The Shadow Knows: Refinement and security in sequential programs

Stepwise refinement is a crucial conceptual tool for system development, encouraging program construction via a number of separate correctness-preserving stages which ideally can be understood in isolation. A crucial conceptual component of security is an adversary’s ignorance of concealed information. We suggest a novel method of combining these two ideas.Our suggestion is based on a mathematical definition of “ignorance-preserving” refinement that extends classical refinement by limiting an adversary’s access to concealed information: moving from specification to implementation should never increase that access. The novelty is the way we achieve this in the context of sequential programs.Specifically we give an operational model (and detailed justification for it), a basic sequential programming language and its operational semantics in that model, a “logic of ignorance” interpreted over the same model, then a program-logical semantics bringing those together — and finally we use the logic to establish, via refinement, the correctness of a real (though small) protocol: Rivest’s Oblivious Transfer. A previous report^? treated Chaum’s Dining Cryptographers similarly.In passing we solve the Refinement Paradox for sequential programs.     

On detecting faults for Boolean expressions

Fault based testing aims at detecting hypothesized faults based on specifications or program source. There are some fault based techniques for testing Boolean expressions which are commonly used to model conditions in specifications as well as logical decisions in program source. The MUMCUT strategy has been proposed to generate test cases from Boolean expressions. Moreover, it detects eight common types of hypothesized faults provided that the original expression is in irredundant disjunctive normal form, IDNF. Software practitioners are more likely to write the conditions and logical decisions in general form rather than IDNF. Hence, it is interesting to investigate the fault detecting capability of the MUMCUT strategy with respect to general form Boolean expressions. In this article, we perform empirical studies to investigate the fault detection capability of the MUMCUT strategy with respect to general form Boolean expressions as well as mutated expressions. A mutated expression can be obtained from the original given Boolean expression by making a syntactic change based on a particular type of fault.

基于NDIS中间层驱动程序的隐蔽通道

通过一个基于网络驱动程序接口规范中间层的驱动,在Windows网络协议栈下建立一个隐蔽通道,使应用程序可利用其直接与外界通信。该通道的作用位置相比防火墙对于协议栈的控制更为底层,可直接从网卡读写数据进行网络通信。分析防火墙由于未对网络进行完整防护而被穿透的原因,探讨抵御该类攻击的方法。     

A semantics for Behavior Trees using CSP with specification commands

In this paper we give a formal definition of the requirements translation language Behavior Trees. This language has been used with success in industry to systematically translate large, complex, and often erroneous requirements documents into a structured model of the system. It contains a mixture of state-based manipulations, synchronisation, message passing, and parallel, conditional, and iterative control structures. The formal semantics of a Behavior Tree is given via a translation to a version of Hoare’s process algebra CSP, extended with state-based constructs such as guards and updates, and a message passing facility similar to that used in publish/subscribe protocols. We first provide the extension of CSP and its operational semantics, which preserves the meaning of the original CSP operators, and then the Behavior Tree notation and its translation into the extended version of CSP.     

定理证明辅助工具PVS剖析

ＰＶ查斯坦福机构开发的强大的规约。验证系统,它的适用领域广泛,在概要介绍ＰＶＳ的构成。功能后,着重分析了ＰＶＳ的规约语言,验证系统的特点,以及使得ＰＶＳ灵活,强大的设计决策和内在机制。     

Presheaves as Configured Specifications

The paper addresses a notion of configuring systems, constructing them from specified component parts with specified sharing. This notion is independent of any underlying specification language and has been abstractly identified with the taking of colimits in category theory. Mathematically it is known that these can be expressed by presheaves and the present paper applies this idea to configuration. We interpret the category theory informally as follows. Suppose ? is a category whose objects are interpreted as specifications, and for which each morphism u : X→Y is interpreted as contravariant ‘instance reduction’, reducing instances of specification Y to instances of X. Then a presheaf P: Set ^?op represents a collection of instances that is closed under reduction. We develop an algebraic account of presheaves in which we present configurations by generators (for components) and relations (for shared reducts), and we outline a proposed configuration language based on the techniques. Oriat uses diagrams to express colimits of specifications, and we show that Oriat's category Diag(?) of finite diagrams is equivalent to the category of finitely presented presheaves over ?. Received May 1998 / Accepted in revised form August 2000     

The New Frontier Issues for Cognition Technology

Cognitive engineering has developed enormously over the last fifteen years. Yet, despite many excellent research projects and publications, its full potential has not been embraced into mainstream system design. This paper will examine the reasons for this failure and argue that the problem is not simply inertia or lack of education. There are strong organisational influences that cause resistance to this particular approach. The discipline itself has characteristics that make it fragile in the modern corporate structure. In addition, the cognitive engineers themselves are not blameless in the equation. They appear to have done exactly what they criticise the engineering community for doing: they have packaged their product in a manner that is not ‘user friendly’ to its target population, not structured to suit its application, and not output in the format required. Suggestions will be made to rectify the situation: a list of actions is proposed for practising cognitive engineers to make their product more likely to enjoy widespread uptake.     

基于OPC和Java的远程监控系统架构研究与设计

目前,OPC技术在过程控制系统中获得了广泛的应用,但OPC技术以Microsoft公司的OLE/COM技术为基础,应用基本上仍然局限在Windows系统平台,而目前企业级的上层应用系统大多采用的是J2EE体系结构,如何在J2EE体系结构下应用OPC技术这将是本文要讨论的问题。本文探讨了Java与OPC相结合的技术,并构建了一种基于OPC和Java技术的分布式远程监控系统。这种系统具有良好的开放性、可扩展性和平台无关性特点。