Data integrity is critical to the secure operation of a computer system. Applications need to know that the data that they access is trustworthy. Many current production-level integrity models are tightly coupled to a specific domain, (e.g., databases), or only apply after the fact (e.g., backups). In this paper we propose a recommendation-based trust model, called Admonita, for data integrity that is applicable to any structured data in a system and provides a measure of trust to applications on-the-fly. The proposed model is based on the Biba integrity model and utilizes the concept of an Integrity Verification Procedure (IVP) proposed by Clark-Wilson. Admonita incorporates subjective logic to maintain the trustworthiness of data and applications in a system. To prevent critical applications from losing trust, Admonita also incorporates the principle of weak tranquility to ensure that highly trusted applications can maintain their trust levels. We develop a simple algebra around these elements and describe how it can be used to calculate the trustworthiness of system entities. By applying subjective logic, we build a powerful, artificial and reasoning trust model for implementing data integrity.

Integer errors continue to create vulnerabilities. In fact, Integer Overflow or Wraparound is listed at position 11 in the 2020 CWE Top 25 Most Dangerous Software Weaknesses. This poster describes the Expression Evaluation (EE) visualization tool that helps students understand the type conversions that take place implicitly within a C program. This tool depicts step-wise the coercions that take place within the evaluation of a user specified expression with mixed integer type operands. The system enables students to create unlimited examples to test their understanding. The tool was evaluated in the classroom and shown to be easy to use and effective.

In many undergraduate programs, students primarily write code in Java or other scripting languages. Yet C and C++ are widely used when performance is important. Poor understanding of a C program's layout in memory and its execution leads to the introduction of security vulnerabilities. We present the SecureCvisual system, which is designed to help students learn to develop more secure and robust C programs.

Seemingly small coding errors can create significant vulnerabilities in C programs. This often occurs due to memory being overwritten in unexpected ways. If a student understands where program variables appear in the process address space, then she can understand the effect of writing beyond the memory allocated to a variable. With this understanding, she can tie her code to its effect within an executing process and is more likely to appreciate the significance of these seemingly harmless errors and to avoid them. We have developed a program analysis and visualization tool to help students understand the impact of common memory errors with the goal to help students avoid introducing these errors into their code. The visualization is through the Program Address Space (PAS) window within a larger system for analysis and visualization of security issues in C programs. The larger system is called SecureCvisual. In this paper, we describe our experience with teaching students fundamental concepts about process address spaces and the impact of buffer overflows using the PAS window. We also present the results from an evaluation of the tool. Our results indicate that students found the tool useful and that it enhanced the course in which it was used.

The integrity of systems files is necessary for the secure functioning of an operating system. Integrity is not generally discussed in terms of complete computer systems. Instead, integrity issues tend to be either tightly coupled to a particular domain (e.g. database constraints), or else so broad as to be useless except after the fact (e.g. backups). Often, file integrity is determined by who modifies the file or by a checksum. This paper focuses on a general model of the internal integrity of a file. Even if a file is modified by a subject with trust or has a valid checksum, it may not meet the specification of a valid file. An example would be a password file with no user assigned a user id of 0. In this paper, we describe a language called Maia that provides a means to specify what the contents of a valid file should be. Maia can be used to specify the format and valid properties of system configuration files, PNG files and others. We give a structural operational semantics of Ma ia and discuss an initial implementation within a mandatory integrity system.

Integer errors can introduce significant vulnerabilities into C programs. We have developed a program analysis and visualization tool to help students understand integer representation and type conversions with the goal to help students avoid introducing these errors into the code they develop. The visualization is through the Integer Representation (IR) window within a larger system for analysis and visualization of security issues in C programs. The system is called the Visualization and Analysis for C Code Security (VACCS) system. In this paper, we describe our experience with teaching fundamental aspects of integer security in a junior-level systems programming course, the IR window, and an evaluation of the tool. Our results indicate that students found the tool to be useful and that it enhanced the course in which it was used.

This paper describes a pedagogical system to visualize program execution.1 The visualization is designed to help students understand how to develop more secure and robust C programs. The system provides several perspectives on the execution including: the values of registers and the logical address space, a call graph, the file descriptor and inode tables, and the handling of sensitive data like passwords and keys. These visualizations are designed to help students understand fundamental concepts such as: buffer overflows, integer overflows, proper handling of sensitive data and application of the principle of least privilege in several contexts including file operations, secure SUID programming, and use and management of the process environment.

UNIXvisual is a user-level visualization tool designed to facilitate the study and teaching of access control in UNIX. UNIXvisual is aimed at both novice users, who need only to control access to their own files, and students of computer security, who need a deeper and more comprehensive understanding. The system allows students to analyze permission settings in the underlying real file system, as well as in a combination of real and pseudo file systems defined through a specification file. It also allows a student to trace the value and effect of credentials within an executing process. UNIXvisual gives instructors flexibility in the allocation of lecture time by supporting self-study, lowers the overhead required for teaching access control by running under an ordinary user account, and enhances learning through the use of visualization. We also present the results of an evaluation of UNIXvisual within a junior-level course on concurrent computing. The evaluation indicated that UNIXvisual helped students understand UNIX permissions and enhanced the course coverage of UNIX permissions, regardless of their prior UNIX experience.

This paper describes a visualization tool AESvisual that helps students learn and instructors teach the AES cipher. The software allows the user to visualize all the major steps of AES encryption and decryption. The demo mode is useful and efficient for classroom presentation and the practice mode provides the user with an environment to practice AES encryption with error checking. AESvisual is quite versatile, providing support for both beginners learning how to encrypt and decrypt, and also for the more advanced users wishing to see all the details, including the GF(28) addition and multiplication operations. Classroom evaluation of the tool was positive.

This paper describes UNIXvisual, which helps students learn access control in UNIX. UNIXvisual is aimed both at novice users, who need only to control access to their own files, and students of computer security, who need a deeper and more comprehensive understanding. UNIXvisual allows students to analyze permission settings without the need for a special environment. It allows a student to trace the value and effect of credentials within an executing process. It also provides a mechanism for instructors to give quizzes UNIXvisual gives instructors flexibility in covering the material by supporting self-study, lowers the overhead required for teaching access control by running under an ordinary user account, and enhances learning by leveraging visualization. UNIXvisual is available for download and runs on the Linux and MacOS platforms.

This paper describes a visualization tool VIGvisual that helps students learn and instructors teach the Vigenère cipher. The software allows the user to visualize both encryption and decryption through a variety of cipher tools. The demo mode is useful and efficient for classroom presentation. The practice mode allows the user to practice encryption and decryption. VIGvisual is quite versatile, providing support for both beginners learning how to encrypt and decrypt, and also for the more advanced users wishing to practice cryptanalysis in the attack mode. Classroom evaluation of the tool was positive.

This paper presents RBACvisual, a user-level visualization tool designed to facilitate the study and teaching of the role-based access control (RBAC) model, which has been widely used in companies to restrict access to authorized users. RBACvisual provides two graphical abstractions of the underlying specification. Policies can be input and modified graphically or using text-based files. Students can use an embedded Query system to answer commonly asked questions and to test their understanding of a given policy. A Practice subsystem is also provided for instructors to assign quizzes to students; the answers can be sent to the instructor via email. We also present the results of an evaluation of RBACvisual within a senior-level course on information security. The student feedback was positive and indicated that RBACvisual helped students understand the model and enhanced the course.

Cryptography and access control are perhaps the two most fundamental mechanisms for data protection. This workshop presents hands-on methods for teaching cryptography and access control that leverage software tools developed with funding from the NSF. The workshop will proceed in two sessions. The first session will address teaching well-known ciphers (including Vigenère, DES, AES, RSA, and SHA) and elliptic-curve cryptography using tools from the cryptoVisual software suite. These tools step students through an algorithm with either the system or the student computing the result of each step. The second session will address access control and the Multilevel Security, Role Based Access Control, and Domain Type Enforcement models using tools from the acVisual software suite. These tools support graphical policy development and analysis. The presenters have used this material in undergraduate courses in Cryptography and Computer Security. The tools have been used and evaluated favorably at multiple institutions. Participants will install and use the software on their own laptops running Linux, Windows, or MacOS. The acVisual software runs natively on Linux and MacOS and through a Linux virtual machine under Windows. The cryptoVisual software suite is available at http://www.cs.mtu.edu/~shene/NSF-4/. The acVisual software suite is available at http://acv.cs.mtu.edu.

This poster presents a visualization tool SHAvisual for instructors to teach and students to learn the SHA-512 algorithm visually with demo and practice modes. This poster will also discuss some findings of classroom use and student reactions, which are very positive and encouraging.

Information security continues to be a pressing issue for industry and government. Perhaps the two most fundamental mechanisms for controlling access to information are cryptography and access control systems. This paper presents MLSvisual, a tool that helps students learn the multi-level(Bell-LaPadula) access control model. MLSvisual allows students to create, explore, and modify an MLS policy through a graphical visualization system. A query system can be used by students to test their understanding of a given policy. Instructors can utilize a test function in the tool to assign an exercise or quiz, with answers sent to them via email. We also present the results of an evaluation of MLSvisual within a senior-level course on information security. This evaluation received positive feedback and showed that MLSviusal helped the understanding of the Bell-LaPadula model and enhanced the course. We believe that this user-level tool will help instructors to teach this material more effectively, and make teaching this material more practical in resource-constrained environments.

This paper describes a visualization tool RSAvisual that helps students learn and instructors teach the RSA cipher. This tool permits the user to visualize the steps of the RSA cipher, do encryption and decryption, learn simple factorization algorithms, and perform some elementary attacks. The demo mode of RSAvisual can be used for classroom presentation and self-study. With the practice mode, the user may go through steps in encryption, decryption, the Extended Euclidean algorithm, two simple factorization algorithms and three elementary attacks. The user may compute the output of each operation and check for correctness. This helps students learn the primitive operations and how they are used in the RSA cipher. The opportunity for self-study provides an instructor with greater flexibility in selecting a lecture pace for the detailed materials. Classroom evaluation was positive and very encouraging.

Access control systems are a key component of computer system security. This paper presents the results of an effort to understand the usability of current access control systems. A study was conducted to observe users of three access control systems: UNIX discretionary access control (DAC), SELinux, and a novel access control system, a File System Firewall (FSF), which we have designed and implemented. Several recommendations for improving user experiences with access control systems are presented based on our analysis of the study results.

This paper describes a visualization tool ECvisual that helps students understand and instructors teach elliptic curve based ciphers. This tool permits the user to visualize elliptic curves over the real field and over a finite field of prime order, perform arithmetic operations, do encryption and decryption, and convert plaintext to a point on an elliptic curve. The demo mode of ECvisual can be used for classroom presentation and self-study. With the practice mode, the user may go through steps in finite field computations, encryption, decryption and plaintext conversion. The user may compute the output for each operation check each answer for correctness. This helps students understand the primitive operations and how they are used in an elliptic curve cipher. The opportunity for self-study provides an instructor greater flexibility in selecting a lecture pace for this detail-filled material. Classroom evaluation was positive and very encouraging.

A weak conjunctive predicate is a conjunction of local predicates that is evaluated under the Possibly modality. In this study, we have proposed a distributed on-line algorithm for detecting weak conjunctions of unstable predicates in dynamic systems. In the algorithm, a virtual network of a logical ring combined with computation trees is dynamically maintained using local variables to keep track of causality relationships between distributed events. The differential technique is exploited to minimize the size of detection related information. During the execution of the distributed computation, each process maintains a vector containing potential solutions. Detection will be announced when the global predicate is verified. This algorithm does not require extra messages except those for process termination. The detection of a solution may not be announced until the termination of the underlying distributed computation in the case where a process never communicates with others. At each process, storage need is proportional to the number of processes in the system. This demand will increase in some extreme cases, although they are very rare in practice.

We present a distributed on-line algorithm for detecting conjunctive stable predicates in dynamic systems. The algorithm consists of a virtual network topology to maintain the causality relationships between distributed events and protocols to check the verification of the predicates over consistent global states. A lazy detection protocol has been developed to minimize the number of messages for the detection. Let Mcbe the number of detection messages, then the message complexity of the algorithm is Mc¿ M + n0, where M is the number of computation messages and n0is the number of initial processes the computation starts with. Computation trees are maintained in the virtual network to reduce the detection delay. Suppose that hmaxis the maximum height of the computation trees. The detection delay is O(hmax+ n0). It has been proved that a solution is declared if and only if the global predicate is verified during the progress of the underlying distributed computation.

A mutually anonymous service hides the identity of a client from the service provider and vice-versa. Providing mutual anonymity usually requires a large number of participants. While peer-to-peer (P2P) networks are capable of recruiting a large number of participants, reliable anonymous communication in these architectures, with low bandwidth usage, still needs further investigation. This paper presents MuON, a protocol to achieve mutual anonymity in unstructured P2P networks. MuON leverages epidemic-style data dissemination to deal with the high churn (changes in system membership) characteristic of unstructured P2P networks. The results from our security analysis and simulation show that MuON provides mutual anonymity over unstructured P2P networks while maintaining predictable latencies, high reliability, and low communication overhead

Summary form only given. A symmetric algorithm is proposed for detecting distributed termination in a dynamic system with asynchronous communication networks. Correctness of the algorithm is proven. In the system, active processes may create new processes or accept outside processes to join the basic computation. No processes can be destroyed or leave the system until the computation terminates. The network model exploited in the algorithm is a combination of a logical ring and computation trees. It is more general and especially suitable for the applications on Internet networks. The algorithm is more efficient than those in previous works in terms of control messages used in the detection protocol.

ThreadMentor is a multiplatform pedagogical tool designed to ease the difficulty in teaching and learning multithreaded programming. It consists of a C++ class library and a visualization system. The class library supports many thread management functions and synchronization primitives in an object-oriented way, and the visualization system is activated automatically by a user program and shows the inner working of every thread and every synchronization primitive on-the-fly. Events can also be saved for playback. In this way, students will be able to visualize the dynamic behavior of a threaded program and the interaction among threads and synchronization primitives.

This paper presents our effort in designing pedagogical tools for teaching message passing using channels. These tools include a class library that supports channels, a visualization system that helps students see the execution behavior of threads and message passing, and a topology editor that provides an environment for students to design network topologies. Moreover, since we have made sure the uniformity of the channel de.nition across the thread, parallel and distributed environments, porting a threaded program to a parallel/distributed environment is easy.

A number of communication libraries have been written to support concurrent programming. For a variety of reasons, these libraries generally are not well-suited for use in undergraduate courses. We have written a communication library uniquely tailored to an academic environment. The library provides two levels of communication abstraction (topology and channel) and supports communication among threads, processes on the same machine, and processes on different machines, via a unified interface. The routines facilitate controlled message loss along channels and can be integrated with an existing graphical tool that supports visualization of the communication that occurs. An editor has been developed for automatic code generation for arbitrary topologies via a graphical interface. All these tools run over Solaris, Linux, and Windows.

Inexpensive but accurate hardware clocks are now commonplace on many systems. A clock synchronization protocol can keep the collection of clocks for a group of networked systems roughly synchronized without the expenditure of a great deal of processor time or network bandwidth. As long as the bounded skew between clocks is taken into account, rough real time can provide an intuitive and valuable mechanism for providing a notion of order in a distributed system. This paper presents a straightforward token-based protocol for the detection of distributed deadlock under the single resource model. It uses clock values as token time stamps to ensure that exactly one process in a deadlock cycle, the process that completed the cycle, detects the deadlock and aborts, breaking the deadlock. The clock-valued time stamps also ensure that no false deadlocks are detected, without additional protocol to eliminate obsolete tokens. Arguments for the correctness of the protocol are developed.

We present the design of a systems laboratory intended for advanced undergraduates and graduate students. The laboratory provides an environment in which students are given complete (root) control of systems with essentially unrestricted access to the Internet. This is achieved without jeopardizing the security of the departmental network of which the laboratory is a part. Students in the laboratory are also given a secure environment in which to do their work. Such a laboratory is most valuable in advanced courses in operating systems and networks in which students implement and evaluate algorithms and policies subjected to real workloads. It is also valuable as a facility for research on systems and network topics, providing an open, yet safe, environment in which to work.

Recently, several flavours of UNIX have appeared which run on inexpensive personal computers. Further, the source code for these operating systems is freely available. This makes offering courses that include realistic kernel programming feasible in an academic environment. However, root access is required in order to modify a system's kernel. This poses a potential security threat both to other systems on the network and to other users of a single machine. This paper presents a lab design which securely integrates machines with untrusted users acting as root into a secured network, and which securely allows multiple users root access to the same machine.