Trusted Execution Environment(TEE) delineates se- cure zones within the system, ensuring the security of the execution environment and data confidentiality. However, due to the relatively late start of the RISC-V instruction set ar- chitecture, there are currently few designs for RISC-V-based TEEs, which face challenges such as performance bottlenecks, insufficient support for privilege modes, and the lack of a unified model. Moreover, synchronous circuits’ reliance on extensive clock networks increases area and power usage. This paper introduces an asynchronous Physical Memory Protection(PMP) design for RISC-V, addressing these issues. This scheme provides key hardware support for implementing TEE for RISC-V. The architecture supports user, supervisor, and machine modes, offering 4 B to 16 GB granular protection and up to 64 PMP entries. The initial address and the number of PMP entries can be configured according to requirements, offering high flexibility. After testing, the overall and sub-module functions are correct and align with expectations. Finally, in the 110-nm process, the area of this architecture is 0.47 mm2and the power consumption is only 3.6829 mW.

We present a global, large-scale measurement of Internet traffic shadowing, a less-studied yet covert format of on-path manipulation. As part of pervasive monitoring, data within packets is silently observed, retained, and then leveraged to produce additional, unsolicited requests. To depict the landscape of such behaviors, we generate a collection of decoy traffic that lures on-path exhibitors, spread them via 4,364 vantage points recruited from commercial VPN providers, and capture unsolicited requests triggered by them. We find traffic shadowing against DNS, HTTP, and TLS protocols; DNS queries to several public resolvers are most susceptible, by being observed on a wide range of Internet paths. Through hop-by-hop tracerouting, we find observers of DNS queries associated with destinations, while HTTP messages are mostly observed on the wire. User data can be retained for long, e.g., over 10 days, and can be leveraged for more than once. While a notable portion of unsolicited requests originate from addresses labeled by blocklists, we find most of them are performing reconnaissance, and we see no evidence of exploits attempted in the collected traffic.

DNS root servers are the starting point of most DNS queries. To ensure their security and stability, multiple anycast instances are operated worldwide, and new root instances have been rapidly deployed in recent years. Apart from authorized instances managed by Root Server System, some networks equip unauthorized instances to hijack queries from clients. Despite various root instances handling queries within their residing networks, few studies have focused on the deployment issues of these instances. In this paper, we provide the first study to reveal the deployment issues of root instances from a nationwide view. With the support of 7,860 vantage points, we utilized a suite of methodologies to identify the deployment of unauthorized instances. 54 vantage points witnessed the evidence of unauthorized instances, and 70.4% of them further observed security issues of unauthorized instances, including DoS, unavailability of DNSSEC validation, and vulnerable DNS software. Additionally, we utilized the side-channel information of censorship mechanisms to measure the catchment area of authorized instances. We found that most authorized instances in the Chinese mainland serve with limited catchment areas due to restricted BGP policies. Through discussions with ISPs and network operators, we make recommendations to improve the deployment status of different root instances.

Classification is the most basic method for organizing resources in the physical space, cyber space, socio space, and mental space. To create a unified model that can effectively manage resources in different spaces is a challenge. The Resource Space Model RSM is to manage versatile resources with a multidimensional classification space. It supports generalization and specialization on multidimensional classifications. This paper introduces the basic concepts of RSM, and proposes the Probabilistic Resource Space Model, P-RSM, to deal with uncertainty in managing various resources in different spaces of the cyber-physical society. P-RSM's normal forms, operations, and integrity constraints are developed to support effective management of the resource space. Characteristics of the P-RSM are analyzed through experiments. This model also enables various services to be described, discovered, and composed from multiple dimensions and abstraction levels with normal form and integrity guarantees. Some extensions and applications of the P-RSM are introduced.

Semantics exhibits diversity in the real world, mental abstraction world, document world, and machine world. Studying mappings between different forms of semantics helps unveil the uniformity in the diversity. This article investigates the mappings between three typical semantic models: the Web ontology language (OWL), relational database model, and resource space model (a classification-based semantic model). By establishing mappings between the semantic primitives of the three models, we study the mapping from OWL description onto resource space and analyze the normal forms of the generated resource space. Mapping back from resource space onto OWL description is then discussed. Further, we investigate the mapping between OWL description and relational database, as well as the mapping between relational database and resource space. Normal forms of the generated relational tables are analyzed. To support advanced applications on the future Web, we suggest integrating the resource space, OWL, and databases to form a powerful semantic platform that enables different semantic models to enhance each other.

An important issue arising from large scale data integration is how to efficiently select the top-K ranking answers from multiple sources while minimizing the transmission cost. This paper resolves this issue by proposing an efficient pruning-based approach to answer top-K join queries. The total amount of transmitted data can be greatly reduced by pruning tuples that can not produce the desired join results with a rank value greater than or equal to the rank value generated so far.