The Shadow Knows: Refinement and security in sequential programs

Stepwise refinement is a crucial conceptual tool for system development, encouraging program construction via a number of separate correctness-preserving stages which ideally can be understood in isolation. A crucial conceptual component of security is an adversary’s ignorance of concealed information. We suggest a novel method of combining these two ideas.Our suggestion is based on a mathematical definition of “ignorance-preserving” refinement that extends classical refinement by limiting an adversary’s access to concealed information: moving from specification to implementation should never increase that access. The novelty is the way we achieve this in the context of sequential programs.Specifically we give an operational model (and detailed justification for it), a basic sequential programming language and its operational semantics in that model, a “logic of ignorance” interpreted over the same model, then a program-logical semantics bringing those together — and finally we use the logic to establish, via refinement, the correctness of a real (though small) protocol: Rivest’s Oblivious Transfer. A previous report^? treated Chaum’s Dining Cryptographers similarly.In passing we solve the Refinement Paradox for sequential programs.     

Object-oriented change detection for the city of Harare,Zimbabwe

Object building and the extraction of homogeneous landscape units on which spatial statistics can be applied is useful in assessing land use and land cover change. Object-oriented processing techniques are becoming more popular compared to traditional pixel-based image analysis. A hierarchical image segmentation approach was adopted to extract the objects from multi-temporal Landsat images over Zimbabwe. The spatial arrangement of t₀ and t₁ objects was independent as the segmentation process was independently applied, although object change of t₁ was based on t₀ boundaries. We applied a Standardized, Object Oriented, Automatic Classification (SOOAC) method based on fuzzy logic. The error matrix for the TM image had an overall accuracy of 95.6% and a KIA value of 94.7%, the ETM showed slightly lower overall accuracy. Various LULC changes were identified over the 13 year period per object and also per class, mainly vegetation decrease. Object-oriented change information is necessary in decision support systems and uncertainty management strategies. This approach addresses some of the major issues in object-based GIS change analysis as it is based on stable object geometry.     

一种基于复数域网络编码的双层卫星通信系统

针对卫星通信网络吞吐量不足、可靠性不高的问题,提出一种基于复数域网络编码(Complex Field Network Coding,CFNC)的卫星通信方案。该方案在信号发送前对源信息作预编码处理,即在复数域上选取一个大小合适的参数化空时码与源信号相乘,编码后的信号与源信号在复数域上有着一一映射关系。对该方案的吞吐量和成对差错概率(Pairwise Error Probability,PEP)做了详尽的理论分析,结果表明,采用该编码方案的卫星通信系统在终端发射功率不变的情况下,吞吐量比路由模式提高了100%以上,比传统的CFNC方式至少可提高75%。该方案还可以扩展至更多的地面源节点,从而支持多用户网络通信。最后,仿真实验表明,在较高的信噪比下,PEP仿真值逼近于渐近值,验证了理论分析的正确性。     

S-phase fractions of breast carcinomas. Relationships to morphology, estrogen and progesterone receptors, and early recurrence

Analysis of the S-phase fractions (SPF) measured by in vitro thymidine labeling, morphological appearances, and estrogen receptor (ER) assays of primary invasive breast carcinomas demonstrated several interrelationships. Lobular, mucinous, tubular, and adenocystic carcinomas consistently had low SPF and were usually positive for ER. The same was true for the carcinomas of no special histologic type [the not otherwise specified (NOS) group of E. R. Fisher including "infiltrating ductal" and undifferentiated carcinomas] with minimal anaplasia. Medullary, atypical medullary, and morphologically unclassifiable carcinomas with marked nuclear anaplasia nearly always had high SPF and were usually negative for ER. High SPF was associated with advanced stages of carcinoma initially or with early recurrence following mastectomy.     

Dufour Gland Contents of Ants of the Cataglyphis bicolor Group

The species of desert-dwelling ants of the Cataglyphis bicolor (Hymenoptera: Formicidae) group are difficult to distinguish by morphological features. Analysis of the secretion from the Dufour glands of workers of a number of colonies was undertaken to see if it provided a clear test of species. Linked 6c-ms showed in all samples straight and branched-chain alkanes, linear alkenes, ketones, aldehydes, acetates, and a group of C₂₂ to C₂₈ esters not previously identified in this genus. Contents of the Dufour glands of C. savignyi from Tunisia and Egypt were similar, and comprised straight and branched-chain alkanes, alkenes and small amounts of esters. C. bicolor from Tunisia contained compounds similar to C. savignyi but was distinguished from the latter by larger amounts of the esters. The major compound in the glands of C. viaticus was tridecane, in contrast to the pentadecane of other species. It also contained a branched alkane, 3-methyltridecane as a major component. Branched-chain esters and a wide variety of acetates were also found in this species. C. diehlii had a limited range of compounds, with branched alkanes almost completely absent and high proportions of pentadecene and dodecyl acetate. C. bombycinus, a sympatric species, but recognized as not belonging to the bicolor group by its different mandibular gland substances, was notable in having butanoate esters in its Dufour glands. Despite these differences among species, both the great variability of individuals from a single colony and the among between conspecific colonies make species diagnosis from a few individuals difficult, in contrast with postpharyngeal glands, which, as recently reported, give a clearer indication of species.     

Compositional noninterference from first principles

The recently formulated Shadow Semantics for noninterference-style security of sequential programs avoids the Refinement Paradox by preserving demonic nondeterminism in those cases where reducing it would compromise security. The construction (originally) of the semantic domain for The Shadow, and the interpretation of programs in it, relied heavily on intuition, guesswork and the advice of others. That being so, it is natural after the fact to try to reconstruct an idealised “inevitable” path from first principles to where we actually ended up: not only does one learn (more) about semantic principles by doing so, but the “rational reconstruction” helps to expose the choices made, along the way, and to legitimise the decisions that resolved them. Unlike our other papers on noninterference, this one does not contain a significant case study: instead its aim is to provide the most accessible account we can of the methods we use and why our model, in its details, has turned out the way it has. In passing, it might give some insight into the general role and significance of compositionality and testing-with-context for program semantics. Finally, a technical contribution here is a new “Transfer Principle” that captures uniformly a large class of classical refinements that remain valid when noninterference is taken into account in our style.     

Gram-negative anaerobic bacilli: Their role in infection and patterns of susceptibility to antimicrobial agents. II. Little-known Fusobacterium species and miscellaneous genera

Twenty infrequently reported species of gram-negative anaerobic bacilli other than Fusobacterium nucleatum, Fusobacterium necrophorum, and members of the genus Bacteroides were studied with regard to their role in infection and their susceptibility to antimicrobial agents. In addition, the literature regarding the recovery of these organisms from both the normal flora and infections of humans was reviewed. During a six-year period at the Wadsworth Clinical Anaerobic Bacteriology Research Laboratory (Veterans Administration Wadsworth Medical Center, Los Angeles, Calif.), 39 (6%) of 679 specimens obtained from anaerobic infections yielded "other gram-negative anaerobic bacilli" (OGNAB). Fusobacterium naviforme, Fusobacterium gonidiaformans, Fusobacterium varium, Fusobacterium mortiferum, and Fusobacterium russii were the most commonly isolated OGNAB. Most of the OGNAB tested were resistant to erythromycin, and most strains, except for F. varium, were susceptible to beta-lactam antibiotics and clindamycin. Chloramphenicol and metronidazole were active against all strains of OGNAB tested. Certain Fusobacterium species are undoubtedly previously unrecognized members of the normal flora of the oropharynx, upper respiratory tract, or urogenital tract and may be present in infections derived from these floras.     

Pain and dissociation in the cold pressor test: A study of hypnotic analgesia with "hidden reports" through automatic key pressing and automatic talking.

To test whether pain blocked by hypnotic analgesia may still be perceived at some level, 20 highly hypnotizable undergraduates participated in an experiment involving cold pressor pain in the normal condition and in hypnotically suggested analgesia. 3 reports were obtained reflecting felt pain within the hypnotic analgesia condition: the usual verbal report on a numerical scale, a manual report by "automatic key pressing," and a retrospective verbal report through "automatic talking." 9 Ss who were amnesic for both keypressing and automatic talking reported more pain in the automatic (hidden) reports than in their usual verbal reports. 8 of these 9, following release of amnesia, had a clear perception of 2 levels of awareness of the pain: the usual hypnotic experience of pain attenuated by analgesia suggestions, and a knowledge at another level of a more severe pain. In no case, however, did an S give a retrospective report of normal suffering at this "hidden" level. The hypnotically analgesic S may have reported no pain verbally because he was amnesic for it; when amnesia was removed he recalled the sensory pain, but without a suffering component, because suffering apparently did not occur. (24 ref) (PsycINFO Database Record (c) 2010 APA, all rights reserved)