E-Science in the classroom – Towards viability

E-Science has the potential to transform school science by enabling learners, teachers and research scientists to engage together in authentic scientific enquiry, collaboration and learning. However, if we are to reap the benefits of this potential as part of everyday teaching and learning, we need to explicitly think about and support the work required to set up and run e-Science experiences within any particular educational context. In this paper, we present a framework for identifying and describing the resources, tools and services necessary to move e-Science into the classroom together with examples of these. This framework is derived from previous experiences conducting educational e-Science projects and systematic analysis of the categories of ‘hidden work’ needed to run these projects. The articulation of resources, tools and services based on these categories provides a starting point for more methodical design and deployment of future educational e-Science projects, reflection on which can also help further develop the framework. It also points to the technological infrastructure from which such tools and services could be built. As such it provides an agenda of work to develop both processes and technologies that would make it practical for teachers to deliver active, and collaborative e-Science learning experiences on a larger scale within and across schools. Routine school e-Science will only be possible if such support is specified, implemented and made available to teachers within their work contexts in an appropriate and usable form.     

e-Science, caGrid, and Translational Biomedical Research

Translational research projects target a wide variety of diseases, test many different kinds of biomedical hypotheses, and employ a large assortment of experimental methodologies. Diverse data, complex execution environments, and demanding security and reliability requirements make the implementation of these projects extremely challenging and require novel e-Science technologies.     

Designing with Care: The Future of Pervasive Healthcare

Humane care—which is an important design paradigm relevant for pervasive healthcare—means designing systems with care, keeping in mind both users and other stakeholders. Understanding human values is a key factor in creating any successful healthcare application and is essential to avoid dehumanizing and stigmatizing users. By considering human values, designers and developers can create pervasive healthcare applications that better fit users' needs and desires. The Designing with Care 09 workshop aimed to bring together researchers, designers, and practitioners to share their experiences with incorporating values into the design of pervasive healthcare systems and to help understand the sensitive issues involved in designing for healthcare. Based on the findings from the workshop, the present state of the art is discussed, and a research agenda is presented.     

Finding and resolving security misusability with misusability cases

Although widely used for both security and usability concerns, scenarios used in security design may not necessarily inform the design of usability, and vice-versa. One way of using scenarios to bridge security and usability involves explicitly describing how design decisions can lead to users inadvertently exploiting vulnerabilities to carry out their production tasks. This paper describes how misusability cases, scenarios that describe how design decisions may lead to usability problems subsequently leading to system misuse, address this problem. We describe the related work upon which misusability cases are based before presenting the approach, and illustrating its application using a case study example. Finally, we describe some findings from this approach that further inform the design of usable and secure systems.     

Cybercrime: Understanding and addressing the concerns of stakeholders

Cybercrime and cybercriminal activities continue to impact communities as the steady growth of electronic information systems enables more online business. The collective views of sixty-six computer users and organizations, that have an exposure to cybercrime, were analyzed using concept analysis and mapping techniques in order to identify the major issues and areas of concern, and provide useful advice. The findings of the study show that a range of computing stakeholders have genuine concerns about the frequency of information security breaches and malware incursions (including the emergence of dangerous security and detection avoiding malware), the need for e-security awareness and education, the roles played by law and law enforcement, and the installation of current security software and systems. While not necessarily criminal in nature, some stakeholders also expressed deep concerns over the use of computers for cyberbullying, particularly where younger and school aged users are involved. The government’s future directions and recommendations for the technical and administrative management of cybercriminal activity were generally observed to be consistent with stakeholder concerns, with some users also taking practical steps to reduce cybercrime risks.     

Empirical evaluation of a cloud computing information security governance framework

ContextCloud computing is a thriving paradigm that supports an efficient way to provide IT services by introducing on-demand services and flexible computing resources. However, significant adoption of cloud services is being hindered by security issues that are inherent to this new paradigm. In previous work, we have proposed ISGcloud, a security governance framework to tackle cloud security matters in a comprehensive manner whilst being aligned with an enterprise’s strategy.ObjectiveAlthough a significant body of literature has started to build up related to security aspects of cloud computing, the literature fails to report on evidence and real applications of security governance frameworks designed for cloud computing environments. This paper introduces a detailed application of ISGCloud into a real life case study of a Spanish public organisation, which utilises a cloud storage service in a critical security deployment.MethodThe empirical evaluation has followed a formal process, which includes the definition of research questions previously to the framework’s application. We describe ISGcloud process and attempt to answer these questions gathering results through direct observation and from interviews with related personnel.ResultsThe novelty of the paper is twofold: on the one hand, it presents one of the first applications, in the literature, of a cloud security governance framework to a real-life case study along with an empirical evaluation of the framework that proves its validity; on the other hand, it demonstrates the usefulness of the framework and its impact to the organisation.ConclusionAs discussed on the paper, the application of ISGCloud has resulted in the organisation in question achieving its security governance objectives, minimising the security risks of its storage service and increasing security awareness among its users.     

Accessible privacy and security: a universally usable human-interaction proof tool

Despite growing interest in designing usable systems for managing privacy and security, recent efforts have generally failed to address the needs of users with disabilities. As security and privacy tools often rely upon subtle visual cues or other potentially inaccessible indicators, users with perceptual limitations might find such tools particularly challenging. To understand the needs of an important group of users with disabilities, a focus group was conducted with blind users to determine their perceptions of security-related challenges. Human-interaction proof (HIP) tools, commonly known as CAPTCHAs, are used by web pages to defeat robots and were identified in the focus group as a major concern. Therefore, a usability test was conducted to see how well blind users were able to use audio equivalents of these graphical tools. Finally, an accessible HIP tool was developed which combines audio and matching images, supporting both visual and audio output. Encouraging results from a small usability evaluation of the prototype with five sighted users and five blind users show that this new form of HIP is preferred by both blind and visual users to previous forms of text-based HIPs. Future directions for research are also discussed.     

Oracle数据库应用中安全问题研究

Oracle数据库的建立是企业实现资源共享的最直接途径,其自身的安全性也成为现今企业重点考虑的要素之一。尽管数据库系统带给了人们在处理数据问题上的诸多便利,但同时也给系统带来了诸多安全隐患,为保证数据库系统管理的安全可靠、确保在应用方面的安全性,本文就Oracle数据库应用中安全问题的举措做出研究。     

On participatory design of home-based healthcare

Participatory design (PD) activities in private homes challenge how we relate to the PD process, compared to PD in professional settings. Grounded in a project related to chronic dizziness among older people, we identified four challenges when performing PD with ill, weak users in their private homes. The challenges are (1) designing for, and negotiating knowledge about, the home, (2) ill, weak users and their participation in PD, (3) divergent interests of participants and (4) usable and sustainable post-project solutions. These challenges have to be carefully addressed, and we use them to reflect upon differences between a home-based PD process with non-workers, such as ours, and work-place projects, such as Utopia. Through this reflection, the paper contributes to a more general discussion on PD in non-work settings with weak users. Indeed, differences do exist between traditional PD projects in work settings, such as Utopia, and home-based PD with weak users especially in relation to knowledge about settings and how to reconcile differences in interests. The home as a place for (technology-assisted) treatment and PD must be carefully analyzed. Diverse interests and roles as well as possibilities for post-project solutions should be negotiated among all stakeholders.     

基于驱动层的数据安全存储系统设计

就目前数据集中存储带来的风险进行分析,并提出基于驱动的数据安全存储系统设计。数据安全存储系统能够在不改变终端用户操作习惯的情况下实现文件的安全存储,该系统工作在操作系统文件驱动层和设备驱动层之间,采用透明加密的方式,在文件物理写入磁盘的过程中,嵌入一系列安全操作,保证实际存储的数据全部经过保护。     

浅析网络安全的威胁和防护

在21世纪,随着信息技术的快速发展和计算机网络的广泛应用,资源共享和网络安全的矛盾不断加大,网络安全问题已经成为世界热门课题之一。网络安全的重要性更加突出,不仅关系到企事业的顺利发展及用户资产、信息资源的安全,甚至也关系到国家安全和社会稳定,不仅成为各个国家和各个领域关注的焦点,也成为热门研究和人才需求的新领域。     

Assessing the Usability of a Science Gateway for Medical Knowledge Bases with TRENCADIS

Biomedical applications are often built on top of knowledge bases that contain medical images and clinical reports. Currently, these bases are being used to improve diagnosis, research and teaching, but in many cases, the infrastructure required has a prohibitive cost for many medical centres. However, resources can be attached from existing e-Science infrastructures. Therefore, many efforts have been made to establish best practices that allow the use of such infrastructures. However, e-Science relies on open, distributed, collaborative environments, built on top of very specialized technologies, such as Grid and Cloud computing, which require reasonable technical skills for their usage. Therefore, science gateways have become essential tools that assist users in interacting with e-Science applications. This paper describes TRENCADIS, a technology that supports the creation and operation of virtual knowledge bases. To this end, it provides developers with components and APIs for building secure data services that can be annotated and queried through ontology templates, based on DICOM and DICOM-SR. This technology was used in this paper to build a gateway for assisting diagnosis and research in breast cancer. We also present here the results of a study conducted to evaluate the gateway, from the point of view of the usability perceived by a group of physicians and radiologists.     

Detecting Vulnerability on IoT Device Firmware: A Survey

Internet of things (IoT) devices make up 30% of all network-connected endpoints, introducing vulnerabilities and novel attacks that make many companies as primary targets for cybercriminals. To address this increasing threat surface, every organization deploying IoT devices needs to consider security risks to ensure those devices are secure and trusted. Among all the solutions for security risks, firmware security analysis is essential to fix software bugs, patch vulnerabilities, or add new security features to protect users of those vulnerable devices. However, firmware security analysis has never been an easy job due to the diversity of the execution environment and the close source of firmware. These two distinct features complicate the operations to unpack firmware samples for detailed analysis. They also make it difficult to create visual environments to emulate the running of device firmware. Although researchers have developed many novel methods to overcome various challenges in the past decade, critical barriers impede firmware security analysis in practice. Therefore, this survey is motivated to systematically review and analyze the research challenges and their solutions, considering both breadth and depth. Specifically, based on the analysis perspectives, various methods that perform security analysis on IoT devices are introduced and classified into four categories. The challenges in each category are discussed in detail, and potential solutions are proposed subsequently. We then discuss the flaws of these solutions and provide future directions for this research field. This survey can be utilized by a broad range of readers, including software developers, cyber security researchers, and software security engineers, to better understand firmware security analysis.      

A secure re‐encryption scheme for data services in a cloud computing environment

Cloud computing as a promising technology and paradigm can provide various data services, such as data sharing and distribution, which allows users to derive benefits without the need for deep knowledge about them. However, the popular cloud data services also bring forth many new data security and privacy challenges. Cloud service provider untrusted, outsourced data security, hence collusion attacks from cloud service providers and data users become extremely challenging issues. To resolve these issues, we design the basic parts of secure re‐encryption scheme for data services in a cloud computing environment, and further propose an efficient and secure re‐encryption algorithm based on the EIGamal algorithm, to satisfy basic security requirements. The proposed scheme not only makes full use of the powerful processing ability of cloud computing but also can effectively ensure cloud data security. Extensive analysis shows that our proposed scheme is highly efficient and provably secure under existing security model. Copyright © 2015 John Wiley & Sons, Ltd.     

Secure D-CAS system for digital contents downloading services

The digital contents market is growing rapidly and we can retrieve digital contents through various multimedia devices including portable hand-held devices, smart phones, and home devices. On the other side, many digital contents without the consent of copyright holders are shared on the Internet. Those copyright infringement problems undermine authoring needs of the digital contents manufacturers and also wither the development of digital contents market. We are sure that we need secure distribution mechanisms for the digital contents supply chain in order to revitalize contents services and markets more and more. Many research projects to limit contents utilization onto legitimate users and to provide secure contents protection and download are in progress. In this paper, we propose a secure D-CAS system (SDCAS) which provides security enhancement to various digital contents downloading services.     

The kernel craze [computer security]

The kernel is a fundamental piece of the operating system that provides and mediates access to a computer system's resources. Naturally, such a critical component plays a key role in providing users with a secure environment and should be subject to security practitioners' scrutiny. The author focuses on kernel security issues, recent vulnerabilities, and the emergence of publicly available exploit code for them.     

A lightweight framework for secure life-logging in smart environments

As the world becomes an interconnected network where objects and humans interact with each other, new challenges and threats appear in the ecosystem. In this interconnected world, smart objects have an important role in giving users the chance for life-logging in smart environments. However, smart devices have several limitations with regards to memory, resources and computation power, hindering the opportunity to apply well-established security algorithms and techniques for secure life-logging on the Internet of Things (IoT) domain. The need for secure and trustworthy life-logging in smart environments is vital, thus, a lightweight approach has to be considered to overcome the constraints of Smart Objects. The purpose of this paper is to present in details the current topics of life-logging in smart environments, while describing interconnection issues, security threats and suggesting a lightweight framework for ensuring security, privacy and trustworthy life-logging. In order to investigate the efficiency of the lightweight framework and the impact of the security attacks on energy consumption, an experimental test-bed was developed including two interconnected users and one smart attacker, who attempts to intercept transmitted messages or interfere with the communication link. Several mitigation factors, such as power control, channel assignment and AES-128 encryption were applied for secure life-logging. Finally, research into the degradation of the consumed energy regarding the described intrusions is presented.     

Designing for human use: Examples of kitchen interiors for persons with disability and elderly people

Around 15% of the global population has a moderate or severe disability. For this reason, a design where the needs of elderly and disabled population are included, should become more common practise and should not be limited only to medical and rehabilitation products. In this study, the inclusive design practices related to the kitchens were applied. All the important stages in a design process, such as market research, planning, concept designing, detailed designing, research (ergonomic assessment), and production preparation were completed. In market research we market research examined the preferences of 216 respondents. Sixty percent of them were either elderly and/or disabled persons (direct users), 40% were caretakers, physiotherapists, and managers of care centres (indirect users). Implementation of obtained results is three kitchen lines with assistive technology solutions, which are the response to the requirements identified as appropriate in meeting the needs of the elderly and disabled kitchen users. The main conclusion of the article is the statement that the needs of seniors can and should be efficiently included in a design process of home interiors. It can be recognised as an important “social” designing criterion which can constitute a good basis for going beyond the traditional design and going toward the sustainable design.     

Putting the user in user-interface testing

Discusses one of the most basic topics in user-interface design: how to run a user test. No matter how good we are at designing a user interface, we must always test it with real users to see whether it is as usable as we hope. The three main rules of user testing are: get real users, have them do real tasks, and shut up while they are trying. Tools, techniques and concepts to optimize user interfaces are described, and ethical issues are discussed     

Guest Editors' Introduction: Secure or Usable?

There's an old joke that computers are actually easy machines to secure: just turn them off, lock them in a metal-lined room, and throw away the key. What you end up with is a machine that is very secure--just not very usable.As the joke's continuing popularity demonstrates, many people believe that there is an inherent trade-off between security and usability. A computer without passwords is usable, but not very secure. On the other hand, a computer that requires you to authenticate every 5 minutes with your password and a fresh drop of blood might indeed be very secure, but nobody would want to use it.