检索结果-内蒙古大学图书馆

ACM Workshop on Scalable Trusted Computing

作者： Kyle, David S. Brustoloni, Jose C. Univ Pittsburgh Dept Comp Sci Pittsburgh PA 15260 USA

ISBN: (纸本)9781595938886

Usage controls allow the distributor of some information to limit how recipients of that information may use it. The Trusted Computing Group has standardized Trusted Platform modules (TPMs) that are built into an increasing number of computers and could greatly harden usage controls against circumvention. However, existing operating systems support TPM's only partially. We describe UClinux, a, novel linux security module that, unlike previous work, supports TPM-based attestation, sealing, and usage controls on existing processors and with minimal modifications in the operating system kernel and applications. Experiments show that UClinux has modest impact on the system's boot latency and run-time performance.

关键词： Trusted Computing Usage Controls Trusted Platform module TPM Trusted Computing Group TCG linux UClinux linux security module LSM Encrypted File System Open Digital Rights Language ODRL

来源：评论

学校读者我要写书评

暂无评论

Analyzing the Overhead of File Protection by linux security modules 21

Analyzing the Overhead of File Protection by Linux Security ...

引用

16th ACM ASIA Conference on Computer and Communications security (ACM ASIACCS)

作者： Zhang, Wenhui Liu, Peng Jaeger, Trent Penn State Univ State Coll PA 16801 USA

ISBN: (纸本)9781450382878

Over the years, the complexity of the linux security module (LSM) is keeping increasing (e.g. 10,684 LOC in linux v2.6.0 vs. 64,018 LOC in v5.3), and the count of the authorization hooks is nearly doubled (e.g. 122 hooks in v2.6.0 vs. 224 hooks in v5.3). In addition, the computer industry has seen tremendous advancement in hardware (e.g., memory and processor frequency) in the past decade. These make the previous evaluation on LSM, which was done 18 years ago, less relevant nowadays. It is important to provide up-to-date measurement results of LSM for system practitioners so that they can make prudent trade-offs between security and performance. This work evaluates the overhead of LSM for file accesses on linux v5.3.0. We build a performance evaluation framework for LSM. It has two parts, an extension of LMBench2.5 to evaluate the overhead of file operations for different security modules, and a security module with tunable latency for policy enforcement to study the impact of the latency of policy enforcement on the end-to-end latency of file operations. In our evaluation, we find opening a file would see about 87% (linux v5.3) performance drop when the kernel is integrated with SElinux hooks (policy enforcement disabled) than without, while the figure was 27% (linux v2.4.2). We found that performance of the above downgrade is affected by two parts, policy enforcement and hook placement. To further investigate the impact of policy enforcement and hook placement respectively, we build a Policy Testing module, which reuses hook placements of LSM, while alternating latency of policy enforcement. With this module, we are able to quantitatively estimate the impact of the latency of policy enforcement on the end-to-end latency of file operations by using a multiple linear regression model and count policy authorization frequencies for each syscall. We then discuss and justify the evaluation results with static analysis on syscalls' call graphs.

关键词： linux security module Hooking Information Flow Authorization Hook Placement linux Performance Tuning

来源：评论

学校读者我要写书评

暂无评论

Efficiently Supporting Attribute-Based Access Control in linux

引用

IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING 2024年第4期21卷 2012-2026页

作者： Varshith, H. O. Sai Sural, Shamik Vaidya, Jaideep Atluri, Vijayalakshmi Indian Inst Technol Dept Comp Sci & Engn Kharagpur 721302 W Bengal India Rutgers State Univ MSIS Dept Newark NJ 07103 USA

linux is a widely used multi-user operating system with applications ranging from personal desktop to commercial heavy duty web servers. It has built-in security features based on discretionary access control enforced in the form of access control lists, which can be enhanced using the linux security module (LSM) Framework. LSM allows inserting security verification hooks for supporting custom security policies. However, there is no support yet for Attribute-Based Access Control (ABAC) - an access control model gaining popularity due to its dynamic nature and flexibility. In ABAC, access is granted or denied based on attributes of the subject, object and environment. In this work, we propose a method for enhancing linux's security features by integrating ABAC for file system objects using the LSM framework. We look at various kernel and user space components and how they can be made to work together to enforce ABAC policies. Different algorithms and data structures for efficient access request resolution are also investigated. Finally, we carry out extensive performance evaluation of the ABAC-enabled linux system and discuss its results.

关键词： linux Access control Kernel File systems Data structures Authentication Sockets ABAC linux security module file system security access resolution

来源：评论

学校读者我要写书评

暂无评论

Hardening the Internet of Things: Toward Designing Access Control For Resource Constrained IoT Devices 24

Hardening the Internet of Things: Toward Designing Access Co...

引用

17th Cyber security Experimentation and Test Workshop (CSET)

作者： Bessler, Manuel Sangster, Paul Upadrashta, Radhika OConnor, T. J. Xylem Washington DC 20003 USA Florida Inst Technol Melbourne FL 32901 USA

ISBN: (纸本)9798400709579

A myriad of security and privacy threats have accompanied the rapid proliferation and widespread adoption of Internet-of-Things (IoT) devices. IoT vendors often justify this challenge by citing the difficulty of securing resource-constrained embedded devices. However, the monolithic nature of IoT devices introduces the opportunity to leverage mandatory and role-based access control to create a comprehensive yet flexible access control design. We identify that the TOMOYO and CaitSith linux security modules offer opportunities to implement practical access control policies for IoT but there is a dearth of publications in this area. In the following work, we design and implement an access control approach for a linux-based IoT gateway. Specifically, we explore how to reduce the attack surface by defining the policies to restrict the device to the minimum required behaviors. We empirically evaluate our approach's ability to withstand a network penetration test. Through these efforts, we demonstrate the capacity of linux security modules to enforce access control on resource-constrained IoT devices.

关键词： Access Control Policies Internet-of-Things security Embedded Device security linux security module CaitSith TOMOYO

来源：评论

学校读者我要写书评

暂无评论

Commercial Hybrid Electric Aircraft Thermal Management Sensitivity Studies

Commercial Hybrid Electric Aircraft Thermal Management Sensi...

引用

AIAA Propulsion and Energy Forum

作者： Rheaume, Jonathan M. Lents, Charles E. Raytheon Technol Res Ctr Thermal Management 411 Silver Lane E Hartford CT 06108 USA

ISBN: (数字)9781624106026

ISBN: (纸本)9781624106026

Weight sensitivity studies were carried out on a Thermal Management System (TMS) of a parallel Hybrid Electric Propulsion (HEP) system of a commercial single aisle aircraft. The HEP system features a battery that feeds a Low Spool Motor (LSM) to assist the fan of a high bypass ratio geared turbofan. The first study gauged the impact of the Energy Storage, Conversion, & Distribution (ECS&D) system on the size of the Air Oil Cooler (AOC) and the Fuel Oil Cooler (FOC). The HEP system results in decreased FOC weight by 11% due to lower fuel flow at higher temperature due to the LSM and its heat load. Conversely, AOC weight increased by 32% also due to the higher heat load. A second study examines the effect of efficiency of the battery and motor drive on the TMS. Increases in efficiency of the battery from 95% to 96% and the motor drive (MD) from 96% to 98% decrease the weights of their Ram air Coolant Coolers (RCC) by 26% and 38%, respectively, as well as the heat sink air flow through them. Lastly, the altitude at which the Battery ram air Cooled Cooler (Bat RCC) was sized to reject the full heat load on a hot day (8 kft vs 20 kft) was examined. A TMS weight decrease in excess of 50 lbs. is possible for the 20 kft case provided that batteries are sufficiently pre-cooled below ambient temperature prior to take-off.

关键词： Batteries Thermal loading kft motor drives bypass ratio DNLZ gene HEP tumour staging notation linux security module fuel flow Thermal management CHILLER Aircraft HYBRID POWER

来源：评论

学校读者我要写书评

暂无评论

Magnetic levitation control including bogie roll motion 7

Magnetic levitation control including bogie roll motion

引用

Proceedings of the 2015 7th IEEE International Conference on Cybernetics and Intelligent Systems (CIS) And Robotics, Automation and Mechatronics (RAM)

作者： Ha, Chang-Wan Kim, Chang-Hyun Lim, Jaewon Chae, Jubyeong Han, Hyung-Suk Korea Inst Machinery & Mat Dept Magnet Levitat & Linear Drive Daejeon South Korea

ISBN: (纸本)9781467373388

The uneven reaction surface profile facing the lift magnets in attractive maglev vehicle based on linear synchronous motor (LSM) naturally brings about roll motion of the bogie. In particular, in the configuration of placing the long stator of LSM on track for high-speed propulsion, the surface irregularities and the offsets between the stator packs make the measured airgaps, which is the clearance between magnet and stator, discontinuously extreme values, resulting in bogie roll motions. This paper incorporates bogie roll motion into the control law for each magnet controller to reduce the variations in both airgap and bogie roll angle. The effectiveness of the proposed method is verified by a full-scale maglev vehicle.

关键词： Bogies MAGNETS Magnetic levitation vehicles control law SCROLL linux security module Surface irregularity Rolling motion Stators offsets Magnetic levitation

来源：评论

学校读者我要写书评

暂无评论

LSM-based Secure System Monitoring Using Kernel Protection Schemes

LSM-based Secure System Monitoring Using Kernel Protection S...

引用

5th International Conference on Availability, Reliability and security

作者： Isohara, Takamasa Takemori, Keisuke Miyake, Yutaka Qu, Ning Perrig, Adrian KDDI R&D Labs Saitama Japan CMU CyLab Pittsburgh PA USA

ISBN: (纸本)9780769539652

Monitoring a process and its file I/O behaviors is important for security inspection for a data center server against intrusions, malware infection and information leakage. In the case of the linux kernel 2.6, a set of hook functions called the linux security module (LSM) has been implemented in order to monitor and control the system calls. By using the LSM we can inspect the activity of unknown malicious processes. However, a sophisticated attacker could breach the kernel configurations using the rootkits. Furthermore since the monitoring results of the malicious process activity are stored as a file on Hard Disk Drive (HDD), it will be easily manipulated by the attacker. In this paper, we propose a secure monitoring scheme that addresses the attacks against the monitoring module and its result for security inspection of the data center server. The monitoring module is implemented as a LSM-based function and protected by the kernel protection technique. The integrity of the monitoring result is guaranteed by using a Mandatory Access Control (MAC) of the linux kernel and a mechanism of the trusted process invocation. This mechanism can serve as an infrastrucuture of secure inspection platform for data center server because the integrity of the monitoring module and its result is guaranteed.

关键词： Secure system monitoring linux security module Lifetime kernel code integrity Mandatory Access Control

来源：评论

学校读者我要写书评

暂无评论

A new Intrusion Detection Mechanism in SElinux 2

A new Intrusion Detection Mechanism in SELinux

引用

International Symposium on System and Software Reliability (ISSSR)

作者： Zhang, Runnan Liu, Gang Yuan, Xin Ji, Shaomin Zhang, Guofang Xidian Univ Sch Comp Sci & Technol Xian 710071 Peoples R China

ISBN: (纸本)9781509055630

A new intrusion detection mechanism in SElinux based on dual-Markov chain and triggered by critical system calls is put forward in this paper. The mechanism integrates access control with intrusion detection by linux security module (LSM) in SElinux and considers both the global behaviour characteristics and local behaviour characteristics. Theoretical analysis and experimental results show that the mechanism we propose is able to integrate access control with intrusion detection effectively and gets a preferable efficiency of intrusion detection, thus enhancing system security.

关键词： intrusion detection dual-Markov chain system calls access control linux security module embedded system security

来源：评论

学校读者我要写书评

暂无评论

Robot navigation using neuro-electronic hybrid systems 28

Robot navigation using neuro-electronic hybrid systems

引用

28th International Conference on VLSI Design (VLSID) / 14th International Conference on Embedded Systems

作者： George, Jude Baby Abraham, Grace Mathew Amrutur, Bharadwaj Sikdar, Sujit Kumar Indian Inst Sci Ctr Nanosicence & Engn Bangalore 560012 Karnataka India Indian Inst Sci Dept Elect Commun Engn Bangalore 560012 Karnataka India Indian Inst Sci Mol Biophys Unit Bangalore 560012 Karnataka India

ISBN: (纸本)9781479966585

Neuro-electronic hybrid systems have been gaining interest of researchers as a possible architecture for computing. This aims to exploit the strengths of biological neuronal systems with their immense parallel processing and learning capabilities along with that of VLSI systems. Towards this end, we have set up a system which demonstrates the use of a live neuronal culture to solve a real world problem of controlling a robot doing the task of obstacle avoidance. We show that a neuronal culture can look at the sensor inputs to the robot and generate motor commands to allow it to explore an arena while avoiding obstacles.

关键词： collision avoidance neurocontrollers robots VLSI system biological neuronal system neuro-electronic hybrid system neuronal culture obstacle avoidance parallel processing robot navigation Decoding Electrodes Hardware Neurons Robot sensing systems Timing Cultured neural networks LSM Temporal Coding neuro-electronic hybrid systems Mobile robot navigation Collision avoidance Obstacle avoidance Manipulator sensing systems PARALLEL PROCESSING (COMPUTERS) Neurocontrollers Robot hybrid systems linux security module DECODING Computer hardware Electrodes Neurons

来源：评论

学校读者我要写书评

暂无评论

Remote Attestation for HDD Files using Kernel Protection Mechanism

Remote Attestation for HDD Files using Kernel Protection Mec...

引用

2010 IEEE International Conference on Communications

作者： Takemori, Keisuke Perrig, Adrian Qu, Ning Miyake, Yutaka KDDI R&D Labs Fujimino Saitama Japan CMU CyLab Pittsburgh PA USA

ISBN: (纸本)9781424464043

A remote attestation that measures files on a hard disk drive (HDD) is important for intrusion detection on a data center server. When the server is infected by a rootkit or when a file measurement application is manipulated, the response of the kernel or the measurement application is not reliable. A trusted platform module (TPM) that achieves a chain of trust from BIOS to kernel upon booting is proposed to provide the remote attestation. However, as the data center server is rarely rebooted, the TPM is ill suited for file measurements of the running server. In this paper, we propose an on-demand remote attestation scheme for HDD files of the server. We designed and implemented a trust chain from the BIOS via the kernel and the file measurement application to the HDD files on a running server for secure integrity measurement. A memory virtualization technique is applied to guarantee the integrity of the running kernel, and the file measurement application is verified using a code signature. Also, we implement a mechanism that attaches the server's signature to a measurement result in a trusted kernel. Finally, our proposed scheme achieves a result whereby the remote verifier can measure the integrity of the server files securely at any time.

关键词： Remote Attestation Kernel and File Integrity linux security module Chain of Trust

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：