{"title":"S*FSM: A Paradigm Shift for Attack Resistant FSM Designs and Encodings","authors":"M. Borowczak, R. Vemuri","doi":"10.1109/BIOMEDCOM.2012.22","DOIUrl":"https://doi.org/10.1109/BIOMEDCOM.2012.22","url":null,"abstract":"While hardware design focuses on creating minimally-sized circuits, this paper proposes that security-centric designs require a departure from this mentality. The need for built-in protection mechanisms at all levels of design is paramount to providing cost-effective secure systems. We focus on the high-level design of sequential circuits by targeting Finite State Machines (FSMs) and their vulnerability to non-invasive, side channel based, attacks. The unconventional paradigm shift needed is justified by showing that conventional, minimalism-based, FSM synthesis and encodings allow direct correlation between state/transitions and Hamming Models. A two-fold method, involving structural modifications and specific encoding strategies, is proposed for side-channel secure FSM (S*FSMs). Preliminary high-level simulations show the effectiveness and potential for security driven S*FSM synthesis methods to mitigate the relationship between attack models and underlying hardware implementations.","PeriodicalId":146495,"journal":{"name":"2012 ASE/IEEE International Conference on BioMedical Computing (BioMedCom)","volume":"41 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-12-14","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126171322","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"READ -- A Resolution and Abduction Based Approach for Policy Comparison in Organizational Collaboration","authors":"Xiaofeng Xia","doi":"10.1109/BIOMEDCOM.2012.24","DOIUrl":"https://doi.org/10.1109/BIOMEDCOM.2012.24","url":null,"abstract":"The policy compliance problem is one of the categories of inconsistency problems existing between access control policies. One of the ways to cope with it is called policy comparison. In this paper we develop and use our approach to perform policy comparison, i.e. when newly specified access control policies for the resources are provided to be compared with certain original policy, we are able to ensure that the noncompliance problem between these newly specified policies and the original policies on the resources will be found. In this paper we propose the READ (Resolution and Abduction based) algorithm to be an approach of finding policy noncompliance. Our approach is based on the resolution and abduction work for Data log rules, and the evaluation of compliance is performed through set implication by Satisfiability Modulo Theories (SMT) Z3 prover. We will illustrate the implementation of READ algorithm with two examples from existing work and one example based on role based access control model.","PeriodicalId":146495,"journal":{"name":"2012 ASE/IEEE International Conference on BioMedical Computing (BioMedCom)","volume":"19 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-12-14","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123287577","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"A Framework for Model Checking of Large Scale Disease Spread Models","authors":"Krishnendu Ghosh","doi":"10.1109/BIOMEDCOM.2012.16","DOIUrl":"https://doi.org/10.1109/BIOMEDCOM.2012.16","url":null,"abstract":"The state explosion problem in model checking is a challenge for large scale models of disease spread. An efficient formalism is created for a disease spread model. Two model reduction mechanisms are described for efficiency in model checking. Queries by variants of temporal logic on the formalism are also stated.","PeriodicalId":146495,"journal":{"name":"2012 ASE/IEEE International Conference on BioMedical Computing (BioMedCom)","volume":"15 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-12-14","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123958766","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Towards an Optimizing Model for Older People at Risk of Falls","authors":"Ahmad Albu-Shamah, J. Zhan","doi":"10.1109/BIOMEDCOM.2012.15","DOIUrl":"https://doi.org/10.1109/BIOMEDCOM.2012.15","url":null,"abstract":"Falls represent a problem associated with elder people. Statistics show that the percentage of people who are aged 65 years and older, get a serious injury when they fall is increasing in a very rapid way. When an elderly person falls, the cost will be high since the fall might cause in bone fractures and sometimes even death. This paper aims to detect the possible fall event by monitoring two parameters that will be put into a mathematical formula, in order to predict whether a fall is going to occur or not so we can avoid getting a long term serious injury.","PeriodicalId":146495,"journal":{"name":"2012 ASE/IEEE International Conference on BioMedical Computing (BioMedCom)","volume":"191 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-12-14","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124238058","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Introducing Security Building Block Models","authors":"A. Rein, C. Rudolph, J. Ruiz, M. Arjona","doi":"10.1109/BIOMEDCOM.2012.28","DOIUrl":"https://doi.org/10.1109/BIOMEDCOM.2012.28","url":null,"abstract":"In today's software development process, security related design decisions are rarely made early in the overall process. Even if security is considered early, this means that in most cases a more-or-less encompassing security requirement analyses is made; Based on this analysis best-practices, ad-hoc design decisions or individual expertise is used to integrate security during the development process or after weaknesses are found after the deployment. This paper introduces Security Building Block Models which are used to build security related components, namely Security Building Blocks. These Security Building Blocks represent concrete security solutions, so called Security Properties, introduced in other publications of the SecFutur project [1]. The goal of this approach is to provide already defined and tested security related software components, which can be used early in the overall development process, to support security-design-decision already while modeling the software-system. The paper shortly describes this new Security Engineering Process with its requirement analysis and definition of Security Properties and how the Security Building Block Model fits into this approach. Additionally the Security Building Block Model is presented in detail. All artifacts and relationships of the model are described. Short examples finish up the paper to show the creation of the Security Building Blocks and their interactions with other software components.","PeriodicalId":146495,"journal":{"name":"2012 ASE/IEEE International Conference on BioMedical Computing (BioMedCom)","volume":"4 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-12-14","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121617675","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
J. Ruiz, A. Rein, M. Arjona, A. Maña, A. Monsifrot, M. Morvan
{"title":"Security Engineering and Modelling of Set-Top Boxes","authors":"J. Ruiz, A. Rein, M. Arjona, A. Maña, A. Monsifrot, M. Morvan","doi":"10.1109/BIOMEDCOM.2012.25","DOIUrl":"https://doi.org/10.1109/BIOMEDCOM.2012.25","url":null,"abstract":"This paper presents a security engineering process for the development of secure systems focusing on the specification and development of the Set-top Boxes. The paper describes the Set-top Box characteristics and functionalities and, using the process and its secure artefacts, models what we call a Domain Security Metamodel that defines all the security properties of that domain and implements them using Security Building Blocks. This security artefact can be used by system engineers when modelling their system model in order to fulfil its security requirements and, as a result, create a secure system that has security naturally integrated in its architecture and functionality.","PeriodicalId":146495,"journal":{"name":"2012 ASE/IEEE International Conference on BioMedical Computing (BioMedCom)","volume":"23 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-12-14","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114889005","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Emerging Infectious Disease: A Computational Multi-agent Model","authors":"Hong Qin, A. Shapiro, Li Yang","doi":"10.1109/BIOMEDCOM.2012.11","DOIUrl":"https://doi.org/10.1109/BIOMEDCOM.2012.11","url":null,"abstract":"In today's global society there exists a need to understand and predict the behavior of vector-borne diseases. With globalization, human groups tend to interact with other groups that can have one or multiple types of viruses. Currently, there are many mathematical models for studying patterns of emerging infectious diseases. These mathematical models are based on differential equations and can become unmanageable due to many parameters involved. With this in mind, we design and implement a simple spatial computational multi-agent model that can be used as a tool to analyze and predict the behavior of emerging infectious diseases. Our novel computational agent-based model integrated with evolution and phylogeny to simulate and understand emerging infectious diseases, which enables us to prevent or control outbreaks of infectious diseases in an effective and timely manner. Our multi-agent spatial-temporal model contributes to epidemiology, public health and computational simulation in several folds: First, our simulation offers an effective way to train public policy decision-makers who will respond to emergent outbreaks of infectious diseases in an appropriately and timely manner. Second, our model has the potential to aid real-time disease control and decision making. Third, our model uniquely takes evolution of viruses into account. Evolution of viruses means their genomic DNA/RNA sequence can mutate and compete for subpopulations of hosts (human, birds/pets). Our implementation provides graphical representation of the results by conducting a set of experiments under various settings.","PeriodicalId":146495,"journal":{"name":"2012 ASE/IEEE International Conference on BioMedical Computing (BioMedCom)","volume":"218 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-12-14","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133584164","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Sean Chung, S. Chung, T. Escrig, Yan Bai, B. Endicott-Popovsky
{"title":"2TAC: Distributed Access Control Architecture for \"Bring Your Own Device\" Security","authors":"Sean Chung, S. Chung, T. Escrig, Yan Bai, B. Endicott-Popovsky","doi":"10.1109/BIOMEDCOM.2012.26","DOIUrl":"https://doi.org/10.1109/BIOMEDCOM.2012.26","url":null,"abstract":"Mobile devices, specifically smartphones, have become ubiquitous. For this reason, businesses are starting to develop \"Bring Your Own Device\" policies to allow their employees to use their devices in the workplace. However, due to emerging attacks and limitations in device resources, it is difficult to trust these devices with access to critical proprietary information. To mitigate this problem we propose a novel architecture called 2-Tier Access Control (2TAC), which uses double layer access control along with device security profiles, anti-virus/malware scanners, and social networking.","PeriodicalId":146495,"journal":{"name":"2012 ASE/IEEE International Conference on BioMedical Computing (BioMedCom)","volume":"32 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-12-14","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128117793","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"A Modular Testing Environment for Implementation Attacks","authors":"L. Judge, M. Cantrell, C. Kendir, P. Schaumont","doi":"10.1109/BIOMEDCOM.2012.21","DOIUrl":"https://doi.org/10.1109/BIOMEDCOM.2012.21","url":null,"abstract":"Implementation attacks, including side-channel, fault, and probing attacks, have received significant attention in both research and commercial communities. Successful attacks have been demonstrated against standard cryptographic algorithms implemented on a wide variety of common platforms. In order to protect against these attacks, designers must incorporate complex countermeasures into the implementation of sensitive operations. Validating the effectiveness of implementation attack countermeasures requires specialized expertise and techniques not commonly used in other types of security and functional testing. We propose a modular testing environment for use in verifying the implementation attack resistance of secure systems. The proposed environment is an open-source solution that allows implementation attack testing to be independent of the system platform, implementation details, and type of attack under evaluation. These key features make the environment suitable for use with an implementation attack security standard in which standard test procedures are published openly and used to evaluate cryptographic systems. We use the proposed test environment to demonstrate a successful side-channel attack on AES, which illustrates the practical usefulness of our design for analyzing implementation attack security. Our open-source design is available at url{http://rijndael.ece.vt.edu/iameter}.","PeriodicalId":146495,"journal":{"name":"2012 ASE/IEEE International Conference on BioMedical Computing (BioMedCom)","volume":"115 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-12-14","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133531742","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"A Misuse Pattern for Retrieving Data from a Database Using SQL Injection","authors":"E. Fernández, E. Alder, R. Bagley, S. Paghdar","doi":"10.1109/BIOMEDCOM.2012.27","DOIUrl":"https://doi.org/10.1109/BIOMEDCOM.2012.27","url":null,"abstract":"SQL injection attacks represent a serious threat to any database-driven site and they are one of the most frequent types of attacks. We present here a misuse pattern for retrieving data from a database using SQL injection, which describes the essential and typical characteristics of this type of attack. A misuse pattern describes from the point of view of the attacker, how a type of attack or misuse is performed (what units it uses and how), looks at the selection of the methods available to the attacker, analyzes the way of stopping the attack, and describes how to trace the attack once it has happened by appropriate collection and observation of forensic data.","PeriodicalId":146495,"journal":{"name":"2012 ASE/IEEE International Conference on BioMedical Computing (BioMedCom)","volume":"29 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-12-14","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114579174","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}