decide whether a software product may be considered certified or not in what concerns the risk of using a COTS into the system. The proposed approach is demonstrated and evaluated using a space application running on top of two alternative COTS real-time operating systems: RTEMS and RTLinux. [ABSTRACT FROM AUTHOR]

Software for space applications requires significant testing. This paper presents an evaluation of the CoFI testing methodology as applied to actual space software, where deterministic fault cases derived from state-based models were executed using the software-implemented fault injection technique. Different models were used to represent the behavior of embedded software in a real satellite computer under the presence of both normal inputs and external faults in communication, processor, and memory. CoFI methodology was used for model construction, the Condado tool for test derivation, and the QSEE-TAS tool for test execution. In total, 8,620% of 471 fault cases detected errors in the software; this is a very large number, and more so considering that the software had already been tested by the company which developed it before being subject the CoFI methodology. [ABSTRACT FROM AUTHOR]

Computer control of discrete applications present a challenging dependability problem since any wrong output may lead the system to a completely anomalous state. This is in contrast with continuous feedback systems where wrong outputs can only gradually deviate the system under control from its intended set point. Transient errors may even be filtered by the latency inherent to the physical application. In this paper we extend our previous experimental research on the use of the fail-bounded model in continuous feedback systems into discrete control applications in order to evaluate whether it could be applied to this kind of problems. The reset-driven approach was used as the basic error detection and recovery mechanism complemented by assertions based on the Petri Net modeling of the problem, thus taking advantage of the discrete nature of the applications. The well-known semaphore control problem is used as testbed for experimental evaluation by fault-injection in the controller. The main contribution of this paper is to present experimental data showing that effectively the fail-bounded model can be applied to discrete applications whenever a continuous physical system exists in the control loop. [ABSTRACT FROM AUTHOR]

Ensuring reliable communication between nodes is a major challenge in mobile ad-hoc networks due to wireless signal propagation that can be significantly affected by terrain, obstacles, battery exhaustion and node mobility. Existing broadcasting protocols for MANETs are able to deal with mobility, as well as congestion and collision, but only when under a fail-stop failure model. However, this model is not a good representative of the real scenarios of faults frequent in MANETs such as link failures, temporary network partitions, topology changes and momentary node failures. In this work we evaluate - through the aid of simulation experiments - how well MANET broadcasting protocols behave when under a more realistic failure model, which are characterized by omission faults. We also discuss their properties and behaviors when taking reliability into consideration. The study conducted here show that most protocols are highly impacted by node failures and are not capable of maintaining high delivery rate. Some even exhibit coverage levels that are unreasonable to expect from broadcasting protocols when placed in a real world scenario. [ABSTRACT FROM AUTHOR]

Given the frequent topology changes in Mobile Ad Hoc Networks (MANET), the choice of appropriate broadcasting techniques is crucial to ensure reliable delivery of messages. The spreading of broadcast messages has a strong similarity with the spreading of infectious diseases. Applying epidemiological models to broadcasting allows an easy evaluation of such strategies depending on the MANET characteristics, e.g. the node density. In this paper, we develop an epidemic model for gossiping, which is a flooding-based probabilistic broadcasting technique. We analytically investigate the impact of node density and forwarding probability on the quality of gossiping. The result of our investigation is to enable mobile nodes for dynamically adapting their forwarding probability depending on the local node density. Simulation results in ns-2 show the reliability, efficiency and scalability of adaptive gossiping. [ABSTRACT FROM AUTHOR]

Mobile devices, such as Smartphones, are being used virtually by every modern individual. Such devices are expected to work continuously and flawlessly for years, despite having been designed without criticality requirements. However, the requirements of mobility, digital identification and authentication lead to an increasing dependence of societies on the correct behaviour of these 'proxies for the individual'. The Windows Mobile 5.0 release has delivered a new set of internal state monitoring services, centralized into the State and Notifications Broker. This API was designed to be used by context-aware applications, providing a comprehensive monitoring of the internal state and resources of mobile devices. In this paper we propose using this service to increase the dependability of mobile applications by showing, through a series of fault-injection campaigns, that this novel API is very effective for error propagation profiling and monitoring. [ABSTRACT FROM AUTHOR]

Existing test techniques focus on particular, relevant aspects of the requirements of the system under test (SUT). Real-life SUTs have, however, numerous features to simultaneously be considered, often leading to a large number of tests. In such cases, because of time and cost constraints the entire set of tests cannot be run. It is then essential to prioritize the tests in sense of a ordering of the relevant events entailed in accordance with the importance of their numerous features. This paper proposes a graph-model-based approach to prioritizing the test process. Tests are ranked according to their preference degrees which are deter mined indirectly, i.e., through classifying the events. To construct the groups of events, Fuzzy c-Means (FCM) clustering algorithm is used. A case study demonstrates and validates the approach. Contrary to other approaches, no prior information is needed about the tests carried out before, e.g., as is case in regression testing. [ABSTRACT FROM AUTHOR]

When building dependable systems by integrating untrusted software components that were not originally designed to interact with each other, it is inevitable the occurrence of architectural mismatches related to assumptions in the failure behaviours. These mismatches if not prevented during system design have to be tolerated during run-time. This paper presents an architectural abstraction based on exception handling for structuring fault-tolerant software systems. This abstraction comprises several components and connectors that transform an existing untrusted software element into an idealised fault-tolerant architectural element. The proposed rigorous approach relies on a formal representation for analysing exception propagation, and verifying important dependability properties. Beyond this, the formal models are also used for generating unit and integration test cases that would be used for validating the final software product. The feasibility of the proposed approach was evaluated on an embedded critical case study. [ABSTRACT FROM AUTHOR]

Aspect oriented programming (AOP) is a promising technique for implementing fault tolerance. Still there exist few actual implementations. One reason is that most present day AOP languages do not offer the level of control needed. This paper addresses the problem by defining a representative set of fault tolerance mechanisms. The set can be used for evaluating the feasibility of languages and for finding needs for improvements. It has been used to evaluate the AspectC++ language, and a number of limitations have been revealed. AspectC++ was then extended in order to address this. It is also demonstrated how reusable fault tolerance mechanisms can be built using aspect oriented C++, and the advantages compared to using standard C++ are discussed. [ABSTRACT FROM AUTHOR]

A distributed dynamic system is a fully distributed system subject to a continual arrival/departure of the entities defining the system. Another characterizing dimension of these systems is their, possibly, arbitrary large size (number of entities) and the possible arbitrary small part of the system a single entity directly interacts with. This interaction occurs through data exchange over logical links, and the constantly changing graph, formed by all links connecting entities, represents the overlay network of the dynamic distributed system. The connectivity of such overlay is of fundamental importance to make the whole system working. This paper gives a precise definition of the connectivity problem in dynamic distributed systems while formally defining assumptions on arrival/departure of entities and on the evolution of the system size along the time. The paper shows the impossibility of achieving connectivity when an arbitrary large number of entities may arrive/depart concurrently at any time, doing so for an arbitrarily long time. A solution is presented achieving overlay connectivity during quiescent periods of the system: periods in which no more arrivals and departures take place. The paper conveys the fact that the finite but not known duration of the perturbed period before quiescence makes the solution of the problem far from being trivial. The paper also provides a simulation study showing that the solution not only achieves connectivity in quiescent periods but it rearranges entities in an overlay that shows good scalability properties. [ABSTRACT FROM AUTHOR]

Several algorithms implementing failure detectors have been proposed in the literature. In particular, we have proposed a family of communication-efficient $\diamondsuit\mathcal{P}$ algorithms, i.e., algorithms using n links to carry messages forever, being n the number of processes in the system. Moreover, we have recently proposed a $\diamondsuit\mathcal{P}$ algorithm that uses only $\mathcal{C}$ links, being $\mathcal{C}$ the number of correct processes. In this paper, we show that $\mathcal{C}$ is the minimum number of links required to implement $\diamondsuit\mathcal{P}$. We also show that, assuming that there is at least one incorrect process, $\mathcal{C}$ is optimal not only for $\diamondsuit\mathcal{P}$ but also for $\diamondsuit\mathcal{S}$ and Ω. We revisit our Reliable Broadcast based communication-optimal $\diamondsuit\mathcal{P}$ algorithm, and we show that, regarding QoS measures, it performs better than the communication-efficient algorithms. [ABSTRACT FROM AUTHOR]

This work proposes a fault-tolerant dynamic routing algorithm that employs maximum flow evaluation for route selection, increasing the number of disjoint paths to the destination, enhancing the path redundancy, and so extending the possibility of using detours, or alternative paths if needed. Route distance is employed as a secondary criterion. Routes may be dynamically changed by intermediate routers, which usually have more recent information about topology changes. Formal proofs for correctness of the algorithm are also presented. The proposed algorithm was implemented in a simulation environment and experimental results are presented. [ABSTRACT FROM AUTHOR]

The continuous advances and progress made in hardware technologies makes it possible to foresee a realm of unprecedented performance levels and of new application-driven architectural designs, e. g., see [1]. One of the main drivers is the reduction of the size of the elementary devices. Nevertheless, the evolution of nanoscale technologies raises serious challenges with respect to both dependability and security viewpoints. Issues at stake encompass three main types of concerns i) unreliability and variability that will characterize the production of emerging nanoscale devices, ii) accidental disturbances that affect the operation of the systems, iii) malicious threats targeting vulnerabilities of hardware circuits. However, on the other hand, thanks to the large scale integration, one may expect the fault tolerance techniques to come to the rescue of the limitations of the currently dominating fault avoidance approaches. After a brief review of each of these issues, we will provide a few hints concerning a proposal for resilient multicore processor chips. [ABSTRACT FROM AUTHOR]

Analysis and design patterns are well established to build high-quality object-oriented software. Patterns combine experience and good practices to develop basic models that can be used for new designs. Security patterns join the extensive knowledge accumulated about security with the structure provided by patterns to provide guidelines for secure system design and evaluation. They are being adopted by companies such as IBM, Sun, and Microsoft. We show the anatomy of a security pattern, a variety of them, and their use in the construction of secure systems. These patterns include Authentication, Authorization, Role-based Access Control, Firewalls, Web Services Security (SAML, XACML, XML Firewall), and others. We apply these patterns through a secure system development method based on a hierarchical architecture whose layers define the scope of each security mechanism. First, the possible attacks are considered from an analysis of use cases. Then the rights of the users are defined from the use cases using a Role-Based Access Control (RBAC) or other security model. The attacks are used to define the policies that could stop them. The rights are reflected in the conceptual class model. We then define additional security constraints that apply to distribution, interfaces, and components. The patterns are shown using UML models and some examples are taken from my book "Security Patterns" (Wiley 2006). [ABSTRACT FROM AUTHOR]

This tutorial describes a general approach for building cooperative services that span multiple administrative domains (MADs). MAD systems are attractive because their diffused control structure may yield services that are potentially less costly and more democratic than their more centralized counterparts. Unfortunately, they are also particularly problematic from a dependability standpoint as they challenge the traditional distinction between correct and faulty nodes. [ABSTRACT FROM AUTHOR]

In this tutorial we explore the use of data warehousing and OLAP (On-Line Analytical Processing) technologies to analyze the results from dependability evaluation experiments. The tutorial, intended for researchers working in experimental dependability evaluation, includes a demonstration of the use of these technologies in a concrete example of experimental dependability evaluation. [ABSTRACT FROM AUTHOR]

Embedded systems permeate our everyday lives. From automobiles to elevators, kitchen appliances to televisions, and water heaters to cell phones, we increasingly depend upon embedded systems to operate as expected. A few obviously critical embedded application domains, such as aviation, have traditionally benefited from extraordinary care during development to ensure that everything is done correctly. But increasingly, everyday embedded applications are becoming "mission critical," with little fanfare and perhaps without the full attention to dependability properties that they truly deserve. [ABSTRACT FROM AUTHOR]

Cost pressure, short time to market, and increased complexity are responsible for an evident increase of the failure rate of computing systems, while the cost of failures is growing rapidly, as a result of an unprecedented degree of dependence of our society on computing systems. The combination of these factors has created a dependability and security gap that is often perceived by users as a lack of trustworthiness in computer applications, but that is in fact undermining the network and service infrastructures that constitute the very core of the knowledge-based society. [ABSTRACT FROM AUTHOR]

The increasing size and complexity of the next generation of large distributed systems will require radical new approaches for guaranteeing certain levels of dependability and security. Current solutions might become brittle in context of new applications, such as pervasive computing, in which there is a large number of components with dynamic interdependencies between them. The inherent complexity of these future systems due to heterogeneity, decentralisation, and emergent technologies also demand scalable and robust solutions. An example of such emergent technologies is ad hoc networks, which are self-configuring networks that enable the connection of thousands of devices in arbitrary topologies. The objective of the panel is to discuss the challenges and the potential solutions when building dependable and secure applications in the context of ad hoc networks. This panel has been organised as a joint event between the Sixth International Conference on Ad-Hoc Networks and Wireless (Ad Hoc NOW 2007) and the Third Latin American Symposium on Dependable Computing (LADC 2007), which are two co-located events of the Mexican International Conference in Computer Science (ENC 2007). [ABSTRACT FROM AUTHOR]