| 1. |
- Schoepe, Daniel, 1989, et al.
(författare)
-
SeLINQ: Tracking information across application-database boundaries
- 2014
-
Ingår i: SIGPLAN Notices (ACM Special Interest Group on Programming Languages). - New York, NY, USA : ACM. - 0730-8566. - 9781450328739 ; 49:9, s. 25-38
-
Konferensbidrag (refereegranskat)abstract
- The root cause for confidentiality and integrity attacks against computing systems is insecure information flow. The complexity of modern systems poses a major challenge to secure end-to-end information flow, ensuring that the insecurity of a single component does not render the entire system insecure. While information flow in a variety of languages and settings has been thoroughly studied in isolation, the problem of tracking information across component boundaries has been largely out of reach of the work so far. This is unsatisfactory because tracking information across component boundaries is necessary for end-to-end security. This paper proposes a framework for uniform tracking of information flow through both the application and the underlying database. Key enabler of the uniform treatment is recent work by Cheney et al., which studies database manipulation via an embedded language-integrated query language (with Microsoft's LINQ on the backend). Because both the host language and the embedded query languages are functional F#-like languages, we are able to leverage information-flow enforcement for functional languages to obtain information-flow control for databases "for free", synergize it with information-flow control for applications and thus guarantee security across application-database boundaries. We develop the formal results in the form of a security type system that includes a treatment of algebraic data types and pattern matching, and establish its soundness. On the practical side, we implement the framework and demonstrate its usefulness in a case study with a realistic movie rental database.
|
|
| 2. |
|
|
| 3. |
- Birgisson, Arnar, 1981, et al.
(författare)
-
Boosting the Permissiveness of Dynamic Information-Flow Tracking by Testing
- 2012
-
Ingår i: Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics). - Berlin, Heidelberg : Springer Berlin Heidelberg. - 1611-3349 .- 0302-9743. ; 7459, s. 55-72
-
Konferensbidrag (refereegranskat)abstract
- Tracking information flow in dynamic languages remains an open challenge. It might seem natural to address the challenge by runtime monitoring. However, there are well-known fundamental limits of dynamic flow-sensitive tracking of information flow, where paths not taken in a given execution contribute to information leaks. This paper shows how to overcome the permissiveness limit for dynamic analysis by a novel use of testing. We start with a program supervised by an information-flow monitor. The security of the execution is guaranteed by the monitor. Testing boosts the permissiveness of the monitor by discovering paths where the monitor raises security exceptions. Upon discovering a security error, the program is modified by injecting an annotation that prevents the same security exception on the next run of the program. The elegance of the approach is that it is sound no matter how much coverage is provided by the testing. Further, we show that when the mechanism has discovered the necessary annotations, then we have an accuracy guarantee: the results of monitoring a program are at least as accurate as flow-sensitive static analysis. We illustrate our approach for a simple imperative language with records and exceptions. Our experiments with the QuickCheck tool indicate that random testing accurately discovers annotations for a collection of scenarios with rich information flows.
|
|
| 4. |
- Björn, Hedin, 1970-
(författare)
-
Exploring Opportunistic Use of Mobile Devices for Studying in Higher Education
- 2014
-
Doktorsavhandling (övrigt vetenskapligt/konstnärligt)abstract
- Students today often feel that they have too much to do and too little time. A common strategy to remedy this is to take advantage of opportunities to use “inter-time”, the time between other activities such as waiting or traveling. The aim of this thesis is to explore how studying using mobile devices in higher education can be designed for such opportunities. I choose to call this Opportunistic Mobile Studying (OMS).Using a design-based research approach this thesis discusses and proposes both scientific and practical contributions. A number of iterations of OMS have been designed, instantiated and tested in university courses and then evaluated using mixed methods.The first research question is how can OMS be designed to support students in adopting the behavior of studying at opportune moments. The results have been framed and interpreted using the Fogg Behavior Model, where behavior is the product of motivation, simplicity, and triggers. The results suggest that a key factor for motivation is procrastination, and therefore deadlines can be used to predict and suggest what students would likely be interested in studying during OMS moments. Simplicity is increased if OMS is adapted for studying in short fragmented moments, where important aspects are that content should be short, easy to access and easy to navigate. Trigger reminders were particularly appreciated and should be triggered based on time and place. Commuting is identified as a good context to build a routine of studying using OMS.The second research question is how can OMS activities and content be designed to support efficient studying in OMS situations. Study- activities identified as especially suitable for OMS situations are those that focus on preparation and repetition. These activities can enhance other learning activities and efficient studying can be accomplished even if only a little time is available. Examples of successful methods for this tested in this thesis include advance organizers and flashcards. Longer and more comprehensive studying material can be used if quick and easy navigation within the material is provided, for example, by using synchronized narrated slides such as enhanced podcasts.
|
|
| 5. |
- Björn, Hedin, 1970-, et al.
(författare)
-
Nu ska jag plugga! Jag ska bara färgsortera mina böcker först
- 2013
-
Konferensbidrag (övrigt vetenskapligt/konstnärligt)abstract
- Prokrastinering, eller att mot bättre vetande skjuta upp något, är ett stort problem i samhället i allmänhet och för studenter i synnerhet. I denna artikel beskriver vi en utbildningsmodul om prokrastinering som vi introducerat på två civilingenjörsprogram på KTH, varav denna rapport behandlar datateknikprogrammet där 466 studenter deltog. Utvärderingen hade 100% svarsfrekvens, och visar att 95% av studenterna hade problem med prokrastinering varav 43% hade stora eller mycket stora problem. 88% ansåg att prokrastinering var ett bra tema att ha med i utbildningen, och 57% ansåg att momentet haft positiva effekter på deras studievanor. Endast 7% ansåg att momentet inte hade gett några märkbara effekter på studierna. Då modulen endast kräver ca 8 timmars arbete från studenternas sida anser vi att fördelarna är så stora att denna eller en liknande modul borde ingå i samtliga utbildningsprogram.
|
|
| 6. |
- Grönlund, Erik, et al.
(författare)
-
Ecosystem services evaluated using emergy methodology
- 2012
-
Konferensbidrag (övrigt vetenskapligt/konstnärligt)abstract
- Ecosystem services (ES) is a concept aiming to internalize assets and costs that are not covered by the traditional market valuations.The market failures giving the ES values much lower than their importance to economies has so far been met by ad hoc modificationsof traditional market valuations. The emergy methodology takes another approach by starting at the global level of driving forces of thebiosphere and then allocating which parts of the total driving forces are used by the ES studied. This approach can be characterized asattributing "donor values" rather than "market values" to ES. Since most other methods to assess ES are market based, the emergyapproach could complement and increase our understanding.Emergy is a measure appearing when applying the energy hierarchy principle to natural (e.g. forests and lakes) or human (e.g. citiesand countries) systems, postulating that energies in any system will self-organize in hierarchical patterns given time to do so.There are two possible main paths in the emergy methodology when applied to ES: the emergy values of the natural driving forces areused, or the emergy values delivered by the environmental production systems are used. Here we discuss the suitability of these twoapproaches when applied to ES using case studies on three different scales: The national level with Sweden as the example, theregional level with the Swedish County of Jämtland as example, and the local level with the small island of Norderön located within theCounty of Jämtland as example.Results show that the use of natural driving forces gives outcomes more related to earlier attempts estimating ES with other methodsthan emergy accounting. The approach with environmental production systems diverts to some extent from other approaches,especially in its use of feedback from the economic sector.
|
|
| 7. |
|
|
| 8. |
- Hedin, Daniel, 1978, et al.
(författare)
-
Information-flow security for a core of JavaScript
- 2012
-
Ingår i: Proceedings. The Computer Security Foundations Workshop III. - 1063-6900. - 9780769547183 ; , s. 3-18
-
Konferensbidrag (refereegranskat)abstract
- Tracking information flow in dynamic languages remains an important and intricate problem. This paper makes substantial headway toward understanding the main challenges and resolving them. We identify language constructs that constitute a core of JavaScript: objects, higher-order functions, exceptions, and dynamic code evaluation. The core is powerful enough to naturally encode native constructs as arrays, as well as functionalities of JavaScript's API from the document object model (DOM) related to document tree manipulation and event processing. As the main contribution, we develop a dynamic type system that guarantees information-flow security for this language.
|
|
| 9. |
- Hedin, Daniel, 1978, et al.
(författare)
-
JSFlow: Tracking Information Flow in JavaScript and its APIs
- 2014
-
Ingår i: Proceedings of the ACM Symposium on Applied Computing (SAC). - New York, NY, USA : ACM. - 9781450324694 ; , s. 1663-1671
-
Konferensbidrag (refereegranskat)abstract
- JavaScript drives the evolution of the web into a powerful application platform. Increasingly, web applications combine services from different providers. The script inclusion mechanism routinely turns barebone web pages into full-fledged services built up from third-party code. Such code provides a range of facilities from helper utilities (such as jQuery) to readily available services (such as Google Analytics and Tynt). Script inclusion poses a challenge of ensuring that the integrated third-party code respects security and privacy. This paper presents JSFlow, a security-enhanced JavaScript interpreter for fine-grained tracking of information flow. We show how to resolve practical challenges for enforcing information-flow policies for the full JavaScript language, as well as tracking information in the presence of libraries, as provided by browser APIs. The interpreter is itself written in JavaScript, which enables deployment as a browser extension. Our experiments with the extension provide in-depth understanding of information manipulation by third-party scripts such as Google Analytics. We find that different sites intended to provide similar services effectuate rather different security policies for the user's sensitive information: some ensure it does not leave the browser, others share it with the originating server, while yet others freely propagate it to third parties. Copyright 2014 ACM.
|
|
| 10. |
- Honée, Caspar, et al.
(författare)
-
Environmental Performance of Data Centres : A Case Study of the Swedish National Insurance Administration : EGG2012, Berlin
- 2012
-
Ingår i: Electronics Goes Green 2012+, ECG 2012 - Joint International Conference and Exhibition, Proceedings. - Berlin : Fraunhofer Verlag. - 9783839604397 ; , s. Art. no. 6360435-
-
Konferensbidrag (övrigt vetenskapligt/konstnärligt)abstract
- There are indications of Data Centres being nodes for environmental impacts in IT solutions, but due to reasons connected to protection of business core assets, few open studies on such centres exist. This LCA case-study of the Swedish National Insurance Agency Data Centre in Sundsvall confirms and quantifies the significance of the environmental load posed by the data centre. The centre increases the IT carbon footprint by more than half (54%) relative to the institutes PC equipment fleet. In the operational phase, climate change contributions are more than double to that of PC use. Environmental impact stemming from embedded emissions in data centre capital infrastructure is significant (33%) given the relative short economic lifetime of the IT hardware. Even within the cold climate geographical zone, about a third (32%) of data centre supplied energy is consumed by air-conditioning thus offering opportunities to further leverage free cooling
|
|
