Architettura cloud per lo sviluppo multi-piattaforma di Sistemi Operativi: Principi generali

Vengono analizzate le strategie di rilascio delle principali Distribuzioni Linux e i metodi per la compilazione automatizzata del software. Si propone quindi una nuova metodologia sia per il rilascio di media installabili e sia per la pacchettizzazione. Sfruttando le tecnologie del campo DevOps, si introduce quindi un alto grado di scalabilità anche in ambienti Cloud, grazie anche alla riproducibilità di ogni componente dell'infrastruttura proposta. Vedremo quindi come questo approccio aumenta l'automatizzazione nei cicli produttivi per la realizzazione della Distribuzione Sabayon Linux e per la definizione di un'infrastruttura automatizzata attualmente in production.

Architettura cloud per lo sviluppo multi-piattaforma di Sistemi Operativi: Applicazioni specifiche

Il mondo dell’Internet of Things e del single board computing sono settori in forte espansione al giorno d’oggi e le architetture ARM sono, al momento, i dominatori in questo ambito. I sistemi operativi e i software si stanno evolvendo per far fronte a questo cambiamento e ai nuovi casi d’uso che queste tecnologie introducono. In questa tesi ci occuperemo del porting della distribuzione Linux Sabayon per queste architetture, la creazione di un infrastruttura per il rilascio delle immagini e la compilazione dei pacchetti software.

Progettazione e sviluppo di un sistema per la verifica dell'integrità hardware e firmware di un sistema

Questa tesi tratta un argomento che si è fatto sempre più interessante, soprattutto in questi ultimi anni, l'integrità firmware e hardware di un sistema. Oggigiorno milioni di persone fanno completamente affidamento al proprio sistema lasciando nelle loro mani moli di dati personali e non, molte delle quali si affidano ai moderni antivirus i quali, però, non sono in grado di rilevare e gestire attacchi che implicano l'alterazione dei firmware. Verranno mostrati diversi attacchi di questo tipo cercando di fare capire come la relativa sicurezza sia importante, inoltre saranno discussi diversi progetti reputati interessanti. Sulla base delle ricerche effettuate, poi, sarà mostrata la progettazione e l'implementazione di un software in grado di rilevare alterazioni hardware e firmware in un sistema.

PanTool - software for data harmonization and conversion, Version 1

The program PanTool was developed as a tool box like a Swiss Army Knife for data conversion and recalculation, written to harmonize individual data collections to standard import format used by PANGAEA. The format of input files the program PanTool needs is a tabular saved in plain ASCII. The user can create this files with a spread sheet program like MS-Excel or with the system text editor. PanTool is distributed as freeware for the operating systems Microsoft Windows, Apple OS X and Linux.

LAPMv2 - software for underwater large-area photo-mosaicking

LAPMv2 is a research software solution specifically developed to allow marine scientists to produce geo-referenced visual maps of the seafloor, known as mosaics, from a set of underwater images and navigation data. LAPMv2 has a graphical user interface that guides the user through the different steps of the mosaicking workflow. LAPMv2 runs on 64-bit Windows, MacOS X and Linux operating systems. There are two versions for each operating system: (1) the WEB-installers (lightweight but require an internet connection during the installation) and (2) the MCR installers (large files but can be installed on computer without internet-connection). The user manual explains how to install and start the program on the different operating systems. Go to http://www.lapm.eu.com for further information about the latest versions of LAPMv2.

Co-simulación HW/SW en Raspberry Pi

En el mundo de la simulación existen varios tipos de sistemas reales, entre los que se encuentran los sistemas de eventos discretos. Para poder simular estos sistemas se pueden utilizar, entre otras, herramientas basadas en el formalismo DEVS (Discrete EVents system Specification), como la utilizada en este proyecto: xDEVS. La simulación posee una importancia muy elevada en campos como la educación y la ciencia, y en ocasiones es necesario incluir datos del medio físico o sacar información al exterior del simulador. Por ello es necesario contar con herramientas que puedan realizar simulaciones utilizando sensores, actuadores, circuitos externos, etc., o lo que es lo mismo, que puedan realizar co-simulaciones entre software y hardware. De esta forma se puede facilitar el desarrollo de sistemas por medio de modelado y simulación, pudiendo extraer el hardware gradualmente y analizar los resultados en cada etapa. Este proyecto es de carácter incremental, y trata de extender la funcionalidad de la plataforma xDEVS para poder realizar co-simulaciones entre hardware y software sobre una Raspberry Pi. Para ello se van a utilizar circuitos lógicos como hardware externo y se enlazarán al simulador a través de ficheros de dispositivo, gestionados por módulos del kernel de Linux. Como caso de estudio se desarrolla la co-simulación entre hardware y software completa de un ascensor de siete plantas para mostrar el uso y funcionamiento en xDEVS, extrayendo los circuitos integrados de uno en uno.

Soporte de sistema operativo para ahorro de energía en plataformas móviles con procesadores multicore asimétricos

Los procesadores multicore asimétricos con repertorio común de instrucciones (AMPsAsymmetric Multicore Processors) han sido propuestos recientemente como alternativa de bajo consumo a los procesadores multicore simétricos convencionales. Los AMPs combinan, en un mismo chip, cores rápidos de alto rendimiento, con cores más lentos y sencillos de consumo reducido. Uno de los ejemplos más destacados de procesador multicore asimétrico es el procesador big.LITTLE de ARM, que incorporan algunos modelos de teléfonos móviles y tablets disponibles en la actualidad. Trabajos previos han demostrado que para explotar los beneficios potenciales de los procesadores multicore asimétricos, el sistema operativo debe tener en cuenta el beneficio relativo (speedup) que cada aplicación experimenta al ejecutar en un core rápido frente a un core lento. Actualmente, los planificadores por defecto de los sistemas operativos de propósito general no tienen en cuenta la diversidad de speedups entre aplicaciones que puede estar presente en una carga de trabajo multiprogramada. En consecuencia, la asignación de aplicaciones a cores que hacen estos planificadores no extrae el máximo rendimiento por vatio de la plataforma. Recientemente se han realizado extensiones en el kernel Linux para ofrecer un mejor soporte de planificación en multicore asimétricos. Sin embargo, estas extensiones del planificador, utilizadas fundamentalmente en dispositivos móviles con el sistema operativo Android, tampoco tienen en cuenta la diversidad de speedups en las aplicaciones de la carga de trabajo. Por lo tanto estas extensiones no constituyen una aproximación robusta desde el punto de vista de la eficiencia energética. En este proyecto se lleva a cabo la evaluación exhaustiva de distintos algoritmos de planificación para multicore asimétricos sobre una plataforma provista de un procesador ARM big.LITTLE. El principal objetivo del estudio es cuantificar el grado de eficiencia energética y el rendimiento global proporcionado por implementaciones de estos algoritmos en el kernel Linux sobre hardware multicore asimétrico real.

Integrity-Based Kernel Malware Detection

Kernel-level malware is one of the most dangerous threats to the security of users on the Internet, so there is an urgent need for its detection. The most popular detection approach is misuse-based detection. However, it cannot catch up with today's advanced malware that increasingly apply polymorphism and obfuscation. In this thesis, we present our integrity-based detection for kernel-level malware, which does not rely on the specific features of malware. We have developed an integrity analysis system that can derive and monitor integrity properties for commodity operating systems kernels. In our system, we focus on two classes of integrity properties: data invariants and integrity of Kernel Queue (KQ) requests. We adopt static analysis for data invariant detection and overcome several technical challenges: field-sensitivity, array-sensitivity, and pointer analysis. We identify data invariants that are critical to system runtime integrity from Linux kernel 2.4.32 and Windows Research Kernel (WRK) with very low false positive rate and very low false negative rate. We then develop an Invariant Monitor to guard these data invariants against real-world malware. In our experiment, we are able to use Invariant Monitor to detect ten real-world Linux rootkits and nine real-world Windows malware and one synthetic Windows malware. We leverage static and dynamic analysis of kernel and device drivers to learn the legitimate KQ requests. Based on the learned KQ requests, we build KQguard to protect KQs. At runtime, KQguard rejects all the unknown KQ requests that cannot be validated. We apply KQguard on WRK and Linux kernel, and extensive experimental evaluation shows that KQguard is efficient (up to 5.6% overhead) and effective (capable of achieving zero false positives against representative benign workloads after appropriate training and very low false negatives against 125 real-world malware and nine synthetic attacks). In our system, Invariant Monitor and KQguard cooperate together to protect data invariants and KQs in the target kernel. By monitoring these integrity properties, we can detect malware by its violation of these integrity properties during execution.

Adding Run-Time Monitoring to UML-RT by Modifying the Papyrus-RT Code Generator

In Model-Driven Engineering (MDE), the developer creates a model using a language such as Unified Modeling Language (UML) or UML for Real-Time (UML-RT) and uses tools such as Papyrus or Papyrus-RT that generate code for them based on the model they create. Tracing allows developers to get insights such as which events occur and timing information into their own application as it runs. We try to add monitoring capabilities using Linux Trace Toolkit: next generation (LTTng) to models created in UML-RT using Papyrus-RT. The implementation requires changing the code generator to add tracing statements for the events that the user wants to monitor to the generated code. We also change the makefile to automate the build process and we create an Extensible Markup Language (XML) file that allows developers to view their traces visually using Trace Compass, an Eclipse-based trace viewing tool. Finally, we validate our results using three models we create and trace.

BeSafe : Säkerhetsapplikation

Examensarbetet beskriver utvecklingen av säkerhetsapplikationen BeSafe vilken utvecklats för IT-konsulttjänsteverksamheten Sogeti. BeSafe kommer i framtiden integreras med två andra applikationer för att tillsammans bilda en större friluftsapplikation. Den färdiga applikationen besvarar de verifierbara målen och därmed även problemformuleringen. Applikationen erbjuder användaren möjlighet att stärka den egna säkerheten. Muntliga intervjuer genomfördes för att bestämma design, färger och logotyp för applikationen. Intervjuerna resulterade i en användarvänligare applikation där undersökningen riktade in arbetet mot det gränssnitt BeSafe nu har. BeSafe är utvecklad genom en iterativ process i utvecklingsmiljön Android Studios och riktar sig till enheter baserade på Androids OS. Vidareutveckling av applikationen skulle kunna ske i form av nya funktioner där användaren exempelvis kan tillåta anhöriga få live feedback på vart användaren befinner sig. Det har tagits hänsyn till etiska aspekter under arbetets gång för att värna om användarens integritet. Detta genom notifikationer, minimering av risk för spridning av data genom lagrings- och kommunikationssätt inom applikationen.

Optisen radiolinkin toteuttaminen ohjelmistoradiolla

Tämän tutkielman tavoitteena oli toteuttaa optinen radiolinkki hyödyntäen ohjelmistoradiota. Työn alkuosassa käydään läpi ohjelmistoradiota yleisellä tasolla sekä yleisesti nykyisin käytössä olevia optisia tiedonsiirtotapoja. Työn keskiosassa käsitellään työhön käytettävä laitteisto ja ohjelmistot sekä optisen radioetuasteen suunnittelu ja toteutus. Työn loppuosassa analysoidaan toteutetun etuasteen toimintaa. Ohjelmistoradio, yleisemmin ohjelmallisesti määritetty radiolaite, jonka toiminnallisuutta, kuten modulaatioita, suodattimia ja kommunikointiin käytettävää taajuuskaistaa, pystytään muuttamaan ohjelmallisesti ilman laitteistomuutoksia. Useimmiten ohjelmistoradioiden toiminnallisuus määrätään ohjelmoimalla ohjelmistoradio-oheislaitteen ohjelmoitavia porttipiirejä, eli FPGA-piirejä. Optisen radioetuasteen suunnittelun pohjana käytettiin audiokäyttöön tarkoitettua infrapunalähetintä ja – vastaanotinta, jotka muokattiin toimimaan näkyvän valon aallonpituuksilla. Ohjelmistoradio-oheislaitteena toimi Ettus USRP1 varustettuna matalataajuisilla lähetin- ja vastaanotintytärkorteilla. Ohjelmistoradion ohjelmointiympäristönä toimi Linux Ubuntu, ja ohjelmistona GNURadio sekä sen graafinen ohjelmointikäyttöliittymä Gnu Radio Companion. Tutkielman lopputuloksena saatiin aikaan piirilevylle rakennettu optisen radioetuasteen prototyyppi, jolla pystyttiin siirtämään digitaalista audiota 300 kbps tiedonsiirtonopeudella muutamien senttimetrien matkalla pimeässä tilassa.

Multirobot Tethering for Localization and Control

Particle filtering has proven to be an effective localization method for wheeled autonomous vehicles. For a given map, a sensor model, and observations, occasions arise where the vehicle could equally likely be in many locations of the map. Because particle filtering algorithms may generate low confidence pose estimates under these conditions, more robust localization strategies are required to produce reliable pose estimates. This becomes more critical if the state estimate is an integral part of system control. We investigate the use of particle filter estimation techniques on a hovercraft vehicle. The marginally stable dynamics of a hovercraft require reliable state estimates for proper stability and control. We use the Monte Carlo localization method, which implements a particle filter in a recursive state estimate algorithm. An H-infinity controller, designed to accommodate the latency inherent in our state estimation, provides stability and controllability to the hovercraft. In order to eliminate the low confidence estimates produced in certain environments, a multirobot system is designed to introduce mobile environment features. By tracking and controlling the secondary robot, we can position the mobile feature throughout the environment to ensure a high confidence estimate, thus maintaining stability in the system. A laser rangefinder is the sensor the hovercraft uses to track the secondary robot, observe the environment, and facilitate successful localization and stability in motion.

Estudo da efetividade dos mecanismos de compartilhamento de memória em hipervisores

The growing demand for large-scale virtualization environments, such as the ones used in cloud computing, has led to a need for efficient management of computing resources. RAM memory is the one of the most required resources in these environments, and is usually the main factor limiting the number of virtual machines that can run on the physical host. Recently, hypervisors have brought mechanisms for transparent memory sharing between virtual machines in order to reduce the total demand for system memory. These mechanisms “merge” similar pages detected in multiple virtual machines into the same physical memory, using a copy-on-write mechanism in a manner that is transparent to the guest systems. The objective of this study is to present an overview of these mechanisms and also evaluate their performance and effectiveness. The results of two popular hypervisors (VMware and KVM) using different guest operating systems (Linux and Windows) and different workloads (synthetic and real) are presented herein. The results show significant performance differences between hypervisors according to the guest system workloads and execution time.

Detecting Motifs in System Call Sequences

The search for patterns or motifs in data represents an area of key interest to many researchers. In this paper we present the Motif Tracking Algorithm, a novel immune inspired pattern identification tool that is able to identify unknown motifs which repeat within time series data. The power of the algorithm is derived from its use of a small number of parameters with minimal assumptions. The algorithm searches from a completely neutral perspective that is independent of the data being analysed and the underlying motifs. In this paper the motif tracking algorithm is applied to the search for patterns within sequences of low level system calls between the Linux kernel and the operating system’s user space. The MTA is able to compress data found in large system call data sets to a limited number of motifs which summarise that data. The motifs provide a resource from which a profile of executed processes can be built. The potential for these profiles and new implications for security research are highlighted. A higher level system call language for measuring similarity between patterns of such calls is also suggested.

Uma API criptográfica para aplicações embarcadas

This document presents GEmSysC, an unified cryptographic API for embedded systems. Software layers implementing this API can be built over existing libraries, allowing embedded software to access cryptographic functions in a consistent way that does not depend on the underlying library. The API complies to good practices for API design and good practices for embedded software development and took its inspiration from other cryptographic libraries and standards. The main inspiration for creating GEmSysC was the CMSIS-RTOS standard, which defines an unified API for embedded software in an implementation-independent way, but targets operating systems instead of cryptographic functions. GEmSysC is made of a generic core and attachable modules, one for each cryptographic algorithm. This document contains the specification of the core of GEmSysC and three of its modules: AES, RSA and SHA-256. GEmSysC was built targeting embedded systems, but this does not restrict its use only in such systems – after all, embedded systems are just very limited computing devices. As a proof of concept, two implementations of GEmSysC were made. One of them was built over wolfSSL, which is an open source library for embedded systems. The other was built over OpenSSL, which is open source and a de facto standard. Unlike wolfSSL, OpenSSL does not specifically target embedded systems. The implementation built over wolfSSL was evaluated in a Cortex- M3 processor with no operating system while the implementation built over OpenSSL was evaluated on a personal computer with Windows 10 operating system. This document displays test results showing GEmSysC to be simpler than other libraries in some aspects. These results have shown that both implementations incur in little overhead in computation time compared to the cryptographic libraries themselves. The overhead of the implementation has been measured for each cryptographic algorithm and is between around 0% and 0.17% for the implementation over wolfSSL and between 0.03% and 1.40% for the one over OpenSSL. This document also presents the memory costs for each implementation.