Strengthening and formally verifying privacy in identity management systems

In a digital world, users’ Personally Identifiable Information (PII) is normally managed with a system called an Identity Management System (IMS). There are many types of IMSs. There are situations when two or more IMSs need to communicate with each other (such as when a service provider needs to obtain some identity information about a user from a trusted identity provider). There could be interoperability issues when communicating parties use different types of IMS. To facilitate interoperability between different IMSs, an Identity Meta System (IMetS) is normally used. An IMetS can, at least theoretically, join various types of IMSs to make them interoperable and give users the illusion that they are interacting with just one IMS. However, due to the complexity of an IMS, attempting to join various types of IMSs is a technically challenging task, let alone assessing how well an IMetS manages to integrate these IMSs. The first contribution of this thesis is the development of a generic IMS model called the Layered Identity Infrastructure Model (LIIM). Using this model, we develop a set of properties that an ideal IMetS should provide. This idealized form is then used as a benchmark to evaluate existing IMetSs. Different types of IMS provide varying levels of privacy protection support. Unfortunately, as observed by Jøsang et al (2007), there is insufficient privacy protection in many of the existing IMSs. In this thesis, we study and extend a type of privacy enhancing technology known as an Anonymous Credential System (ACS). In particular, we extend the ACS which is built on the cryptographic primitives proposed by Camenisch, Lysyanskaya, and Shoup. We call this system the Camenisch, Lysyanskaya, Shoup - Anonymous Credential System (CLS-ACS). The goal of CLS-ACS is to let users be as anonymous as possible. Unfortunately, CLS-ACS has problems, including (1) the concentration of power to a single entity - known as the Anonymity Revocation Manager (ARM) - who, if malicious, can trivially reveal a user’s PII (resulting in an illegal revocation of the user’s anonymity), and (2) poor performance due to the resource-intensive cryptographic operations required. The second and third contributions of this thesis are the proposal of two protocols that reduce the trust dependencies on the ARM during users’ anonymity revocation. Both protocols distribute trust from the ARM to a set of n referees (n > 1), resulting in a significant reduction of the probability of an anonymity revocation being performed illegally. The first protocol, called the User Centric Anonymity Revocation Protocol (UCARP), allows a user’s anonymity to be revoked in a user-centric manner (that is, the user is aware that his/her anonymity is about to be revoked). The second protocol, called the Anonymity Revocation Protocol with Re-encryption (ARPR), allows a user’s anonymity to be revoked by a service provider in an accountable manner (that is, there is a clear mechanism to determine which entity who can eventually learn - and possibly misuse - the identity of the user). The fourth contribution of this thesis is the proposal of a protocol called the Private Information Escrow bound to Multiple Conditions Protocol (PIEMCP). This protocol is designed to address the performance issue of CLS-ACS by applying the CLS-ACS in a federated single sign-on (FSSO) environment. Our analysis shows that PIEMCP can both reduce the amount of expensive modular exponentiation operations required and lower the risk of illegal revocation of users’ anonymity. Finally, the protocols proposed in this thesis are complex and need to be formally evaluated to ensure that their required security properties are satisfied. In this thesis, we use Coloured Petri nets (CPNs) and its corresponding state space analysis techniques. All of the protocols proposed in this thesis have been formally modeled and verified using these formal techniques. Therefore, the fifth contribution of this thesis is a demonstration of the applicability of CPN and its corresponding analysis techniques in modeling and verifying privacy enhancing protocols. To our knowledge, this is the first time that CPN has been comprehensively applied to model and verify privacy enhancing protocols. From our experience, we also propose several CPN modeling approaches, including complex cryptographic primitives (such as zero-knowledge proof protocol) modeling, attack parameterization, and others. The proposed approaches can be applied to other security protocols, not just privacy enhancing protocols.

Local adjustment and global adaptation of control periods for QoC management of control systems

Linking real-time schedulability directly to the Quality of Control (QoC), the ultimate goal of a control system, a hierarchical feedback QoC management framework with the Fixed Priority (FP) and the Earliest-Deadline-First (EDF) policies as plug-ins is proposed in this paper for real-time control systems with multiple control tasks. It uses a task decomposition model for continuous QoC evaluation even in overload conditions, and then employs heuristic rules to adjust the period of each of the control tasks for QoC improvement. If the total requested workload exceeds the desired value, global adaptation of control periods is triggered for workload maintenance. A sufficient stability condition is derived for a class of control systems with delay and period switching of the heuristic rules. Examples are given to demonstrate the proposed approach.

Identity management : strengthening one-time password authentication through usability

Usability in HCI (Human-Computer Interaction) is normally understood as the simplicity and clarity with which the interaction with a computer program or a web site is designed. Identity management systems need to provide adequate usability and should have a simple and intuitive interface. The system should not only be designed to satisfy service provider requirements but it has to consider user requirements, otherwise it will lead to inconvenience and poor usability for users when managing their identities. With poor usability and a poor user interface with regard to security, it is highly likely that the system will have poor security. The rapid growth in the number of online services leads to an increasing number of different digital identities each user needs to manage. As a result, many people feel overloaded with credentials, which in turn negatively impacts their ability to manage them securely. Passwords are perhaps the most common type of credential used today. To avoid the tedious task of remembering difficult passwords, users often behave less securely by using low entropy and weak passwords. Weak passwords and bad password habits represent security threats to online services. Some solutions have been developed to eliminate the need for users to create and manage passwords. A typical solution is based on generating one-time passwords, i.e. passwords for single session or transaction usage. Unfortunately, most of these solutions do not satisfy scalability and/or usability requirements, or they are simply insecure. In this thesis, the security and usability aspects of contemporary methods for authentication based on one-time passwords (OTP) are examined and analyzed. In addition, more scalable solutions that provide a good user experience while at the same time preserving strong security are proposed.

The relationship between parents’ self-efficacy beliefs, outcome expectations, child behaviour, and management of atopic dermatitis

Atopic dermatitis (AD) is a chronic inflammatory skin condition, characterized by intense pruritis, with a complex aetiology comprising multiple genetic and environmental factors. It is a common chronic health problem among children, and along with other allergic conditions, is increasing in prevalence within Australia and in many countries worldwide. Successful management of childhood AD poses a significant and ongoing challenge to parents of affected children. Episodic and unpredictable, AD can have profound effects on children’s physical and psychosocial wellbeing and quality of life, and that of their caregivers and families. Where concurrent child behavioural problems and parenting difficulties exist, parents may have particular difficulty achieving adequate and consistent performance of the routine management tasks that promote the child’s health and wellbeing. Despite frequent reports of behaviour problems in children with AD, past research has neglected the importance of child behaviour to parenting confidence and competence with treatment. Parents of children with AD are also at risk of experiencing depression, anxiety, parenting stress, and parenting difficulties. Although these factors have been associated with difficulty in managing other childhood chronic health conditions, the nature of these relationships in the context of child AD management has not been reported. This study therefore examined relationships between child, parent, and family variables, and parents’ management of child AD and difficult child behaviour, using social cognitive and self-efficacy theory as a guiding framework. The study was conducted in three phases. It employed a quantitative, cross-sectional study design, accessing a community sample of 120 parents of children with AD, and a sample of 64 child-parent dyads recruited from a metropolitan paediatric tertiary referral centre. In Phase One, instruments designed to measure parents’ self-reported performance of AD management tasks (Parents’ Eczema Management Scale – PEMS) and parents’ outcome expectations of task performance (Parents’ Outcome Expectations of Eczema Management Scale – POEEMS) were adapted from the Parental Self-Efficacy with Eczema Care Index (PASECI). In Phase Two, these instruments were used to examine relationships between child, parent, and family variables, and parents’ self-efficacy, outcome expectations, and self-reported performance of AD management tasks. Relationships between child, parent, and family variables, parents’ self-efficacy for managing problem behaviours, and reported parenting practices, were also examined. This latter focus was explored further in Phase Three, in which relationships between observed child and parent behaviour, and parent-reported self-efficacy for managing both child AD and problem behaviours, were explored. Phase One demonstrated the reliability of both PEMS and POEEMS, and confirmed that PASECI was reliable and valid with modification as detailed. Factor analyses revealed two-factor structures for PEMS and PASECI alike, with both scales containing factors related to performing routine management tasks, and managing the child’s symptoms and behaviour. Factor analysis was also applied to POEEMS resulting in a three-factor structure. Factors relating to independent management of AD by the parent, involving healthcare professionals in management, and involving the child in management of AD were found. Parents’ self-efficacy and outcome expectations had a significant influence on self-reported task performance. In Phase Two, relationships emerged between parents’ self-efficacy and self-reported performance of AD management tasks, and AD severity, child behaviour difficulties, parent depression and stress, conflict over parenting issues, and parents’ relationship satisfaction. Using multiple linear regressions, significant proportions of variation in parents’ self-efficacy and self-reported performance of AD management tasks were explained by child behaviour difficulties and parents’ formal education, and self-efficacy emerged as a likely mediator for the relationships between both child behaviour and parents’ education, and performance of AD management tasks. Relationships were also found between parents’ self-efficacy for managing difficult child behaviour and use of dysfunctional parenting strategies, and child behaviour difficulties, parents’ depression and stress, conflict over parenting issues, and relationship satisfaction. While significant proportions of variation in self-efficacy for managing child behaviour were explained by both child behaviour and family income, family income was the only variable to explain a significant proportion of variation in parent-reported use of dysfunctional parenting strategies. Greater use of dysfunctional parenting strategies (both lax and authoritarian parenting) was associated with more severe AD. Parents reporting lower self-efficacy for managing AD also reported lower self-efficacy for managing difficult child behaviour; likewise, less successful self-reported performance of AD management tasks was associated with greater use of dysfunctional parenting strategies. When child and parent behaviour was directly observed in Phase Three, more aversive child behaviour was associated with lower self-efficacy, less positive outcome expectations, and poorer self-reported performance of AD management tasks by parents. Importantly, there were strong positive relationships between these variables (self-efficacy, outcome expectations, and self-reported task performance) and parents’ observed competence when providing treatment to their child. Less competent performance was also associated with greater parent-reported child behaviour difficulties, parent depression and stress, parenting conflict, and relationship dissatisfaction. Overall, this study revealed the importance of child behaviour to parents’ confidence and practices in the contexts of child AD and child behaviour management. Parents of children with concurrent AD and behavioural problems are at particular risk of having low self-efficacy for managing their child’s AD and difficult behaviour. Children with more severe AD are also at higher risk of behaviour problems, and thus represent a high-risk group of children whose parents may struggle to manage the disease successfully. As one of the first studies to examine the role and correlates of parents’ self-efficacy in child AD management, this study identified a number of potentially modifiable factors that can be targeted to enhance parents’ self-efficacy, and improve parent management of child AD. In particular, interventions should focus on child behaviour and parenting issues to support parents caring for children with AD and improve child health outcomes. In future, findings from this research will assist healthcare teams to identify parents most in need of support and intervention, and inform the development and testing of targeted multidisciplinary strategies to support parents caring for children with AD.

Understanding the very nature of Project Management : a praxiological approach

Foreword: In this paper I call upon a praxiological approach. Praxeology (early alteration of praxiology) is the study of human action and conduct. The name praxeology/praxiologyakes is root in praxis, Medieval Latin, from Greek, doing, action, from prassein to do, practice (Merriam-Webster Dictionary). Having been involved in project management education, research and practice for the last twenty years, I have constantly tried to improve and to provide a better understanding/knowledge of the field and related practice, and as a consequence widen and deepen the competencies of the people I was working with (and my own competencies as well!), assuming that better project management lead to more efficient and effective use of resources, development of people and at the end to a better world. For some time I have perceived a need to clarify the foundations of the discipline of project management, or at least elucidate what these foundations could be. An immodest task, one might say! But not a neutral one! I am constantly surprised by the way the world (i.e., organizations, universities, students and professional bodies) sees project management: as a set of methods, techniques, tools, interacting with others fields – general management, engineering, construction, information systems, etc. – bringing some effective ways of dealing with various sets of problems – from launching a new satellite to product development through to organizational change.

Leveraging innovation for sustainable construction, proceedings of the CIB Task Group 58: Clients and Construction Innovation Workshop

This publication consists of a volume of papers presented at the workshop of the CIB Task Group 58: Clients and Construction Innovation, held on May 18- 19, 2009 at the University of Alberta in Edmonton, Canada. The workshop theme, “Leveraging Innovation for Sustainable Construction”, reflects a growing concern among clients for perspectives, approaches, and tools that will secure the practice of construction economically, socially, and environmentally. This collection encompasses some of the most incisive assessments of the challenges facing the construction industry today from a range of researchers and industry practitioners who are leading the way for tomorrow’s innovations. It provides a useful documentation of the ongoing conversation regarding innovation and sustainability issues and a foundation of knowledge for future research and development. The papers contained in this volume explore the workshop’s overarching theme of how to leverage innovation to increase the sustainability of the construction process and product. Participants sought to generate discussion on the topics of innovation and sustainability within the construction field, to share international examples of innovation from the research community and from industry, and to establish a point of reference for ongoing enquiry. In particular, our contributors have noted the value of learning through practice in order to orient research based on real-world industry experience. Chapters two and three present complementary models of sustainable research programs through the three parts collaboration of government, industry, and academia. Chapters four and five explore new tools and forms of technological innovation as they are deployed to improve construction project management and set the direction for advances in research. Chapters six, seven, and eight closely study practical examples of innovation in large-scale construction projects, showing with concrete results the impact of applying creative methods and best practices to the field. Innovation and sustainability in construction are truly global efforts; these papers illustrate how we can draw on international examples and cooperative organizations to address these important issues for long-term benefit of the industry.

Relationship between the nature of the search task types and query reformulation behaviour

Success of query reformulation and relevant information retrieval depends on many factors, such as users’ prior knowledge, age, gender, and cognitive styles. One of the important factors that affect a user’s query reformulation behaviour is that of the nature of the search tasks. Limited studies have examined the impact of the search task types on query reformulation behaviour while performing Web searches. This paper examines how the nature of the search tasks affects users’ query reformulation behaviour during information searching. The paper reports empirical results from a user study in which 50 participants performed a set of three Web search tasks – exploratory, factorial and abstract. Users’ interactions with search engines were logged by using a monitoring program. 872 unique search queries were classified into five query types – New, Add, Remove, Replace and Repeat. Users submitted fewer queries for the factual task, which accounted for 26%. They completed a higher number of queries (40% of the total queries) while carrying out the exploratory task. A one-way MANOVA test indicated a significant effect of search task types on users’ query reformulation behaviour. In particular, the search task types influenced the manner in which users reformulated the New and Repeat queries.

Is simulation training effective in increasing podiatrists' confidence in foot ulcer management?

Background: Foot ulcers are a frequent reason for diabetes-related hospitalisation. Clinical training is known to have a beneficial impact on foot ulcer outcomes. Clinical training using simulation techniques has rarely been used in the management of diabetes-related foot complications or chronic wounds. Simulation can be defined as a device or environment that attempts to replicate the real world. The few non-web-based foot-related simulation courses have focused solely on training for a single skill or “part task” (for example, practicing ingrown toenail procedures on models). This pilot study aimed to primarily investigate the effect of a training program using multiple methods of simulation on participants’ clinical confidence in the management of foot ulcers. Methods: Sixteen podiatrists participated in a two-day Foot Ulcer Simulation Training (FUST) course. The course included pre-requisite web-based learning modules, practicing individual foot ulcer management part tasks (for example, debriding a model foot ulcer), and participating in replicated clinical consultation scenarios (for example, treating a standardised patient (actor) with a model foot ulcer). The primary outcome measure of the course was participants’ pre- and post completion of confidence surveys, using a five-point Likert scale (1 = Unacceptable-5 = Proficient). Participants’ knowledge, satisfaction and their perception of the relevance and fidelity (realism) of a range of course elements were also investigated. Parametric statistics were used to analyse the data. Pearson’s r was used for correlation, ANOVA for testing the differences between groups, and a paired-sample t-test to determine the significance between pre- and post-workshop scores. A minimum significance level of p < 0.05 was used. Results: An overall 42% improvement in clinical confidence was observed following completion of FUST (mean scores 3.10 compared to 4.40, p < 0.05). The lack of an overall significant change in knowledge scores reflected the participant populations’ high baseline knowledge and pre-requisite completion of web-based modules. Satisfaction, relevance and fidelity of all course elements were rated highly. Conclusions: This pilot study suggests simulation training programs can improve participants’ clinical confidence in the management of foot ulcers. The approach has the potential to enhance clinical training in diabetes-related foot complications and chronic wounds in general.

Using information communication technologies to develop dynamic curriculum frameworks for diverse cohorts: a case study from event management

This article investigates the role of information communication technologies (ICTs) in establishing a well-aligned, authentic learning environment for a diverse cohort of non-cognate and cognate students studying event management in a higher education context. Based on a case study which examined the way ICTs assisted in accommodating diverse learning needs, styles and stages in an event management subject offered in the Creative Industries Faculty at Queensland University of Technology in Brisbane, Australia, the article uses an action research approach to generate grounded, empirical data on the effectiveness of the dynamic, individualised curriculum frameworks that the use of ICTs makes possible. The study provides insights into the way non-cognate and cognate students respond to different learning tools. It finds that whilst non-cognate and cognate students do respond to learning tools differently, due to a differing degree of emphasis on technical, task or theoretical competencies, the use of ICTs allows all students to improve their performance by providing multiple points of entry into the content. In this respect, whilst the article focuses on the way ICTs can be used to develop an authentic, well-aligned curriculum model that meets the needs of event management students in a higher education context, with findings relevant for event educators in Business, Hospitality, Tourism and Creative Industries, the strategies outlined may also be useful for educators in other fields who are faced with similar challenges when designing and developing curriculum for diverse cohorts.

A methodological evaluation of business process compliance management frameworks

Existing compliance management frameworks (CMFs) offer a multitude of compliance management capabilities that makes difficult for enterprises to decide on the suitability of a framework. Making a decision on the suitability requires a deep understanding of the functionalities of a framework. Gaining such an understanding is a difficult task which, in turn, requires specialised tools and methodologies for evaluation. Current compliance research lacks such tools and methodologies for evaluating CMFs. This paper reports a methodological evaluation of existing CMFs based on a pre-defined evaluation criteria. Our evaluation highlights what existing CMFs offer, and what they cannot. Also, it underpins various open questions and discusses the challenges in this direction.

Integrating agency and resource dependence theory : firm profitability, industry regulation, and board task performance

Boards of directors are key governancemechanisms in organizations and fulfill twomain tasks:monitoringmanagers and firm performance, and providing advice and access to resources. In spite of a wealth of researchmuch remains unknown about how boards attend to the two tasks. This study investigates whether organizational (firm profitability) and environmental factors (industry regulation) affect board task performance. The data combine CEOs' responses to a questionnaire, and archival data from a sample of large Italian firms. Findings show that past firm performance is negatively associatedwith board monitoring and advice tasks; greater industry regulation enhances perceived board task performance; board monitoring and advice tasks tend to reinforce each other, despite their theoretical and practical distinction.

Analyzing and defining information requirements of knowledge intensive construction management tasks on BIM

With the increasing popularity and adoption of building information modeling (BIM), the amount of digital information available about a building is overwhelming. Enormous challenges remain however in identifying meaningful and required information from a complex BIM model to support a particular construction management (CM) task. Detailed specifications of information required by different construction domains and expressive and easy-to-use BIM reasoning mechanisms are seen as an important means in addressing these challenges. This paper analyzes some of the characteristics and requirements of component-specific construction knowledge in relation to the current work practice and BIM-based applications. It is argued that domain ontologies and information extraction approaches, such as queries could significantly bring much needed support for knowledge sharing and integration of information between design, construction and facility management.

Composite SaaS resource management in cloud computing using evolutionary computation

Cloud computing is an emerging computing paradigm in which IT resources are provided over the Internet as a service to users. One such service offered through the Cloud is Software as a Service or SaaS. SaaS can be delivered in a composite form, consisting of a set of application and data components that work together to deliver higher-level functional software. SaaS is receiving substantial attention today from both software providers and users. It is also predicted to has positive future markets by analyst firms. This raises new challenges for SaaS providers managing SaaS, especially in large-scale data centres like Cloud. One of the challenges is providing management of Cloud resources for SaaS which guarantees maintaining SaaS performance while optimising resources use. Extensive research on the resource optimisation of Cloud service has not yet addressed the challenges of managing resources for composite SaaS. This research addresses this gap by focusing on three new problems of composite SaaS: placement, clustering and scalability. The overall aim is to develop efficient and scalable mechanisms that facilitate the delivery of high performance composite SaaS for users while optimising the resources used. All three problems are characterised as highly constrained, large-scaled and complex combinatorial optimisation problems. Therefore, evolutionary algorithms are adopted as the main technique in solving these problems. The first research problem refers to how a composite SaaS is placed onto Cloud servers to optimise its performance while satisfying the SaaS resource and response time constraints. Existing research on this problem often ignores the dependencies between components and considers placement of a homogenous type of component only. A precise problem formulation of composite SaaS placement problem is presented. A classical genetic algorithm and two versions of cooperative co-evolutionary algorithms are designed to now manage the placement of heterogeneous types of SaaS components together with their dependencies, requirements and constraints. Experimental results demonstrate the efficiency and scalability of these new algorithms. In the second problem, SaaS components are assumed to be already running on Cloud virtual machines (VMs). However, due to the environment of a Cloud, the current placement may need to be modified. Existing techniques focused mostly at the infrastructure level instead of the application level. This research addressed the problem at the application level by clustering suitable components to VMs to optimise the resource used and to maintain the SaaS performance. Two versions of grouping genetic algorithms (GGAs) are designed to cater for the structural group of a composite SaaS. The first GGA used a repair-based method while the second used a penalty-based method to handle the problem constraints. The experimental results confirmed that the GGAs always produced a better reconfiguration placement plan compared with a common heuristic for clustering problems. The third research problem deals with the replication or deletion of SaaS instances in coping with the SaaS workload. To determine a scaling plan that can minimise the resource used and maintain the SaaS performance is a critical task. Additionally, the problem consists of constraints and interdependency between components, making solutions even more difficult to find. A hybrid genetic algorithm (HGA) was developed to solve this problem by exploring the problem search space through its genetic operators and fitness function to determine the SaaS scaling plan. The HGA also uses the problem's domain knowledge to ensure that the solutions meet the problem's constraints and achieve its objectives. The experimental results demonstrated that the HGA constantly outperform a heuristic algorithm by achieving a low-cost scaling and placement plan. This research has identified three significant new problems for composite SaaS in Cloud. Various types of evolutionary algorithms have also been developed in addressing the problems where these contribute to the evolutionary computation field. The algorithms provide solutions for efficient resource management of composite SaaS in Cloud that resulted to a low total cost of ownership for users while guaranteeing the SaaS performance.

Star performers : task and contextual performance are components, but are they enough?

Identifying outstanding performers or ‘stars’ is a critical component of managing talent. However, organizational effectiveness in this area is limited by the current lack of guidance about the behaviour and characteristics of stars. We address this gap by combining a conceptual analysis with an empirical study involving 174 managers. Conceptually we examine the alignment of managers’ perceptions of outstanding performance with the well established task and contextual performance model and find this framework accounts for a core element in managers’ judgments about outstanding performers. However, a second, more qualitative approach finds that other dimensions including being self-directed, and a willingness to lead are also important. Our findings are consistent with a long-term trend toward identifying work effectiveness with highly discretionary, psychological and behavioural elements, and we consider the implications of this for the study and management of high level, individual effectiveness.

Emergency powers and pandemics : federalism and the management of public health emergencies in Australia

Under the International Health Regulations 2005 Australia is obliged to develop a domestic framework designed to equip it to respond to public health emergencies. The legislative arrangements for the declaration of a public health emergency in Australia are complex, vary across state jurisdictions and intersect with other emergency powers. The task of harmonising laws and other arrangements within a federal system poses both challenges and opportunities for flexibility and choice. This article argues that Australia's current multi-strand and multi-level response provides a coordinated framework which also accommodates desirable levels of flexibility and choice.