Web applications require exchanging parameters between a client and a server to function properly. In real-world systems such as online banking transfer, traversing multiple pages with parameters contributed by both the user and server is a must, and hence the applications have to enforce workflow and parameter dependency controls across multiple requests. An application that applies insufficient server-side input validations is however vulnerable to parameter tampering attacks, which manipulate the exchanged parameters. Existing fuzzing-based scanning approaches however neglected these important controls, and this caused their fuzzing requests to be dropped before they can reach any vulnerable code. In this paper, we propose a novel approach to identify the workflow and parameter dependent constraints, which are then maintained and leveraged for automatic detection of server acceptances during fuzzing. We realized the approach by building a generic blackbox parameter tampering scanner. It successfully uncovered a number of severe vulnerabilities, including one from the largest multi-national banking website, which other scanners miss.

We propose a new, simple and effective domain segmentation approach to sustain SSL protection which is usually compromised when users are expected to perform legitimacy judgment. It has been established that using security warnings and indicators is a serious operational flaw of SSL. As a security-critical system, SSL should never rely on users' judgment as the ultimate defense because adversaries that exploit users' ignorance and illiteracy are sufficient to break the most secure system. The proposal simply requires a service provider to opt-in by hosting its service in a special subdomain "secure". The enhanced protection will then be automatically in force. In this paper, we consider three severe and characteristic attack models, namely dynamic pharming, deceptive captive portal and SSLStrip attacks, and we show that there is no single defeating solution except SSLock. We have conducted deployability analysis which further justifies the proposal in terms of its high compatibility rate. SSLock is the only approach that is generic and light-weight for application vendors, opt-in and zero-initialization for service providers, and privacy-preserving and idiot-proof for generic users.

HTTPS is designed to protect a connection against eavesdropping and man-in-the-middle attacks. HTTPS is however often compromised and voided when users are to embrace invalid certificates or disregard if HTTPS is being used. The current HTTPS deployment relies on unsophisticated users to safeguard themselves by performing legitimacy judgment. We propose HTTPS Lock, a simple and immediate approach to enforce HTTPS security. HTTPS Lock can be deployed to a website with a valid certificate by simply including several Javascript and HTML files, which will be cached in browsers. Similar to the trust-on-first-use model used by SSH, the trusted code cached on the client-side can effectively enforce the use of HTTPS and forbid users to embrace invalid certificates for any compromised networks subsequently encountered. Over 72% of major web browsers are supported, and further growth is expected. In any situation where the protection is unsupported or expired, the current security standard is gracefully maintained. As desired, the deployment is not hindered by standardization and collaboration from browser vendors as with other proposals.

We demonstrate experimental all-optical code-division multiplexing (AO-CDM) systems using 64-picosecond optical pulses and a 2/sup n/ prime code of n=3. A distinguishing feature of this experiment is that the modulation of ultrashort optical clock stream by electrical data is realized without using any optical intensity modulator at each transmitter. Moreover, only low-cost standard optical 2/spl times/2 couplers and fiber delay lines are employed to implement all-serial encoders and decoders for a 2/sup n/ prime code. As a result, this new system is more cost- and power-effective than a conventional AO-CDM system.

ACTA (adaptive cycle tunable access) has been proposed for a high speed multimedia network. It is a simple multi-channel network protocol suitable for photonic implementation. It adopts a slotted cycle to transmit packets and the cycle length is dynamically adjusted according to the network load. We study the performance of the ACTA protocol both for single-channel and multi-channel integrated services operations. Through the simulations, we have shown that the overhead of channel tuning is quite small. We also study the priority mechanism of ACTA, and analyze the relation between the node transmission quota and bandwidth allocation. In addition, we present a slot reuse scheme which requires only one additional access control bit, and demonstrate great improvement in network utilization. The simulation results show that ACTA network is a very promising candidate for the future high speed multimedia networks.

This paper proposes a fast revertible restoration scheme (FRRS) for dual-ring networks. It uses the inter-communications among adjacent nodes to facilitate restoration and can operate in normal and revertive modes. The normal mode allows fast network recovery while the revertive mode returns the network status back to normal state after the failures have been removed. The validity of the scheme was tested on a high-speed multimedia network prototype designed at the Chinese University of Hong Kong-CUMLAUDE NET. In laboratory testing, the completion times for both operation modes are found to be within a millisecond. Performance measures including communicative probability and survivability are used to quantify the network reliability under the scheme.

This paper describes the design and the experimental demonstration of a novel fast channel tunable optical transmitter which is suitable for ultrahigh-speed all-optical time-division multiaccess (TDMA) networks. This optical transmitter is capable of performing fast channel tuning and data modulation in a simple and cost-effective way without using the expensive optical modulators and optical switches. By employing this transmitter, together with the proposed destructive writing scheme, ultrahigh-speed channel multiplexing with relaxed synchronization requirements for data access can be achieved. The demonstrated prototype can be arbitrarily tuned to any one of the 16 1-Gb/s channels in a 16-Gb/s all-optical TDMA network with a channel switching time of less than 5 ns. This is suitable for use in most high-speed optical time-division multiplexed (TDM) systems and tunable-channel multiaccess (TCMA) networks.

A multichannel extension of the fiber distributed data interface (FDDI) protocol using tunable-channel access is proposed. It greatly reduces the node complexity and allows low-speed electronics to be used for a high-speed network. Compared with a single-channel FDDI implementation, the multichannel FDDI either has a much higher throughput efficiency (same access delay) or a much lower access delay (same total throughput or TTRT). The proposed scheme is applicable to many other token ring networks.>

The system issues and network applications of acoustooptic tunable filters (AOTFs) are discussed. AOTFs are thought to be attractive system components in dense wavelength-division multiplexed (WDM) networks because of their broad continuous electronic wavelength tunability and narrow filter bandwidth. Their unique multiwavelength filtering capability adds a greater dimension of flexibility to network design. The characteristics of the AOTF are reviewed from a system viewpoint and the performance and capabilities of bulk-devices, integrated-optic devices, and fiber-based devices are discussed and compared. Three network applications using the acoustooptic tunable filters are described. The first application is as wavelength-tunable receivers or taps for local users in a subscriber loop distribution network. The second is as multiwavelength tunable receivers in a broadcast local-area cross-connect for packet communication with very-high-throughput data rate. The third is as wavelength-selective space-division switch fabric for routing and cross-connect between central offices. Future prospects and various issues for future research are also discussed.>

An evolutionary transport structure for local loop distribution based on RF subcarrier multiplexing and wavelength-division multiplexing is discussed. Issues relating to technology and cost are discussed. The transport structure provides private, high-bit-rate, premium services to business sites, and broadcast, low-bit-rate, low-cost services to residential users. The structure is transparent to various protocols or modulation schemes and can be configured to suit different needs. Up to 60 analog FM broadcast video channels downstream and 4 analog FM video channels upstream (or a single 155-Mb/s broadband ISDN channel) per subscriber can be provided for 16 subscribers per fiber feeder. It is possible that the transport structure could be deployed affordably in the near future. Future upgrades and expansions are possible because the transport structure is compatible with most promising future technologies. Various tradeoffs are also discussed.>

The background needed to understand the integrated-optic collinear acoustically tunable optical filters (ATOFs) and the fabrication and performance of both simple and multielement acoustooptic tunable filters is presented. The most important sources of crosstalk between channels simultaneously selected by a single device are discussed. ATOFs have the combined virtues of narrow passband (subnanometer bandwidth), broad tuning range (hundreds of nanometers have been demonstrated), and simultaneous independent multiple-channel filtering. The theory and practice of collinear integrated optic acoustooptic filters is presented. Devices which involve higher-order integration are discussed, including multiple-state filters for enhanced sidelobe suppression and polarization-independent configurations. Various sources of interchannel crosstalk are derived and demonstrated in multiwavelength filtering experiments.>