STACK OVERWRITING ATTACKS AND DEFENCES IN UNIX ENVIRONMENT

Työn tarkoituksena on tutkia pinon ylikirjoitukseen perustuvien hyökkäysten toimintaa ja osoittaa kokeellisesti nykyisten suojaustekniikoiden olevan riittämättömiä. Tutkimus suoritetaan testaamalla miten valitut tietoturvatuotteet toimivat eri testitilanteissa. Testatut tuotteet ovat Openwall, PaX, Libsafe 2.0 ja Immunix 6.2. Testaus suoritetaan pääasiassa RedHat 7.0 ympäristössä testiohjelman avulla. Testeissä mitataan sekä tuotteiden kyky havaita hyökkäyksiä että niiden nopeusvaikutukset. Myös erityyppisten hyökkäysten ja niitä vastaan kehitettyjen metodien toimintaperiaatteet esitellään seikkaperäisesti ja havainnollistetaan yksinkertaistetuilla esimerkeillä. Esitellyt tekniikat sisältävät puskurin ylivuodot, laittomat muotoiluparametrit, loppumerkittömät merkkijonot ja taulukoiden ylivuodot. Testit osoittavat, etteivät valitut tuotteet estä kaikkia hyökkäyksiä, joten lopuksi perehdytään myös vahinkojen minimointiin onnistuneiden hyökkäysten varalta.

Methods of Design and Testing of Real Time Systems

Teollusuussovelluksissa vaaditaan nykyisin yhä useammin reaaliaikaista tiedon käsittelyä. Luotettavuus on yksi tärkeimmistä reaaliaikaiseen tiedonkäsittelyyn kykenevän järjestelmän ominaisuuksista. Sen saavuttamiseksi on sekä laitteisto, että ohjelmisto testattava. Tämän työn päätavoitteena on laitteiston testaaminen ja laitteiston testattavuus, koska luotettava laitteistoalusta on perusta tulevaisuuden reaaliaikajärjestelmille. Diplomityössä esitetään digitaaliseen signaalinkäsittelyyn soveltuvan prosessorikortin suunnittelu. Prosessorikortti on tarkoitettu sähkökoneiden ennakoivaa kunnonvalvontaa varten. Uusimmat DFT (Desing for Testability) menetelmät esitellään ja niitä sovelletaan prosessorikortin sunnittelussa yhdessä vanhempien menetelmien kanssa. Kokemukset ja huomiot menetelmien soveltuvuudesta raportoidaan työn lopussa. Työn tavoitteena on kehittää osakomponentti web -pohjaiseen valvontajärjestelmään, jota on kehitetty Sähkötekniikan osastolla Lappeenrannan teknillisellä korkeakoululla.

Design Patterns in EPOC Software Development

Työssä tutkittiin oliosuunnittelumalleja EPOC-käyttöjärjestelmässä. Työssä tutkittiin sekä yleisiä suunnittelumalleja että EPOC-ympäristössä esiintyviä oliorakenteita, niiden aiheuttamia vaatimuksia sovelluksille sekä niiden käyttämisestä saatavia hyötyjä. Työssä toteutettiin EPOC-ohjelmiston suunnittelu hyödyntäen suunnittelumalleja ja periaatteita. Oliosuunnittelumallit ovat yleistyneet huomattavasti viime vuosina. Suunnittelumallien lähtökohtana ovat sekä yleiset että ympäristökohtaiset suunnitteluperiaatteet ja säännöt. Suunnittelumallit ovat osa isompaa rakennekokonaisuutta, joka käsittää sekä prosessi-, analyysi-, arkkitehtuuri- ym. malleja. Oliosuunnittelumallit nopeuttavat ja helpottavat suunnittelua sekä parantavat uudelleenkäytettävyyttä korkeammalla abstraktiotasolla. EPOC on tulevaisuuden mobiililaitteiden yleisimpiä käyttöjärjestelmiä. EPOC on kokonaisuudessaan oliopohjainen ja sisältää lukuisia oliorakenteita, joiden ymmärtäminen on sovelluskehityksen kannalta elintärkeää. Koska ympäristöt, joissa EPOC-käyttöjärjestelmää käytetään, ovat yleensä resurssien puolesta rajoittuneita, on yleisten suunnittelumallien käytössä oltava tarkkana. EPOC vaatii yleisiin suunnittelumalleihin muutoksia ja estää joidenkin käytön kokonaan.

A Generic Framework Architecture for Portal Front End

A modem software development requires quick results and excellent quality, which leads to high demand for reusability in design and implementation of software components. The purpose of this thesis was to design and implement a reusable framework for portal front ends, including common portal features, such as authentication and authorization. The aim was also to evaluate frameworks as components of reuse and compare them to other reuse techniques. As the result of this thesis, a goo'd picture of framework's life cycle, problem domain and the actual implementation process of the framework, was obtained. It was also found out that frameworks fit well to solve recurrent and similar problems in a restricted problem domain. The outcome of this thesis was a prototype of a generic framework and an example application built on it. The implemented framework offered an abstract base for the portal front ends, using object-oriented methods and wellknown design patterns. The example application demonstrated the speed and ease of the application development based on the application frameworks.

Centralized Identity Management for Web Applications

Internet-palvelujen määrä kasvaa jatkuvasti. Henkilöllä on yleensä yksi sähköinen identiteetti jokaisessa käyttämässään palvelussa. Autentikointitunnusten turvallinen säilytys käy yhä vaikeammaksi, kun niitä kertyy yhdet jokaisesta uudesta palvelurekisteröitymisestä. Tämä diplomityö tarkastelee ongelmaa ja ratkaisuja sekä palvelulähtöisestä että teknisestä näkökulmasta. Palvelulähtöisen identiteetinhallinnan liiketoimintakonsepti ja toteutustekniikat – kuten single sign-on (SSO) ja Security Assertion Markup Language (SAML) – käydään läpi karkeiden esimerkkien avulla sekä tutustuen Nokia Account -hankkeessa tuotetun ratkaisun konseptiin ja teknisiin yksityiskohtiin. Nokia Account -palvelun ensimmäisen version toteutusta analysoidaan lopuksi identiteetinhallintapalveluiden suunnitteluperiaatteita ja vaatimuksia vasten.

Market Orientation in Rapidly Internationalizing Small Companies — Evidence from the Software Industry

For more than a decade, researchers have been aware of the increased pace of small-firm internationalization and the greater effect of these rapidly growing small businesses on the wealth, international trade, and job-creation opportunities of countries. Due to the small size of the home market, Finnish companies have been generally considered highly interested in internationalization. One particular domain in which rapid internationalization has been considered feasible is the global software business, with its knowledge-intensive nature and high growth potential. However, over time the failure rate of small entrepreneurial firms has remained especially high in high-technology markets. One of the reasons for this seems to lie in the fact that these companies are often formed by people with a strong technological background but limited competences in other areas. Further, research on the marketing capabilities of rapidly internationalizing high-tech firms has been scarce thus far. In addition, while there is much research on the first years of operations of rapidly internationalizing companies, it is not well known what becomes of them later on. Therefore, there is a need for more investigation into the managerial mindset, competences and decision-making in these small companies, especially from the perspective of how they acquire and exploit market knowledge, and enhance their networking capabilities in order to promote international expansion. The present study focuses on market orientation in small software firms that internationalize their operations rapidly in global software markets. It builds on qualitative data to illustrate how these companies develop their market-oriented product-market strategies during the process of increasing international commitment. It also shows how they manage their network relationships in order to be able to offer better customer service and to thrive in the fierce global competition. The study was conducted in the empirical context of Finnish small software companies, and the main data consists of interviews with top managers in these businesses. The interviews were designed to cover a minimum period of five years of the company's international operations, thus offering a retrospective in-depth perspective on market orientation, internationalization and partnerships in the given context. One particular focus is on less successfully internationalized software companies, and the challenges they face when approaching international markets. This study makes a significant contribution to the literature on market orientation for several reasons. First, building on data from the software industry, it clarifies the existing theory in the context of rapid internationalization and network relationships. Secondly, it provides a good body of evidence on market orientation in both successfully and less successfully internationalized companies, and identifies the key related differences between the two company groups. Thirdly, it highlights the importance of inter-firm networks in the rapid internationalization of small software firms, providing companies with important market knowledge and, in some cases, management challenges. Fourthly, this investigation clarifies market orientation in the context of different software-product strategies, thus, combining the perspectives of market orientation in both manufacturing and services. In sum, the results of the study are significant for both small software firms and public-policy makers since they shed light on the market-oriented managerial mindset and the market-information gathering and sharing processes that are needed in successful rapid internationalization.

A System-Level Simulation Model for a Protocol Processor

As the development of integrated circuit technology continues to follow Moore’s law the complexity of circuits increases exponentially. Traditional hardware description languages such as VHDL and Verilog are no longer powerful enough to cope with this level of complexity and do not provide facilities for hardware/software codesign. Languages such as SystemC are intended to solve these problems by combining the powerful expression of high level programming languages and hardware oriented facilities of hardware description languages. To fully replace older languages in the desing flow of digital systems SystemC should also be synthesizable. The devices required by modern high speed networks often share the same tight constraints for e.g. size, power consumption and price with embedded systems but have also very demanding real time and quality of service requirements that are difficult to satisfy with general purpose processors. Dedicated hardware blocks of an application specific instruction set processor are one way to combine fast processing speed, energy efficiency, flexibility and relatively low time-to-market. Common features can be identified in the network processing domain making it possible to develop specialized but configurable processor architectures. One such architecture is the TACO which is based on transport triggered architecture. The architecture offers a high degree of parallelism and modularity and greatly simplified instruction decoding. For this M.Sc.(Tech) thesis, a simulation environment for the TACO architecture was developed with SystemC 2.2 using an old version written with SystemC 1.0 as a starting point. The environment enables rapid design space exploration by providing facilities for hw/sw codesign and simulation and an extendable library of automatically configured reusable hardware blocks. Other topics that are covered are the differences between SystemC 1.0 and 2.2 from the viewpoint of hardware modeling, and compilation of a SystemC model into synthesizable VHDL with Celoxica Agility SystemC Compiler. A simulation model for a processor for TCP/IP packet validation was designed and tested as a test case for the environment.

Tietoliikenneanalysaattorin testausohjelmiston suunnittelu ja toteutus ICONIX-prosessin avulla

Matkapuhelinverkot kehittyvät jatkuvasti tarjoten asiakkailleen uusia palveluja ja nopeampia datayhteyksiä. Verkkojen eri protokollien testaamisessa käytetään apuna tietoliikenneanalysaattoreita, joiden avulla matkapuhelinverkkojen eri rajapinnoissa liikkuvaa informaatiota voidaan tutkia yksityiskohtaisesti. Tämän työn tarkoituksena oli suunnitella ja toteuttaa etämonitorointianalysaattorin testauksessa käytettävä testausohjelmisto ICONIX-prosessin avulla. Suunnitteluun katsottiin kuuluvan prosessiin mukaiset vaatimusmäärittelyn, analyysin ja alustavan suunnittelun sekä yksityiskohtaisen suunnittelun vaiheet. Toteutus muodostui vastaavasti ohjelmointityöstä ja yksikkötestauksesta. Työn tuloksena saatiin suunnittelun ja toteutuksen aikana syntyneet erilaiset kaaviot ja ohjelmakoodi. Lisäksi testausohjelmistoa käytettiin etämonitorointianalysaattorin toiminnallisuus- ja suorituskykytesteissä, joiden perusteella arvioitiin toteutetun testausohjelmiston toimivuutta. Testausohjelmiston todettiin sopivan etämonitorointianalysaattorin testaukseen, sillä niin toiminnallisuustestit kuin kuormitustestitkin saatiin suoritettua onnistuneesti toteutetun testausohjelmiston avulla. ICONIX-prosessin todettiin sopivan testausohjelmiston suunnitteluun, vaikka testausohjelmisto onkin toimintaperiaatteeltaan erilainen, kuin prosessia esittelevissä lähteissä esimerkkeinä käytetyt ohjelmistot. Eri suunnitteluvaiheisiin kului prosessiin tottumattomalta aikaa, mutta toisaalta laadittuja suunnitelmia ei tarvinnut enää toteutusvaiheen aikana muuttaa ja ohjelmointityö oli hyvin suoraviivaista.

Benefits and Limitations of Service Oriented Architecture

In this thesis I examine Service Oriented Architecture (SOA) considering both its positive and negative qualities for business organizations and IT. In SOA, services are loosely coupled and invoked through standard interfaces to enable business process independence from the underlying technology. As an architecture, SOA brings the key benefit of service reuse that may mean anything from simple application reuse to taking advantage of entire business processes across enterprises. SOA also promises interoperability especially by the Web services standards that enable platform independency. Cost efficiency is mainly a result of the savings in IT maintenance and reduced development costs. The most severe limitations of SOA are performance implications and security issues, but the applicability of SOA is also limited. Additional disadvantages of a service oriented approach include problems in data management and complexity questions, and the lack of agreement about SOA and its twofold nature as a business as well as technology approach leads to problematic interpretation of the available information. In this thesis I find the benefits and limitations of SOA for the purpose described above and propose that companies need to consider the decision to implement SOA carefully to determine whether the benefits will outdo the costs in the individual case.

The use of future-oriented knowledge in regional innovation processes: Research on knowledge generation, transfer and conversion

The importance of the regional level in research has risen in the last few decades and a vast literature in the fields of, for instance, evolutionary and institutional economics, network theories, innovations and learning systems, as well as sociology, has focused on regional level questions. Recently the policy makers and regional actors have also began to pay increasing attention to the knowledge economy and its needs, in general, and the connectivity and support structures of regional clusters in particular. Nowadays knowledge is generally considered as the most important source of competitive advantage, but even the most specialised forms of knowledge are becoming a short-lived resource for example due to the accelerating pace of technological change. This emphasizes the need of foresight activities in national, regional and organizational levels and the integration of foresight and innovation activities. In regional setting this development sets great challenges especially in those regions having no university and thus usually very limited resources for research activities. Also the research problem of this dissertation is related to the need to better incorporate the information produced by foresight process to facilitate and to be used in regional practice-based innovation processes. This dissertation is a constructive case study the case being Lahti region and a network facilitating innovation policy adopted in that region. Dissertation consists of a summary and five articles and during the research process a construct or a conceptual model for solving this real life problem has been developed. It is also being implemented as part of the network facilitating innovation policy in the Lahti region.

Harjoitustöiden vertaisarviointi opetusvälineenä

Harjoitustöiden vertaisarvioinnissa opiskelijat tarkastavat toistensa töitä ja antavat niistä palautteen annettujen ohjeiden mukaan. Yleensä opiskelijoille annetaan tätä tehtävää tukemaan tietty joukko arviointikriteereitä, joiden osalta työtä ainakin on kommentoitava. Vertaisarviointi voi antaa opiskelijoille monipuolisempaa palautetta kuin ilman sitä olisi mahdollista, mahdollisuuden tehtävien vaihtoehtoisiin ratkaisuihin tutustumiseen sekä kokemusta ongelmanratkaisun analyyttisestä ja kriittisestä tarkastelusta. Lisäksi vertaisarviointi voi tukea opettajien työtä helpottamalla riittävän palautteen antamista opiskelijoille ja antamalla jonkinlaista kuvaa opiskelijoiden näkemyksistä tehtävän aihealueeseen liittyen. Tämän työn tavoitteena on selvittää, mitä mainituista vertaisarviointiin liitetyistä hyödyistä voidaan todellisuudessa saavuttaa ohjelmointipainotteisilla kursseilla. Ohjelmointikurssin opiskelijat arvioivat kurssiin kuuluvien harjoitustöiden yhteydessä toistensa ratkaisuja yhteen tehtävistä. Opiskelijoille suunnatulla kyselyllä pyritään kartoittamaan, kuinka hyvin vertaisarvioinnille asetetut tavoitteet toteutuvat. Kokemuksia opettajan näkökulmasta selvitetään haastattelujen avulla. Testauksen toteutuksessa käytetään verkkosovellusta, johon opiskelijat tallentavat omat työnsä, josta he lataavat itselleen määrätyt työt arvioitavaksi, johon he tallentavat arvionsa ja jonka kautta he lopulta saavat palautteen omasta työstään.

Analyzing Carbon Trade Permits in Optimization Framework

The threats caused by global warming motivate different stake holders to deal with and control them. This Master's thesis focuses on analyzing carbon trade permits in optimization framework. The studied model determines optimal emission and uncertainty levels which minimize the total cost. Research questions are formulated and answered by using different optimization tools. The model is developed and calibrated by using available consistent data in the area of carbon emission technology and control. Data and some basic modeling assumptions were extracted from reports and existing literatures. The data collected from the countries in the Kyoto treaty are used to estimate the cost functions. Theory and methods of constrained optimization are briefly presented. A two-level optimization problem (individual and between the parties) is analyzed by using several optimization methods. The combined cost optimization between the parties leads into multivariate model and calls for advanced techniques. Lagrangian, Sequential Quadratic Programming and Differential Evolution (DE) algorithm are referred to. The role of inherent measurement uncertainty in the monitoring of emissions is discussed. We briefly investigate an approach where emission uncertainty would be described in stochastic framework. MATLAB software has been used to provide visualizations including the relationship between decision variables and objective function values. Interpretations in the context of carbon trading were briefly presented. Suggestions for future work are given in stochastic modeling, emission trading and coupled analysis of energy prices and carbon permits.

Eliminating Software Failures - A Literature Survey

Software faults are expensive and cause serious damage, particularly if discovered late or not at all. Some software faults tend to be hidden. One goal of the thesis is to figure out the status quo in the field of software fault elimination since there are no recent surveys of the whole area. Basis for a structural framework is proposed for this unstructured field, paying attention to compatibility and how to find studies. Bug elimination means are surveyed, including bug knowhow, defect prevention and prediction, analysis, testing, and fault tolerance. The most common research issues for each area are identified and discussed, along with issues that do not get enough attention. Recommendations are presented for software developers, researchers, and teachers. Only the main lines of research are figured out. The main emphasis is on technical aspects. The survey was done by performing searches in IEEE, ACM, Elsevier, and Inspect databases. In addition, a systematic search was done for a few well-known related journals from recent time intervals. Some other journals, some conference proceedings and a few books, reports, and Internet articles have been investigated, too. The following problems were found and solutions for them discussed. Quality assurance is testing only is a common misunderstanding, and many checks are done and some methods applied only in the late testing phase. Many types of static review are almost forgotten even though they reveal faults that are hard to be detected by other means. Other forgotten areas are knowledge of bugs, knowing continuously repeated bugs, and lightweight means to increase reliability. Compatibility between studies is not always good, which also makes documents harder to understand. Some means, methods, and problems are considered method- or domain-specific when they are not. The field lacks cross-field research.

Improving and User Interface to E-Procurement Software Used in Asset Accounting and Investigating Effects to Efficiency

This diploma thesis has been done to international organization which takes care from the accounting actions of two major companies. In this organization are used three different purchasing tools which are used when new asset master data is wanted to input to SAP R/3- system. The aim of this thesis is to find out how much changing the user interface of one of these three e-procurement programs will affect to overall efficiency in asset accounting. As an addition will be introduced project framework which can be used in future projects and which help to avoid certain steps in the development process. At the moment data needs to be inputted manually with many useless mouse clicks and data needs to be searched from many various resources which slow down the process. Other organization has better tools at the moment than the myOrders system which is under investigation Research was started by exploring the main improvement areas. After this possible defects were traced. Suggested improvements were thought by exploring literature which has been written from usability design and research. Meanwhile also directional calculations from the benefits of the project were done alongside with the analysis of the possible risks and threats. After this NSN IT approved the changes which they thought was acceptable. The next step was to program them into tool and test them before releasing to production environment. The calculations were made also from implemented improvements and compared them to planned ones From whole project was made a framework which can be utilized also to other similar projects. The complete calculation was not possible because of time schedule of the project. Important observation in the project was that efficiency is not improved not only by changing the GUI but also improving processes without any programming. Feedback from end user should be also listened more in development process. End-user is after all the one who knows the best how the program should look like.

Ketterien sovelluskehityskäytäntöjen soveltaminen J2EE-kehitykseen

Yritysohjelmistojen kehittäminen on monesti aikataulukriittistä ja tuottavuusvaatimukset ovat korkeita. Työssä kehitettiin tyypillisen web-käyttöliittymän omaavan J2EE-sovelluksen koontiin soveltuva koontimenetelmä, joka hyödyntää XP:n (Extreme Programming) sovelluskehityskäytäntöjä. Tärkeimpiä näistä on automatisoitu testaus, jonka päätyypit ovat automatisoitu yksikkö- ja integrointitestaus. Työn aikana asetettiin tavoitteet koontimenetelmälle sekä evaluointiin ja valittiin markkinoilla olevista työkaluista toimeksiantajan ympäristöön sopiva joukko. Koontimenetelmän toteutuksen tarkastelussa havaittiin, että XP:n käytännöt soveltuvat J2EE-sovelluskehitykseen ja tarpeelliset työkalut tähän ovat olemassa.