Malware distribution using drive-by download attacks has become the most prominent threat for organizations and individuals. Compromised web services and web applications hosted on the cloud act as the delivery medium for the exploits. The exploits included often target the vulnerabilities within th

QR (Quick Response) code has become quite popular in recent years due to its large storage capacity, ease of generation and distribution, and fast readability. However, it is not likely that users will be able to find out easily the content encoded, typically URLs, until after they scan QR codes. This makes QR codes a perfect medium for attackers to conceal and launch their attacks based on malicious URLs. We believe that security hardening on QR code scanners is the most effective way to detect and prevent the potential attacks exploiting QR codes. However, little attention has been paid to the security features of QR code scanners so far in literature. In this paper, we investigated the current status of existing QR code scanners in terms of their detection of malicious URLs exploited for two well-known attacks: phishing and malware. Our study results show the existing scanners either cannot detect or can very poorly detect those two attacks. Hence, we propose a QR code solution called SafeQR that enhances the detection rate of malicious URLs by leveraging two existing security APIs to detect phishing and malware attacks: Google Safe Browsing API and Phishtank API. Additionally, a visual warning scheme was carefully designed and implemented to enable users to better heed warnings. A user study was designed and conducted to investigate the effectiveness of our scheme compared with the methods adopted by existing QR code scanners.

Infrastructure as a service (IaaS) is a cloud service model that provides storage and computation services for users at a low price. A recent report from Gartner indicates that IaaS will be the fastest growing area among all of the cloud service models in the near future, and thus it is strongly env

Drive-by downloads have become the primary attack vehicle for malware distribution in recent years. With the rise of targeted attacks, the vulnerabilities within the cloud based services and web based collaboration frameworks might end up as the principal targets for hosting drive-by download attack

ABSTRACT One of the critical yet lingering issues in computer security is insider threat, and it often takes advantage of some security services based on directory services such as authentication and access control. Detecting these threats is quite challenging because malicious users with the technical ability to leverage these services often have sufficient knowledge and expertise to conceal unauthorized activity. In this article, we present an approach using directory virtualization to monitor various systems across an enterprise for the purpose of detecting malicious insider activity. Specifically, a policy engine that leverages directory virtualization services is proposed to enhance monitoring and detecting capabilities by allowing greater flexibility in analyzing changes for malicious intent. The resulting architecture is a system‐based approach, where the relationships and dependencies between data sources and directory services are used to detect an insider threat, rather than simply relying on point solutions. This paper presents such an architecture in detail, including a description of implementation results. Copyright © 2011 John Wiley & Sons, Ltd.

Dual supply voltage design is widely accepted as an effective way to reduce the power consumption of CMOS circuits. In this paper, we propose a comprehensive design framework that includes dual- scheduling, dual- allocation, controller synthesis as well as layout generation. In particular, we address a problem of high-level synthesis with objective of minimizing power consumption of storage units and multiplexers using dual- ; this is made possible by utilizing timing slack that is left in the data-path after operation scheduling. We use integer linear programming (ILP) and also provide heuristic algorithms to solve the dual- register and connection allocation. The physical layout of dual-circuits has to separate power rails of and cells from each other. We propose a voltage island based placement algorithm to relieve this restriction and allow more flexibility of placement. In experiments on benchmark designs implemented in 1.08 V (with Vddlof 0.8 V) 65-nm CMOS technology, both switching and leakage power are reduced by 20% on average, respectively, compared to data-path with dual-Vddapplied to functional units alone. Detailed analysis of area and wirelength is performed to assess feasibility of the proposed method.

One of the latest attacks on secure socket layer (SSL), called the SSLstripping attack, was reported at the Blackhat conference in 2009. As a type of man-in-the-middle (MITM) attack, it has the potential to affect tens of millions of users of popular online social networking and financial websites protected by SSL. Interestingly, the attack exploits users' browsing habits, rather than a technical flaw in the protocol, to defeat the SSL security. In this paper we present a novel approach to addressing this attack by using visually augmented security. Specifically, motivated by typical traffic lights, we introduce a set of visual cues aimed at thwarting the attack. The visual cues, called security status light (SSLight), can be used to help users make better, more informed decisions when their sensitive information need to be submitted to the websites. A user study was conducted to investigate the effectiveness of our scheme, and its results show that our approach is more promising than the traditional pop-up method adopted by major web browsers.

Cloud computing has drawn much attention in recent years. One of its delivery models, called infrastructure as a service (IaaS), provides users with infrastructure services such as computation and data storage, heavily dependent upon virtualization techniques that offers benefits such as elasticity

Directory services are used by almost every enterprise computing environment to provide data concerning users, computers, contacts, and other objects. Virtual directories are components that provide directory services in a highly customized manner. Unfortunately, though the use of virtual directory services are widespread, an analysis of risks posed by their unique position and architecture has not been completed. We present a detailed analysis of six attacks to virtual directory services, including steps for detection and prevention. We also describe various categories of attack risks, and discuss what is necessary to launch an attack on virtual directories. Finally, we present a framework to use in analyzing risks to individual enterprise computing virtual directory instances. We show how to apply this framework to an example implementation, and discuss the benefits of doing so.

User privacy is a challenging issue that must be addressed urgently in current online social networking (SN) sites. One of the fundamental problems associated with the issue is the lack of support of a user-centric approach to managing and sharing user profile information in current SN systems. In t

Driven by increasing complexity and reliability demands, the Japanese Aerospace Exploration Agency (JAXA) in 2004 commissioned development of ELEGANT, a complete SpecC-based environment for electronic system-level (ESL) design of space and satellite electronics. As integral part of ELEGANT, the Center for Embedded Computer System (CECS) has developed and supplied the SER tool set. Following a Specify-Explore-Refine methodology, SER supports system-level design space exploration, interactive platform development and automatic model refinement and model generation. The SER engine has been successfully integrated into ELEGANT. With SER at its core, ELEGANT provides a seamless tool chain for modeling verification and synthesis from top-level specification down to embedded HW/SW implementation. ELEGANT and SER have been successfully delivered to JAXA and its suppliers. Tools are currently being deployed in companies like NEC Toshiba Space Systems. Evaluation results prove the feasibility of the approach for design space exploration, rapid virtual prototyping and system synthesis resulting in tremendous productivity and reliability gains. In addition, ELEGANT has been commercialized for general market availability. The SER component has been licensed to InterDesign Technologies, Inc. (IDT) and it is available from, sold and supported by IDT.

Abstract—Much effort in register transfer level (RTL) design has been devoted to developing “push-button ” types of tools. However, given the highly complex nature, and lack of control on RTL design, push-button type synthesis is not accepted by many designers. Interactive design with assistance of algorithms and tools can be more effective if it provides control to the steps of synthesis. In this paper, we propose an interactive RTL design environment which enables designers to control the design steps and to integrate hardware components into a system. Our design environment is targeting a generic RTL processor architecture and supporting pipelining, multicycling, and chaining. Tasks in the RTL design process include clock definition, component allocation, scheduling, binding, and validation. In our interactive environment, the user can control the design process at every stage, observe the effects of design decisions, and manually override synthesis decisions at will. We present a set of experimental results that demonstrate the benefits of our approach. Our combination of automated tools and interactive control by the designer results in quickly generated RTL designs with better performance than fully-automatic results, comparable to fully manually optimized designs. Index Terms—Embedded systems, high level synthesis, interactive design environment, register transfer level (RTL) processor, system-on-chip (SoC). I.

In recent years user centricity has drawn a lot of attention as a promising component to advance federated identity management (FIM) systems. The basic notion is to give users a larger degree of control over their attribute data that comprises digital identities on a federated network, thus providing an ideal mechanism for upholding user privacy. One of the fundamental problems facing user centricity in this context is how a user can selectively share her identity attributes certified by an identity provider (IdP) to a service provider (SP). In this paper we present an approach to addressing the problem, which allows a user to share only selected attributes from a larger set of attributes that form his digital identity credential for better privacy. Our approach enables such sharing to occur without IdP’s intervention in every transaction.

With growing market pressures and rising system complexities, automated system-level communication design with efficient design space exploration capabilities is becoming increasingly important. At the same time, customized network-oriented communication architectures become necessary in enabling a high-performance communication among the system components. To this end, corresponding communication design flows that are supported by efficient design automation techniques need to be developed. In this paper, we present a system-level design environment for the generation of bus-based system-on-chip architectures. Our approach supports a two-stage design flow using automated model refinement toward custom heterogeneous communication networks. Starting from an abstract specification of the desired communication channels, our environment automatically generates tailored network models at various levels of abstraction. At its core, an automatic layer-based refinement approach is utilized. We have applied our approach to a set of industrial-strength examples with a wide range of target architectures. Our experimental results show significant productivity gains over a traditional communication design, allowing early and rapid design space exploration.

Impromptu collaboration, often characterized as being opportunistic, spontaneous, proximity-based, and transient, is fast becoming a common way of interactions in mobile and pervasive computing. Though continued research efforts have been made to secure this type of collaboration, the increasing computational and storage capabilities of mobile devices pose a new security challenge of access control for sharing a variety of their resources. In this paper we present a visual framework for securing impromptu collaboration in a pervasive computing environment. The framework incorporates a method of demonstrative identification of mobile devices, key-based capability list, and 2-dimensional visual barcode technology to support a convenient access control service in mobile and pervasive computing. Impromptu collaboration, often characterized as being opportunistic, spontaneous, proximity-based, and transient, is fast becoming a common way of interactions in mobile and pervasive computing. Though continued research efforts have been made to secure this type of collaboration, the increasing computational and storage capabilities of mobile devices pose a new security challenge of access control for sharing a variety of their resources. In this paper we present a visual framework for securing impromptu collaboration in a pervasive computing environment. The framework incorporates a method of demonstrative identification of mobile devices, key-based capability list, and 2-dimensional visual barcode technology to support a convenient access control service in mobile and pervasive computing

The increasing demand for and the wide adoption of mobile technologies have been witnessed in enterprise information technology (IT) environments in recent years. However, there exist few solutions to address the applicability of mobile technologies or devices in enterprise security management (ESM). In this paper we present an approach to enabling mobility in ESM, whereby security administrators can manage various types of enterprise security polices using mobile devices in order to effectively monitor and defend their trusted domains, which are constantly under attacks. Specifically, we describe a security architecture for designing and implementing a mobile-enabled solution for ESM through which various benefits such as the backup of important security policies or credentials, offline administration, immediate response, and monitoring can be achieved. We also discuss our approach in the context of the security framework development guideline provided by the ISO 17799 code of practice for information security management (2000)

As we are entering the network-on-chip era and system communication is becoming a dominating factor, communication abstraction and synthesis are becoming the integral part of system design flows. The key to the success of any design flow are well-defined abstraction levels and models, which enable automation of early validation, synthesis and verification. In this paper, we define system communication abstraction layers and corresponding design models that support successive, stepwise refinement from abstract message-passing down to a cycle-accurate, bus-functional implementation. Experimental results show the benefits of our definitions and design flow.

Spontaneous communications for either personal or shared activities are becoming very common in wireless pervasive computing environments. However, there still remain challenging problems in this type of communications, especially their security over ad-hoc wireless channels. In this paper we present an approach to using a visual code system in order to establish secure spontaneous communications among wireless devices in pervasive computing environments. After briefly discussing the visual code system, we describe two distinct models of spontaneous communications, and then discuss how the visual code system can be leveraged in order to secure spontaneous communications in those models. We also demonstrate our approach through a proof-of-concept implementation.

We propose a systematic pipelining method for a linear system to minimize power and maximize throughput, given a constraint on the number of pipeline stages and a set of resource constraints. Unlike most existing pipelining approaches, our method takes the number of pipeline stages as one of the constraints and considers the pipelining as an aspect of power minimization. Operations are retimed so that as many operations as possible take common operands as their inputs, using a novel technique called force-directed retiming; operand sharing is then determined, based on list scheduling. Experimental results show that the proposed approach reduces the power consumption of functional units by 27.8% on average and by more than 50% in some cases, compared to the state-of-the-art pipelining and operand sharing techniques.

Surveys and polling data confirm that the Internet is now a prime vehicle for business, community, and personal interactions. The notion of identity is the important component of this vehicle. When users interact with services on the Internet, they often tailor the services in some way for their personal use. For example, a user may establish an account with a username and password and/or set some preferences for what information the user wants displayed and how the user wants it displayed. The network identity of each user is the overall global set of these attributes constituting the various accounts. In this paper, we investigate two well-known federated identity management (FIM) solutions, Microsoft Passport and Liberty Alliance, attempting to identify information assurance (IA) requirements in FIM. In particular, we focus on principal IA requirements for Web services (WS) which plays an integral role in enriching identity management through federation.

Abstract Over the last decade there has been a tremendous advance in the theory and practice of role‐based access control (RBAC). One of the most significant aspects of RBAC can be viewed from its management of permissions on the basis of roles rather than individual users. Consequently, it reduces administrative costs and potential errors. The management of roles in various RBAC implementations, however, tends to be conducted on an ad hoc basis, closely coupled with a certain context of system environments. This paper discusses the development of a system whose purpose is to help manage a valid set of roles with assigned users and permissions for role‐based authorization infrastructures. We have designed and implemented the system, called RolePartner. This system enables role administrators to build and configure various components of a RBAC model so as to embody organizational access control policies which can be separated from different enforcement mechanisms. Hence the system helps make it possible to lay a foundation for role‐based authorization infrastructures. Three methodological constituents are introduced for our purposes, together with the design and implementation issues. The system has a role‐centric view for easily managing constrained and hierarchical roles as well as assigned users and permissions. An LDAP‐accessible directory service was used for a role database. We show that the system can be seamlessly integrated with an existing privilege‐based authorization infrastructure. Copyright © 2004 John Wiley & Sons, Ltd.

This paper presents a methodology and algorithms for automatic communication refinement. The communication refinement task in system-level synthesis transforms abstract data-transfer between components to its actual bus level implementation. The input model of the communication refinement is a set of concurrently executing components, communicating with each other through abstract communication channels. The refined model reflects the actual communication architecture. Choosing a good communication architecture in system level designs requires sufficient exploration through evaluation of various architectures. However, this would not be possible with manually refining the system model for each communication architecture. For one, manual refinement is tedious and error-prone. Secondly, it wastes substantial amount of precious designer time. We solve this problem with automatic model refinement. We also present a set of experimental results to demonstrate how the proposed approach works on a typical system level design.

In this paper we present an approach to modeling system-centric information in order to facilitate role engineering (RE). In particular, we first discuss the general character-istics of the information required in RE. Afterwards, we discuss two informational flow types among authorities in-volved in RE process, forward information flow (FIF) and backward information flow (BIF), together with the intro-duction of an information model which is greatly suitable for use in the backward information flow. System-centric information is incorporated in the information model and UML extension mechanisms are exploited for modeling the information. Not only can the information model provide those different authorities with a method for both analy-sis of resources and communication of knowledge in the RE process, but it can also help lay a foundation for successful implementations of RBAC.

Information sharing among collaborating organizations usually occurs in broad, highly dynamic network-based environments, and formally accessing the resources in a secure manner poses a difficult challenge. The mechanisms must be provided to protect the resources from adversaries. The proposed delegation framework addresses the issue of how to advocate selective information sharing among collaborating organizations. We introduce a systematic approach to manage delegated privileges with the specification of delegation and revocation policies using a set of rules. We demonstrate the feasibility of our approach by providing a proof-of-concept implementation. We also briefly discuss several issues from our experiment including future directions.

The directory service markup language (DSML) prescribes how to manipulate directory services information in XML, and thus it facilitates sharing of directory information as XML fragments among XML-based applications. We describe how to leverage DSML for role-based access control on XML-based Web applications which often need collaboration within or beyond a single enterprise boundary. Compared with previous works in this area, we show that our approach can solve the problems of a previous LDAP-oriented solution. We discuss the security architecture based upon a server-pull model and its components. We also demonstrate the feasibility of our approach through a proof-of-concept implementation. Finally, several issues from our experience are discussed as well.

As process technology goes into deep submicron range, interconnect delay becomes dominant among overall system delay, occupying most of the system clock cycle time. Interconnect delay is now a crucial factor that needs to be considered even during high-level synthesis. In this paper, we propose a concurrent scheduling and binding algorithm that takes interconnect delay into account. We first define our distributed target architecture, which minimizes the effect of interconnect delay on clock cycle time. We no longer assume that interconnect delay between functional units is a part of one clock cycle. Interconnect delay can span over multiple clock cycles. We incorporate the concept of multi-cycle interconnect delay into scheduling and binding process, to reduce the critical path length and therefore the system latency. We show that by introducing interconnect delay, we can obtain latency improvement of up to 54 % and of 37% on the average.

Article Low power pipelining of linear systems: a common operand centric approach Share on Authors: Daehong Kim EECS, Seoul National University, Seoul, Korea EECS, Seoul National University, Seoul, KoreaView Profile , Dongwan Shin ICS, UC Irvine ICS, UC IrvineView Profile , Kiyoung Choi EECS, Seoul National University, Seoul, Korea EECS, Seoul National University, Seoul, KoreaView Profile Authors Info & Claims ISLPED '01: Proceedings of the 2001 international symposium on Low power electronics and designAugust 2001 Pages 225–230https://doi.org/10.1145/383082.383141Online:06 August 2001Publication History 9citation224DownloadsMetricsTotal Citations9Total Downloads224Last 12 Months3Last 6 weeks0 Get Citation AlertsNew Citation Alert added!This alert has been successfully added and will be sent to:You will be notified whenever a record that you have chosen has been cited.To manage your alert preferences, click on the button below.Manage my AlertsNew Citation Alert!Please log in to your account Save to BinderSave to BinderCreate a New BinderNameCancelCreateExport CitationPublisher SiteGet Access

With the increasing performance and density of VLSI circuits as well as the popularity of portable devices such as personal digital assistance, power consumption has emerged as an important issue in the design of electronic systems. Low power design techniques have been pursued at all design levels. However, it is more effective to attempt to reduce power dissipation at higher levels of abstraction which allow wider view. In this paper, we propose a simultaneous scheduling and binding scheme which increases the correlation between consecutive inputs to an execution unit so that the switched capacitance of the execution unit is reduced. The proposed method is implemented and integrated into the scheduling and assignment part of the HYPER synthesis environment. Compared with the original HYPER synthesis system, average power saving of 23.0% in execution units and 14.2% in the whole circuit, is obtained for a set of benchmark examples.