Scalable model-based configuration management of security services in complex enterprise networks

Security administrators face the challenge of designing, deploying and maintaining a variety of configuration files related to security systems, especially in large-scale networks. These files have heterogeneous syntaxes and follow differing semantic concepts. Nevertheless, they are interdependent due to security services having to cooperate and their configuration to be consistent with each other, so that global security policies are completely and correctly enforced. To tackle this problem, our approach supports a comfortable definition of an abstract high-level security policy and provides an automated derivation of the desired configuration files. It is an extension of policy-based management and policy hierarchies, combining model-based management (MBM) with system modularization. MBM employs an object-oriented model of the managed system to obtain the details needed for automated policy refinement. The modularization into abstract subsystems (ASs) segment the system-and the model-into units which more closely encapsulate related system components and provide focused abstract views. As a result, scalability is achieved and even comprehensive IT systems can be modelled in a unified manner. The associated tool MoBaSeC (Model-Based-Service-Configuration) supports interactive graphical modelling, automated model analysis and policy refinement with the derivation of configuration files. We describe the MBM and AS approaches, outline the tool functions and exemplify their applications and results obtained. Copyright (C) 2010 John Wiley & Sons, Ltd.

Formal validation of automated policy refinement in the management of network security systems

Policy hierarchies and automated policy refinement are powerful approaches to simplify administration of security services in complex network environments. A crucial issue for the practical use of these approaches is to ensure the validity of the policy hierarchy, i.e. since the policy sets for the lower levels are automatically derived from the abstract policies (defined by the modeller), we must be sure that the derived policies uphold the high-level ones. This paper builds upon previous work on Model-based Management, particularly on the Diagram of Abstract Subsystems approach, and goes further to propose a formal validation approach for the policy hierarchies yielded by the automated policy refinement process. We establish general validation conditions for a multi-layered policy model, i.e. necessary and sufficient conditions that a policy hierarchy must satisfy so that the lower-level policy sets are valid refinements of the higher-level policies according to the criteria of consistency and completeness. Relying upon the validation conditions and upon axioms about the model representativeness, two theorems are proved to ensure compliance between the resulting system behaviour and the abstract policies that are modelled.

Specific depth cone resistivity measurements to determine soil engineering properties

The University of British Columbia (UBC) began performing piezocone penetration tests (CPTU) with electrical resistivity measurements (RCPTU) in 1989. Since then, RCPTU research at UBC has focused on obtaining geo-environmental parameters such as fluid resistivity and soil engineering properties such as porosity and degree of saturation from measurements of bulk soil electrical resistivity using the empirical relationship proposed by Archie (1942). Within this framework, the paper illustrates and discusses important design and calibration issues for resistivity modules such as the use of isolated circuitry to achieve linear calibrations over large ranges of resistivity. The suitability of RCPTU measurements for determination of geo-environmental and geotechnical parameters are assessed using typical ranges of soil and groundwater properties and methods of isolating individual factors for study are discussed. Illustrative examples of RCPTU research efforts including the environmental characterization of mine tailings, delineation of saline water intrusions in fresh water aquifers and the quality control of geotechnical ground densification are presented throughout the text. It is shown that groundwater temperature and hence ion mobility is not significantly altered by frictional heat generated during piezocone penetration and that ratio-based approaches to monitoring soil porosity can be used to eliminate the requirement for extensive groundwater sampling programs. Lastly, it is shown that RCPTU measurements above the water table can only be made using resistivity modules that are stable over a large range of resistivities and that such measurements are the most difficult to interpret because of grain surface conduction effects and generally unknown fluid resistivities.

Revisiting the Security of the ALRED Design and Two of Its Variants: Marvin and LetterSoup

The ALRED construction is a lightweight strategy for constructing message authentication algorithms from an underlying iterated block cipher. Even though this construction's original analyses show that it is secure against some attacks, the absence of formal security proofs in a strong security model still brings uncertainty on its robustness. In this paper, aiming to give a better understanding of the security level provided by different authentication algorithms based on this design strategy, we formally analyze two ALRED variants-the MARVIN message authentication code and the LETTERSOUP authenticated-encryption scheme,-bounding their security as a function of the attacker's resources and of the underlying cipher's characteristics.

Optimal Code Set Selection and Security Issues in Spectral Phase-Encoded Time Spreading (SPECTS) OCDMA Systems

In this paper, we perform a thorough analysis of a spectral phase-encoded time spreading optical code division multiple access (SPECTS-OCDMA) system based on Walsh-Hadamard (W-H) codes aiming not only at finding optimal code-set selections but also at assessing its loss of security due to crosstalk. We prove that an inadequate choice of codes can make the crosstalk between active users to become large enough so as to cause the data from the user of interest to be detected by other user. The proposed algorithm for code optimization targets code sets that produce minimum bit error rate (BER) among all codes for a specific number of simultaneous users. This methodology allows us to find optimal code sets for any OCDMA system, regardless the code family used and the number of active users. This procedure is crucial for circumventing the unexpected lack of security due to crosstalk. We also show that a SPECTS-OCDMA system based on W-H 32(64) fundamentally limits the number of simultaneous users to 4(8) with no security violation due to crosstalk. More importantly, we prove that only a small fraction of the available code sets is actually immune to crosstalk with acceptable BER (<10(-9)) i.e., approximately 0.5% for W-H 32 with four simultaneous users, and about 1 x 10(-4)% for W-H 64 with eight simultaneous users.

The 3C cooperation model applied to the classical requirement analysis

Aspects related to the users' cooperative work are not considered in the traditional approach of software engineering, since the user is viewed independently of his/her workplace environment or group, with the individual model generalized to the study of collective behavior of all users. This work proposes a process for software requirements to address issues involving cooperative work in information systems that provide distributed coordination in the users' actions and the communication among them occurs indirectly through the data entered while using the software. To achieve this goal, this research uses ergonomics, the 3C cooperation model, awareness and software engineering concepts. Action-research is used as a research methodology applied in three cycles during the development of a corporate workflow system in a technological research company. This article discusses the third cycle, which corresponds to the process that deals with the refinement of the cooperative work requirements with the software in actual use in the workplace, where the inclusion of a computer system changes the users' workplace, from the face to face interaction to the interaction mediated by the software. The results showed that the highest degree of users' awareness about their activities and other system users contribute to a decrease in their errors and in the inappropriate use of the system.

Design, implementation and evaluation of a virtual laboratory for Computer Engineering Education

Broad consensus has been reached within the Education and Cognitive Psychology research communities on the need to center the learning process on experimentation and concrete application of knowledge, rather than on a bare transfer of notions. Several advantages arise from this educational approach, ranging from the reinforce of students learning, to the increased opportunity for a student to gain greater insight into the studied topics, up to the possibility for learners to acquire practical skills and long-lasting proficiency. This is especially true in Engineering education, where integrating conceptual knowledge and practical skills assumes a strategic importance. In this scenario, learners are called to play a primary role. They are actively involved in the construction of their own knowledge, instead of passively receiving it. As a result, traditional, teacher-centered learning environments should be replaced by novel learner-centered solutions. Information and Communication Technologies enable the development of innovative solutions that provide suitable answers to the need for the availability of experimentation supports in educational context. Virtual Laboratories, Adaptive Web-Based Educational Systems and Computer-Supported Collaborative Learning environments can significantly foster different learner-centered instructional strategies, offering the opportunity to enhance personalization, individualization and cooperation. More specifically, they allow students to explore different kinds of materials, to access and compare several information sources, to face real or realistic problems and to work on authentic and multi-facet case studies. In addition, they encourage cooperation among peers and provide support through coached and scaffolded activities aimed at fostering reflection and meta-cognitive reasoning. This dissertation will guide readers within this research field, presenting both the theoretical and applicative results of a research aimed at designing an open, flexible, learner-centered virtual lab for supporting students in learning Information Security.

Computer Aided Surgery for Percutaneous Nephrolithotomy: Clinical Requirement Analysis and System Design

Percutaneous nephrolithotomy (PCNL) for the treatment of renal stones and other related renal diseases has proved its efficacy and has stood the test of time compared with open surgical methods and extracorporal shock wave lithotripsy. However, access to the collecting system of the kidney is not easy because the available intra-operative image modalities only provide a two dimensional view of the surgical scenario. With this lack of visual information, several punctures are often necessary which, increases the risk of renal bleeding, splanchnic, vascular or pulmonary injury, or damage to the collecting system which sometimes makes the continuation of the procedure impossible. In order to address this problem, this paper proposes a workflow for introduction of a stereotactic needle guidance system for PCNL procedures. An analysis of the imposed clinical requirements, and a instrument guidance approach to provide the physician with a more intuitive planning and visual guidance to access the collecting system of the kidney are presented.

Improving chondrogenesis: potential and limitations of SOX9 gene transfer and mechanical stimulation for cartilage tissue engineering

Articular cartilage injuries and degeneration affect a large proportion of the population in developed countries world wide. Stem cells can be differentiated into chondrocytes by adding transforming growth factor-beta1 and dexamethasone to a pellet culture, which are unfeasible for tissue engineering purposes. We attempted to achieve stable chondrogenesis without any requirement for exogenous growth factors. Human mesenchymal stem cells were transduced with an adenoviral vector containing the SRY-related HMG-box gene 9 (SOX9), and were cultured in a three-dimensional (3D) hydrogel scaffold composite. As an additional treatment, mechanical stimulation was applied in a custom-made bioreactor. SOX9 increased the expression level of its known target genes, as well as its cofactors: the long form of SOX5 and SOX6. However, it was unable to increase the synthesis of sulfated glycosaminoglycans (GAGs). Mechanical stimulation slightly enhanced collagen type X and increased lubricin expression. The combination of SOX9 and mechanical load boosted GAG synthesis as shown by (35)S incorporation. GAG production rate corresponded well with the amount of (endogenous) transforming growth factor-beta1. Finally, cartilage oligomeric matrix protein expression was increased by both treatments. These findings provide insight into the mechanotransduction of mesenchymal stem cells and demonstrate the potential of a transcription factor in stem cell therapy.

A project-oriented course in probability and statistics for undergraduate electrical engineering students

An introductory course in probability and statistics for third-year and fourth-year electrical engineering students is described. The course is centered around several computer-based projects that are designed to achieve two objectives. First, the projects illustrate the course topics and provide hands-on experience for the students. The second and equally important objective of the projects is to convey the relevance and usefulness of probability and statistics to practical problems that undergraduate students can appreciate. The benefit of this course as to motivate electrical engineering students to excel in the study of probability concepts, instead of viewing the subject as one more course requirement toward graduation. The authors co-teach the course, and MATLAB is used for mast of the computer-based projects

Enzyme engineering of aminotransferases for improved activity and thermostability

The production by biosynthesis of optically active amino acids and amines satisfies the pharmaceutical industry in its demand for chiral building blocks for the synthesis of various pharmaceuticals. Among several enzymatic methods that allow the synthesis of optically active aminoacids and amines, the use of minotransferase is a promising one due to its broad substrate specificity and no requirement for external cofactor regeneration. The synthesis of chiral compounds by aminotransferases can be done either by asymmetric synthesis starting from keto acids or ketones, and by kinetic resolution starting from racemic aminoacids or amines. The asymmetric synthesis of substituted (S)-aminotetralin, an active pharmaceutical ingredient (API), has shown to have two major factors that contribute to increasing the cost of production. These factors are the raw material cost of biocatalyst used to produce it and product loss during biocatalyst separation. To minimize the cost contribution of biocatalyst and to minimize the loss of product, two routes have been chosen in this research: 1. To engineer the aminotransferase biocatalyst to have greater specific activity, and 2. Improve the engineering of the process by immobilization of biocatalyst in calcium alginate and addition of cosolvents. An (S)-aminotransferase (Mutant CNB03-03) was immobilized, not as purified enzyme but as enzyme within spray dried cells, in calcium alginate beads and used to produce substituted (S)-aminotetralin at 50 °C and pH 7 in experiments where the immobilized biocatalyst was recycled. Initial rate of reaction for cycle 1 (6 hr duration) was determined to be 0.258 mM/min, for cycle 2 (20 hr duration) it decreased by ~50% compared to cycle 1, and for cycle 3 (20 hr duration) it decreased by ~90% compared to cycle 1 (immobilized preparation consisted of 50 mg of spray dried cells per gram of calcium alginate). Conversion to product for each cycle decreased as well, from 100% in cycle 1 (About 50 mM), 80% in cycle 2, and 30% after cycle 3. This mutant was determined to be deactivated at elevated temperatures during the reaction cycle and was not stable enough to allow multiple cycles in its immobilized form. A new mutant aminotransferase was isolated by applying error-prone polymerase chain reaction (PCR) on the gene coding for this enzyme and screening/selection: CNB04-01. This mutant showed a significant improvement in thermostability in comparison to CNB03-03. The new mutant was immobilized and tested under similar reaction conditions. Initial rate remained fairly constant (0.2 mM/min) over four cycles (each cycle with a duration of about 20 hours) with the mutant retaining almost 80% of initial rate in the fourth cycle. The final product concentrations after each cycle did not decrease during recycle experiments. Thermostability of CNB04-01 was much improved compared to CNB03-03. Under the same reaction conditions as stated above, the addition of co-solvents was studied in order to increase substituted tetralone solubility. Toluene and sodium dodecylsulfate (SDS) were used. SDS at 0.01% (w/v) allowed four recycles of the immobilized spray dried cells of CNB04-01, always reaching higher product concentration (80-85 mM) than the system with toluene at 3% (v/v) -70 mM-. The long term activity of immobilized CNB04-01 in a system with SDS 0.01% (w/v) at 50 °C, pH 7 was retained for three cycles (20 to 24 hours each one), reaching always final product concentration between 80-85 mM, but dropping precipitously in the fourth cycle to a final product concentration of 50 mM. Although significant improvement of immobilization on productivity and stability were observed using CNB04-01, another observation demonstrated the limitations of an immobilization strategy on reducing process costs. After analyzing the results of this experiment it was seen that a sudden drop occurred on final product concentration after the third recycle. This was due to product accumulation inside the immobilized preparation. In order to improve the economics of the process, research was focused on developing a free enzyme with an even higher activity, thus reducing raw material cost as well as improving biomass separation. A new enzyme was obtained (CNB05-01) using error-prone PCR and screening using as a template the gene derived from the previous improved enzyme. This mutant was determined to have 1.6 times the initial rate of CNB04-01 and had a higher temperature optimum (55°). This new enzyme would allow reducing enzyme loading in the reaction by five-fold compared to CNB03-03, when using it at concentration of one gram of spray dried cells per liter (completing the reaction after 20-24 hours). Also this mutant would allow reducing process time to 7-8 hours when used at a concentration of 5 grams of spray dried cells per liter compared to 24 hours for CNB03-03, assuming that the observations shown before are scalable. It could be possible to improve the economics of the process by either reducing enzyme concentration or reducing process time, since the production cost of the desired product is primarily a function of both enzyme concentration and process time.

Genetic engineering and the world trade system

While the WTO agreements do not regulate the use of biotechnology per se, their rules can have a profound impact on the use of the technology for both commercial and non-commercial purposes. This book seeks to identify the challenges to international trade regulation that arise from biotechnology. The contributions examine whether existing international obligations of WTO Members are appropriate to deal with the issues arising for the use of biotechnology and whether there is a need for new international legal instruments, including a potential WTO Agreement on Biotechnology. They combine various perspectives on and topics relating to genetic engineering and trade, including human rights and gender; intellectual property rights; traditional knowledge and access and benefit sharing; food security, trade and agricultural production and food safety; and medical research, cloning and international trade.

E-Learning 2.0 in hydraulic engineering education

In this contribution the experiences with e-Learning 2.0 applications by using a Wiki for the education in hydraulic engineering are shown. Up to now important information for the students has been prepared by the instructor. For this project the students were asked to collaborate and search on their own for the information they needed. Therefore a Wiki-system was used. For the engineering practice a self dependent realisation of tasks is an important requirement which students should be prepared for. With the help of online communication there should be shown the possibilities for students for working together in an interdisciplinary team. The positive experiences as well as the results of the evaluation of this project plead for a continuation of the application of e-Learning 2.0 for education. The comparison of results of tests without using Wiki and with using Wiki shows a qualitative tendency of better marks. In this contribution we present the application of Wiki in hydraulic engineering but the results can also be used for other engineering disciplines.

Efficient Deployment of Mobile Detectors for Security Applications

We present a real-world problem that arises in security threat detection applications. The problem consists of deploying mobile detectors on moving units that follow predefined routes. Examples of such units are buses, coaches, and trolleys. Due to a limited budget not all available units can be equipped with a detector. The goal is to equip a subset of units such that the utility of the resulting coverage is maximized. Existing methods for detector deployment are designed to place detectors in fixed locations and are therefore not applicable to the problem considered here. We formulate the planning problem as a binary linear program and present a coverage heuristic for generating effective deployments in short CPU time. The heuristic has theoretical performance guarantees for important special cases of the problem. The effectiveness of the coverage heuristic is demonstrated in a computational analysis based on 28 instances that we derived from real-world data.