Tool-supported dataflow analysis of a security-critical embedded device

Defence organisations perform information security evaluations to confirm that electronic communications devices are safe to use in security-critical situations. Such evaluations include tracing all possible dataflow paths through the device, but this process is tedious and error-prone, so automated reachability analysis tools are needed to make security evaluations faster and more accurate. Previous research has produced a tool, SIFA, for dataflow analysis of basic digital circuitry, but it cannot analyse dataflow through microprocessors embedded within the circuit since this depends on the software they run. We have developed a static analysis tool that produces SIFA compatible dataflow graphs from embedded microcontroller programs written in C. In this paper we present a case study which shows how this new capability supports combined hardware and software dataflow analyses of a security critical communications device.

Data flow analysis of embedded program expressions

Data flow analysis techniques can be used to help assess threats to data confidentiality and integrity in security critical program code. However, a fundamental weakness of static analysis techniques is that they overestimate the ways in which data may propagate at run time. Discounting large numbers of these false-positive data flow paths wastes an information security evaluator's time and effort. Here we show how to automatically eliminate some false-positive data flow paths by precisely modelling how classified data is blocked by certain expressions in embedded C code. We present a library of detailed data flow models of individual expression elements and an algorithm for introducing these components into conventional data flow graphs. The resulting models can be used to accurately trace byte-level or even bit-level data flow through expressions that are normally treated as atomic. This allows us to identify expressions that safely downgrade their classified inputs and thereby eliminate false-positive data flow paths from the security evaluation process. To validate the approach we have implemented and tested it in an existing data flow analysis toolkit.

Information sharing with key suppliers : a contingency approach

This paper focuses on information sharing with key suppliers and seeks to explore the factors that might influence its extent and depth. We also investigate how information sharing affects a company’s performance with regards to resource usage, output, and flexibility. Drawing from transaction cost- and contingency theories, several factors, namely environmental uncertainty, demand uncertainty, dependency and, the product life cycle stage are proposed to explain the level of information shared with key suppliers. We develop a model where information sharing mediates the (contingent) factors and company performance. A mail survey was used to collect data from Finnish and Swedish companies. Partial Least Squares analysis was separately performed for each country (n=119, n=102). There was consistent evidence that environmental uncertainty, demand uncertainty and supplier/buyer dependency had explanatory power, whereas no significance was found for the product life cycle stage. The results also confirm previous studies by providing support for a positive relationship between information sharing and performance, where output performance was found to be the most strongly related

State convergence in the initialisation of the Sfinks stream cipher

Sfinks is a shift register based stream cipher designed for hardware implementation. The initialisation state update function is different from the state update function used for keystream generation. We demonstrate state convergence during the initialisation process, even though the individual components used in the initialisation are one-to-one. However, the combination of these components is not one-to-one.

Australian Tax Analysis [8th Edition]

Now in its eighth edition, Australian Tax Analysis: Cases, Commentary, Commercial Applications and Questions has a proven track record as a high level work for students of taxation law written by a team of authors with many years of experience. Taking into account the fact that the volume of material needed to be processed by today’s taxation student can be overwhelming, the well-chosen extracts and thought-provoking commentary in Australian Tax Analysis, 8th edition, provide readers with the depth of knowledge, and reasoning and analytical skills that will be required of them as practitioners. As well as the carefully selected case extracts and the helpful commentary, each chapter is supplemented by engaging practice questions, involving problem-solving, commercial decision-making, legal analysis and quantitative application. All these elements combined make Australian Tax Analysis an invaluable aid to the understanding of a subject that can be both technical and complex.

Promoting student well-being and resilience at law school

University can be a psychologically distressing place for students, particularly those studying law. Legal academics have been concerned about this for some time. In the United States, in particular, it has been found that symptoms of psychological distress rise signifi cantly for students in their fi rst year of law (compared to levels in the general population at that time), and persist throughout the degree to post-graduation. Recognised symptoms include depression, obsessive compulsive behaviour, feelings of inadequacy and inferiority, anxiety, hostility, paranoia, and social alienation. Many students experience law school as an isolating, adversarial and competitive environment, which impacts negatively on their values and motivation...

Fish out of water : refugee and international students in mainstream Australian schools

In this paper, the authors combine Pierre Bourdieu’s concept of hysteresis (the ‘fish out of water’ experience) with the discourse historical approach to critical discourse analysis (CDA) as a theoretical and analytical framework through which they examine specific moments in the schooling experiences of one refugee student and one international student, both enrolled in post-compulsory education in Australian mainstream secondary schools. We examine specific moments – as narrated by these students during interviews – in which these students can be described as ‘fish out of water’. As such, this paper takes up the concerns of researchers who call for an examination of the lived geographies and the everyday lives of individual students in mainstream schools. We find that our students’ habitus, conditioned by their previous schooling experiences in their home countries, did not match their new Australian schools, resulting in frustration with, and alienation from, their mainstream schools. However, we also note that schools, too, need to adapt and adjust their habitus to the new multicultural world, in which there are international and refugee students among their usual cohort of mainstream students.

Analysis of Object-Specific Authorization Protocol (OSAP) using coloured Petri nets

The use of Trusted Platform Module (TPM) is be- coming increasingly popular in many security sys- tems. To access objects protected by TPM (such as cryptographic keys), several cryptographic proto- cols, such as the Object Specific Authorization Pro- tocol (OSAP), can be used. Given the sensitivity and the importance of those objects protected by TPM, the security of this protocol is vital. Formal meth- ods allow a precise and complete analysis of crypto- graphic protocols such that their security properties can be asserted with high assurance. Unfortunately, formal verification of these protocols are limited, de- spite the abundance of formal tools that one can use. In this paper, we demonstrate the use of Coloured Petri Nets (CPN) - a type of formal technique, to formally model the OSAP. Using this model, we then verify the authentication property of this protocol us- ing the state space analysis technique. The results of analysis demonstrates that as reported by Chen and Ryan the authentication property of OSAP can be violated.

Towards a secure human-and-computer mutual authentication protocol

We blend research from human-computer interface (HCI) design with computational based crypto- graphic provable security. We explore the notion of practice-oriented provable security (POPS), moving the focus to a higher level of abstraction (POPS+) for use in providing provable security for security ceremonies involving humans. In doing so we high- light some challenges and paradigm shifts required to achieve meaningful provable security for a protocol which includes a human. We move the focus of security ceremonies from being protocols in their context of use, to the protocols being cryptographic building blocks in a higher level protocol (the security cere- mony), which POPS can be applied to. In order to illustrate the need for our approach, we analyse both a protocol proven secure in theory, and a similar proto- col implemented by a �nancial institution, from both HCI and cryptographic perspectives.

Improving the efficiency of RFID authentication with pre-computation

Security of RFID authentication protocols has received considerable interest recently. However, an important aspect of such protocols that has not received as much attention is the efficiency of their communication. In this paper we investigate the efficiency benefits of pre-computation for time-constrained applications in small to medium RFID networks. We also outline a protocol utilizing this mechanism in order to demonstrate the benefits and drawbacks of using thisapproach. The proposed protocol shows promising results as it is able to offer the security of untraceableprotocols whilst only requiring the time comparable to that of more efficient but traceable protocols.

Conceptual modeling - an epistemological foundation

The success of contemporary organizations depends on their ability to make appropriate decisions. Making appropriate decisions is inevitably bound to the availability and provision of relevant information. Information systems should be able to provide information in an efficient way. Thus, within information systems development a detailed analysis of information supply and information demands has to prevail. Based on Syperski’s information set and subset-model we will give an epistemological foundation of information modeling in general and show, why conceptual modeling in particular is capable of specifying effective and efficient information systems. Furthermore, we derive conceptual modeling requirements based on our findings. A short example illustrates the usefulness of a conceptual data modeling technique for the specification of information systems.

Total Dik - Transmedia Concept development

Total Dik! is a collaborative project between the Queensland University of Technology (QUT) and Queensland Theatre Company (QTC). Total Dik! explores transmedia storytelling in live performance from concept development to delivery and builds on works, By the Way, Meet Vera Stark, (Forrester2012), Hotel Modern’s Kamp (2005) and God’s Beard (2012) that use visual art, puppetry, music and film. The project’s first iteration enabled an interrogation of the integration of media-rich elements with live performers in a theatrical environment. Performative transmedia storytelling draws on the tenets of convergent media theory developed by Jenkins (2007, 2012), Dena (2010) and Philips (2012). This exploratory work, juxtaposing transmedia storytelling techniques with live performance, draws on Samuel Becket’s challenges to theatre orthodoxy, and touches on Brechtian notions of alienation through ‘sleight-of-hand’ or processual unpacking and deconstruction during performance. Total Dik! blends a convergence of technologies, models, green screen capture, and live dimensions of performance in one narrative allowing the work’s creators to test new combinations of transmedia storytelling techniques on a traditional performance platform.

The effect of testing protocol on immature bovine thoracic spine segment stiffness

Introduction. In vitro spine biomechanical testing has been central to many advances in understanding the physiology and pathology of the human spine. Owing to the difficulty in obtaining sufficient numbers of human samples to conduct these studies, animal spines have been accepted as a substitute model. However, it is difficult to compare results from different studies, as they use different preparation, testing and data collection methods. The aim of this study was to identify the effect of repeated cyclic loading on bovine spine segment stiffness. It also aimed to quantify the effect of multiple freeze-thaw sequences, as many tests would be difficult to complete in a single session [1-3]. Materials and Methods. Thoracic spines from 6-8 week old calves were used. Each spine was dissected and divided into motion segments including levels T4-T11 (n=28). These were divided into two equal groups. Each segment was potted in polymethylemethacrylate. An Instron Biaxial materials testing machine with a custom made jig was used for testing. The segments were tested in flexion/extension, lateral bending and axial rotation at 37 degrees C and 100% humidity, using moment control to a maximum plus/minus 1.75 Nm with a loading rate of 0.3 Nm per second. Group (A) were tested with continuous repeated cyclic loading for 500 cycles with data recorded at cycles 3, 5, 10, 25, 100, 200, 300, 400 and 500. Group (B) were tested with 10 load cycles after each of 5 freeze thaw sequences. Data was collected from the tenth load cycle after each sequence. Statistical analysis of the data was performed using paired samples t-tests, ANOVA and generalized estimating equations. Results. The data were confirmed as having a normal distribution. 1. There were significant reductions in mean stiffness in flexion/extension (-20%; P=0.001) and lateral bending (-17%; P=0.009) over the 500 load cycles. However, there was no statistically significant change in axial rotation (P=0.152) 2. There was no statistically significant difference between mean stiffness over the five freeze-thaw sequences in flexion/extension (p=0.879) and axial rotation (p=0.07). However, there was a significant reduction in stiffness in lateral bending (-26%; p=0.007) Conclusion. Biomechanical testing of immature bovine spine motion segments requires careful interpretation. The effect of the number of load cycles as well as the number of freeze-thaw cycles on the stiffness of the motion segments depends on the axis of main movement.

The association between pterygium and conjunctival ultraviolet autofluorescence : The Norfolk Island Eye Study

Purpose: To investigate the association between conjunctival ultraviolet autofluorescence (UVAF), a biomarker of ocular ultraviolet radiation (UVR) exposure, and prevalent pterygium. Methods: We conducted a cross-sectional study on Norfolk Island, South Pacific. All permanent residents aged ‡15 were invited to participate. Participants completed a sun exposure questionnaire and underwent autorefraction and slit lamp biomicroscope examination. Area of conjunctival UVAF (sum of temporal ⁄ nasal area in right and left eyes) was determined using computerized methods. Multivariate logistic and linear regression models were used to estimate the associations with pterygia and UVAF, respectively. Results: Of 641 participants, 70 people (10.9%) had pterygium in one or both eyes, and prevalence was higher in males (15.0% versus 7.7%, p = 0.003). Significant independent associations with pterygium in any eye were UVAF (per 10 mm2) [odds ratio (OR) 1.16, 95% confidence interval (CI) 1.16–1.28, p = 0.002], tanning skin phenotype (OR 2.17,1.20–3.92, p = 0.010) and spending more than three-quarters of the day outside (OR 2.22, 1.20–4.09, p = 0.011). Increasing quartile of UVAF was associated with increased risk of pterygium following adjustment of age, sex and time outdoors (pTrend = 0.002). Independent associations with increasing UVAF (per 10 mm2) were decreasing age, time outdoors, skin type and male gender (all p < 0.001). UVAF area correlated well with the duration of outdoor activity (pTrend < 0.001). Conclusion: Pterygium occurs in approximately one-tenth of Norfolk Islanders. Increasing conjunctival UVAF is associated with prevalent pterygia, confirming earlier epidemiological, laboratory and ray-tracing studies that pterygia are associated with UVR. Protection from the sun should be encouraged to reduce the prevalence of pterygium in the community.