Currently, security is frequently considered late in software life cycle. It is often bolted on late in development, or even during deployment or maintenance, through activities such as add-on security software and penetration-and-patch maintenance. Even if software developers aim to incorporate security into their products from the beginning of the software life cycle, they face an exhaustive amount of ad hoc unstructured information without any practical guidance on how and why this information should be used and what the costs and benefits of using it are. This is due to a lack of structured methods.

In this thesis we present a model for secure software development and implementation of a security plug-in that deploys this model in software life cycle. The model is a structured unified process, named S3P (Sustainable Software Security Process) and is designed to be easily adaptable to any software development process. S3P provides the formalism required to identify the causes of vulnerabilities and the mitigation techniques that address these causes to prevent vulnerabilities. We present a prototype of the security plug-in implemented for the OpenUP/Basic development process in Eclipse Process Framework. We also present the results of the evaluation of this plug-in. The work in this thesis is a first step towards a general framework for introducing security into the software life cycle and to support software process improvements to prevent recurrence of software vulnerabilities.

Accident statistics indicate that every year a significant number of casualties and extensive property losses occur due to traffic accidents. Consequently, efforts are directed towards developing passive and active safety systems that help reduce the severity of crashes, or prevent vehicles from colliding with one another. To develop these systems, technologies such as sensor systems, computer vision and vehicular communication have been proposed. Safety vehicular communication is defined as the exchange of data between vehicles with the goal of providing in-vehicle safety systems with enough information to permit detection of traffic dangers. Inter-vehicle communication is a key safety technology, especially as a complement to other technologies such as radar, as the information it provides cannot be gathered in any other way. However, due to the specifics of the traffic environment, the design of efficient safety communication systems poses a series of major technical challenges.

In this thesis we focus on the design and development of a safety communication system that provides support for active safety systems such as collision warning and collision avoidance. We begin by providing a method for designing the support system for active safety systems. Within our study, we investigate different safety aspects of traffic situations. For performing traffic investigations, we have developed ECAM, a temporal reasoning system for modeling and analyzing accident scenarios.

Next, we focus on the communication system design. We investigate approaches that can be applied to implement safety vehicular communication, as well as design aspects of such systems, including networking techniques and transmission procedures. We then propose a new solution for vehicular communication in the form of a distributed communication protocol that allows the vehicles to organize themselves in virtual clusters according to their common interest in traffic safety. To disseminate the information used for organizing the network and for assessing dangers in traffic, we develop an anonymous context-based broadcast protocol. This protocol requires the receivers to determine whether they are the intended destination for sent messages based on knowledge about their current situation in traffic. This communication system is then augmented with a reactive operation mode, where warnings can be issued and forwarded by vehicles. A vehicular communication platform that provides an implementation framework for the communication system, and integrates it within a vehicle, is also proposed. Experiments have been conducted, under various conditions, to test communication performance and the system’s ability to reduce accidents. The results indicate that that the proposed communication system can efficiently provide the exchange of safety information between vehicles.

Accident statistics indicate that every year a large number of casualties and extensive property losses are recorded due to traffic accidents. Consequently, efforts are directed towards developing passive and active safety systems that help reducing the severity of crashes or prevent vehicles to collide with each other. Within the development of these systems, technologies such as sensor systems, computer vision and vehicular communication are considered of importance. Vehicular communication is defined as the exchange of data between vehicles, and is considered a key technology for traffic safety due to its ability to provide the vehicles with information that cannot be acquired using other means (e.g. radar and video systems). However, due to the current early stage in the development of in-vehicle safety systems, the applicability of communication for improving traffic safety is still an open issue. Furthermore, due to the specificity of the environment in which vehicles travel, the design of communication systems that provide an efficient exchange of safety-related data between vehicles poses a series of major technical challenges.

In this thesis we focus on the development of a communication system that provides support for in-vehicle active safety systems such as collision warning and collision avoidance.

We begin by studying the applicability of communication for supporting the development of effective active safety systems. Within our study, we investigate different safety aspects of traffic situations. For performing such investigations we develop ECAM, a temporal reasoning system for modeling and analyzing accident scenarios. This system gives us the possibility of analyzing relations between events that occur in traffic and their possible consequences. We use ECAM for analyzing the degree of accident prevention that can be achieved by applying crash countermeasures based on communication in specific traffic scenarios.

By acknowledging the potential of communication for traffic safety, we further focus in the thesis on the design of a safety-oriented vehicular communication system. We propose a new solution for vehicular communication in the form of a distributed communication protocol that allows the vehicles to organize the network in an ad-hoc decentralized manner. For disseminating information, we develop an anonymous context-based broadcast protocol that requires the receivers to determine whether they are the intended destination of sent messages based on knowledge about their momentary situation in traffic. We further design a vehicular communication platform that provides an implementation framework for the communication system, and integrates it within a vehicle. Investigations of the communication performances, which evaluate metrics such as transmission delay, send errors, packet collisions and information filtering, indicate that the proposed vehicular communication system is able to provide a reliable and timely exchange of data between vehicles.

In today's world, traffic safety is a major problem. Traffic accidents result in more than half a million casualties each year and are associated with serious injuries and extensive material losses. Therefore, special attention is given to those technologies that can reduce the number and severity of road events. Inter-vehicle communication (IVC) and vehicle to road communication (VRC) are considered to have extensive potential for the development of efficient safety systems installed in vehicles. This paper proposes a novel, safety-oriented communication platform dedicated to supporting the exchange of safety-relevant information between traffic participants. The vehicular communication platform (VCP) aims to support a specific vehicular communication mechanism previously designed by the authors and briefly presented in the paper.

More than half a million casualties are due to traffic accidents each year. Therefore, there is a high demand for innovative technologies focused on collision warning and collision avoidance. Among such technologies, the inter-vehicle communication and the vehicle-to-road communication are considered to have extensive potential for supporting the safety systems located within a vehicle. In this paper we propose a new approach to vehicular communication. We designed a safety-oriented vehicular communication, built around the concept of mobile ad-hoc peer-to-peer (P2P) networking. The merging between ad-hoc connectivity and P2P paradigm facilitates the development of a vehicular network characterized by self-organization, fault-tolerance, scalability, shareable resources and services, cooperation, cases of interconnection and cost efficiency. These characteristics recommend the communication proposed here as an efficient method for providing safety-relevant data for safety systems installed in vehicles.

This paper focuses on the utilization and integration of geographic information systems (GIS) oriented to tragic safety in vehicles. We have primarily analyzed the benefits of introducing GIS systems that support the driver and provide processed data to collision warning and collision avoidance systems located in vehicles. Further on, we have defined a set of information that is relevant for traffic safety and appropriate to be used within an in-vehicle GIS system. Based on these data, we propose in this paper a specific design for the GIS system. This system integrates the relevant data for traffic safety and takes into consideration the specific requirements of the vehicular domain. The integration of the GIS system within vehicles introduces a series of problems that are discussed in the paper.

Traffic accidents account for more than half a million casualties every year. The analysis of accidents helps identifying the elements that affect traffic conditions, the relationships between them, and how they may contribute to the occurrence of dangerous situations. In this paper we present a temporal reasoning system for modeling and analyzing various types of accident scenarios. The system is based on Event Calculus and was implemented using Prolog. We exemplify the use of the system by applying it for modeling and analyzing a rear-end accident scenario.

An ever-increasing number of Internet applications, such as content and software distribution, distance learning, multimedia streaming, teleconferencing, and collaborative workspaces, need efficient and secure multicast communication. However, efficiency and security are competing requirements and balancing them to meet the application needs is still an open issue.

In this thesis we study the efficiency versus security requirements tradeoffs in group key management for multicast communication. The efficiency is in terms of minimizing the group rekeying cost and the key storage cost, while security is in terms of achieving backward secrecy, forward secrecy, and resistance to collusion.

We propose two new group key management schemes that balance the efficiency versus resistance to collusion. The first scheme is a flexible category-based scheme, and addresses applications where a user categorization can be done based on the user accessibility to the multicast channel. As shown by the evaluation, this scheme has a low rekeying cost and a low key storage cost for the controller, but, in certain cases, it requires a high key storage cost for the users. In an extension to the basic scheme we alleviate this latter problem.

For applications where the user categorization is not feasible, we devise a cluster-based group key management. In this scheme the resistance to collusion is measured by an integer parameter. The communication and the storage requirements for the controller depend on this parameter too, and they decrease as the resistance to collusion is relaxed. The results of the analytical evaluation show that our scheme allows a fine-tuning of security versus efficiency requirements at runtime, which is not possible with the previous group key management schemes.

Science is changing. Computers, fast communication, and  new technologies have created new ways of conducting research.  For  instance, researchers from different disciplines are processing and  analyzing scientific data that is increasing at an exponential rate.  This kind of research requires that the scientists have access to  tools that can handle huge amounts of data, enable access to vast  computational resources, and support the collaboration of large  teams of scientists. This thesis focuses on tools that help support  scientific collaboration.

Workflows and provenance are two concepts that have proven useful in  supporting scientific collaboration.  Workflows provide a formal  specification of scientific experiments, and provenance offers a  model for documenting data and process dependencies.  Together, they  enable the creation of tools that can support collaboration through  the whole scientific life-cycle, from specification of experiments  to validation of results.  However, existing models for workflows  and provenance are often specific to particular tasks and tools.  This makes it hard to analyze the history of data that has been  generated over several application areas by different tools.  Moreover, workflow design is a time-consuming process and often  requires extensive knowledge of the tools involved and collaboration  with researchers with different expertise. This thesis addresses  these problems.

Our first contribution is a study of the differences between two  approaches to interoperability between provenance models: direct  data conversion, and mediation. We perform a case study where we  integrate three different provenance models using the mediation  approach, and show the advantages compared to data conversion.  Our  second contribution serves to support workflow design by allowing  multiple users to concurrently design workflows. Current workflow  tools lack the ability for users to work simultaneously on the same  workflow.  We propose a method that uses the provenance of workflow  evolution to enable real-time collaborative design of workflows.  Our third contribution considers supporting workflow design by  reusing existing workflows. Workflow collections for reuse are  available, but more efficient methods for generating summaries of  search results are still needed. We explore new summarization  strategies that considers the workflow structure.

This book constitutes the workshop proceedings of the 14th International Conference on Database Systems for Advanced Applications, DASFAA 2009, held in Brisbane, Australia, in April 2009. The volume contains six workshops, each focusing on specific research issues that contribute to the main themes of the DASFAA conference: The First International Workshop on Benchmarking of XML and Semantic Web Applications (BenchmarkX'09); The Second International Workshop on Managing Data Quality in Collaborative Information Systems (MCIS'09); The 1st International Workshop on Data and Process Provenance (WDPP'09); The First International Workshop on Privacy-Preserving Data Analysis (PPDA'09); The First International Workshop on Mobile Business Collaboration (MBC'09); and the First Ph.D. Workshop.

Private homes are becoming increasingly connected to the Internet in fast and reliable ways. These connections pave the way for networked services, i.e. services that gain their value through their connectivity. Examples of such electronic services (e-services) are services for remote control of household appliances, home health care or infotainment.

Residential gateways connect the private home with the Internet and are the home access point and one execution platform for e-services. Potentially, a residential gateway runs e-services from multiple providers. The software environment of such a residential gateway is a Java execution environment where e-services execute as Java threads within the Java virtual machine. The isolation of these Java e-services from each other and from their execution environment is the topic of this thesis.

Although the results of this thesis can be applied to most Java servers-e.g. Javaenabled web browsers, web servers, JXTA, JINI-this work focuses on e-services for the private home and their execution platform. Security for the private home as a prerequisite for end user acceptance is the motivation for this approach.

This thesis establishes requirements that prevent e-services on the Java execution platform from harming other e-services on the same or other network nodes and that prevent e-services from harming their underlying execution environment. Some of the requirements can be fulfilled by using the existing Java sandbox for access control. Other requirements, concerned with availability of e-services and network nodes, need a modified Java environment that supports resource control and e-service-specific access control. While some of the requirements result in implementation guidelines for Java servers, and in particular for the e-service environment, other requirements have been implemented as a proof of concept. 

The runtime environments provided by application-level virtual machines such as the Java Virtual Machine or the .NET Common Language Runtime are attractive for Internet application providers because the applications can be deployed on any platform that supports the target virtual machine. With Internet applications, organisations as well as end users face the risk of viruses, trojans, and denial of service attacks. Virtual machine providers are aware of these Internet security risks and provide, for example, runtime monitoring of untrusted code and access control to sensitive resources.

Our work addresses two important security issues in runtime environments. The first issue concerns resource or release control. While many virtual machines provide runtime access control to resources, they do not provide any means of limiting the use of a resource once access is granted; they do not provide so-called resource control. We have addressed the issue of resource control in the example of the Java Virtual Machine. In contrast to others’ work, our solution builds on an enhancement to the existing security architecture. We demonstrate that resource control permissions for Java-mediated resources can be integrated into the regular Java security architecture, thus leading to a clean design and a single external security policy.

The second issue that we address is the usabilityhttps://www.diva-portal.org/liu/webform/form.jsp

DiVA Web Form and security of the setup of security policies for runtime environments. Access control decisions are based on external configuration files, the security policy, which must be set up by the end user. This set-up is security-critical but also complicated and errorprone for a lay end user and supportive, usable tools are so far missing. After one of our usability studies signalled that offline editing of the configuration file is inefficient and difficult for end users, we conducted a usability study of personal firewalls to identify usable ways of setting up a security policy at runtime. An analysis of general user help techniques together with the results from the two previous studies resulted in a proposal of design guidelines for applications that need to set up a security policy. Our guidelines have been used for the design and implementation of the tool JPerM that sets the Java security policy at runtime. JPerM evaluated positively in a usability study and supports the validity of our design guidelines.

The growing number of the elderly in industrialised countries is increasing the pressure on respective health care systems. This is one reason for recent trends in the development and expansion of home health care organisations. With Internet access available to everyone and the advent of wireless technologies, advanced telehomecare is a possibility for a large proportion of the population.

In the near future, one of the authors plans to implement a home health care infrastructure for patients with congestive heart failure and patients with chronic obstructive pulmonary disease. The system is meant to support regular and ad-hoc measurements of medical parameters in patient homes and transmission of measurement data to the home health care provider.

In this paper we look at network technologies that connect sensors and input devices in the patient home to a home health care provider. We consider wireless and Internet technologies from functional and security-related perspectives and arrive at a recommendation for our system.

Security and usability aspects of the proposed network infrastructures are explored with special focus on their impact on the patient home.

Web browsers, Web servers, Java application servers and OSGi frameworks are all instances of Java execution environments that tun more or less untrusted Java applications. In all these environments, Java applications can come from different sources. Consequently, application developers rarely know which other applications exist in the target Java execution environment. This paper investigates the requirements that need to be imposed on such a container from a security point of view and how the requirements have been implemented by different Java application containers. More specifically, we show a general risk analysis considering assets, threats and vulnerabilities of a Java container. This risk analysis exposes generic Java security problems and leads to a set of security requirements. These security requirements are then used to evaluate the security architecture of existing Java containers for Java applications, applets, servlets, OSGi bundles, and Enterprise Java Beans. For comparison, the requirements are also examined for a C++ application.

The Java Security Manager is one major security feature of the Java programming language. However, in many Java applications the Security Manager is not enabled because it slows execution time. This paper explores the performance of the Java Security Manager in depth, identifies the permissions with the worst performance and gives advice on how to use the Security Manager in a more efficient way.

Our performance test shows that the CPU execution time penalty varies between 5% and 100% per resource access statement. This extreme range is due to the fact that some resource accesses are costly (such as file and socket access) and therefore hide the performance penalty for the access control check almost completely. The time penalty is much more noticeable with access to main memory resources (such as Java objects).

In order to achieve reasonable response times, it is of utmost importance to tune garbage collection because the Java Security Manager creates short-lived objects during its permission check. Also, the order of permissions in the policy file can be important.

Life scientists often have to retrieve data from multiple biological data sources to solve their research problems. Although many data sources are available, they vary in content, data format, and access methods, which often vastly complicates the data retrieval process. The user must decide which data sources to access and in which order, how to retrieve the data and how to combine the results - in short, the task of retrieving data requires a great deal of effort and expertise on the part of the user.

Information integration systems aim to alleviate these problems by providing a uniform (or even integrated) interface to biological data sources. The information integration systems currently available for biological data sources use traditional integration approaches. However, biological data and data sources have unique properties which introduce new challenges, requiring development of new solutions and approaches.

This thesis is part of the BioTrifu project, which explores approaches to integrating multiple biological data sources. First, the thesis describes properties of biological data sources and existing systems that enable integrated access to them. Based on the study, requirements for systems integrating biological data sources are formulated and the challenges involved in developing such systems are discussed. Then, the thesis presents a query language and a high-level architecture for the BioTrifu system that meet these requirements. An approach to generating a query plan in the presence of alternative data sources and ways to integrate the data is then developed. Finally, the design and implementation of a prototype for the BioTrifu system are presented.

Data integration is an important procedure underlying many research tasks in the life sciences, as often multiple data sources have to be accessed to collect the relevant data. The data sources vary in content, data format, and access methods, which often vastly complicates the data retrieval process. As a result, the task of retrieving data requires a great deal of effort and expertise on the part of the user. To alleviate these difficulties, various information integration systems have been proposed in the area. However, a number of issues remain unsolved and new integration solutions are needed.

The work presented in this thesis considers data integration at three different levels. 1) Integration of biological data sources deals with integrating multiple data sources from an information integration system point of view. We study properties of biological data sources and existing integration systems. Based on the study, we formulate requirements for systems integrating biological data sources. Then, we define a query language that supports queries commonly used by biologists. Also, we propose a high-level architecture for an information integration system that meets a selected set of requirements and that supports the specified query language. 2) Integration of ontologies deals with finding overlapping information between ontologies. We develop and evaluate algorithms that use life science literature and take the structure of the ontologies into account. 3) Grouping of biological data entries deals with organizing data entries into groups based on the computation of similarity values between the data entries. We propose a method that covers the main steps and components involved in similarity-based grouping procedures. The applicability of the method is illustrated by a number of test cases. Further, we develop an environment that supports comparison and evaluation of different grouping strategies.

The work is supported by the implementation of: 1) a prototype for a system integrating biological data sources, called BioTRIFU, 2) algorithms for ontology alignment, and 3) an environment for evaluating strategies for similarity-based grouping of biological data, called KitEGA.

To detect network changes and network troubles, Transpondertech needs a tool that can make network measurements.

The purpose of this thesis has been to find measurable network properties that best reflect the status of a network, to find methods to measure these proerties and to implement these methods in one single tool. The resulting tool is called NetworkPerf and can measure the following network properties: availability, round-trip delay, delay variation, number of hops, intermediate hosts, available bandwidth, available ports, and maximum allowed packet size. Together, these properties give a good picture of the status of a network connection.

The thesis also presents the methods used for meassuring these properties in the tool.

Better methods and tools are needed in the fight against child pornography. This thesis presents a method for file type categorisation of unknown data fragments, a method for reassembly of JPEG fragments, and the requirements put on an artificial JPEG header for viewing reassembled images. To enable empirical evaluation of the methods a number of tools based on the methods have been implemented.

The file type categorisation method identifies JPEG fragments with a detection rate of 100% and a false positives rate of 0.1%. The method uses three algorithms, Byte Frequency Distribution (BFD), Rate of Change (RoC), and 2-grams. The algorithms are designed for different situations, depending on the requirements at hand.

The reconnection method correctly reconnects 97% of a Restart (RST) marker enabled JPEG image, fragmented into 4 KiB large pieces. When dealing with fragments from several images at once, the method is able to correctly connect 70% of the fragments at the first iteration.

Two parameters in a JPEG header are crucial to the quality of the image; the size of the image and the sampling factor (actually factors) of the image. The size can be found using brute force and the sampling factors only take on three different values. Hence it is possible to use an artificial JPEG header to view full of parts of an image. The only requirement is that the fragments contain RST markers.

The results of the evaluations of the methods show that it is possible to find, reassemble, and view JPEG image fragments with high certainty.

Usability issues are traditionally associated with user interfaces rather than with agent frameworks. We argue that the metaphors and models used in a framework will affect the thinking of the developer, and will influence the application design. Therefore, usability is of central importance for successful software development, and for reducing development and maintenance costs. We discuss the design and implementation of a lightweight agent framework for interactive multi-agent applications. A lightweight framework is advantageous for distributed interactive applications, for instance applications running on hand-held devices with limited memory. The design is based on minimalism and simplicity. We present the results from a usability study of the framework, where issues such as learnability and attitude have been evaluated. The study shows that minimalist design principles are useful for achieving understandable and navigable frameworks.

The development of standards for biological pathways has led to a huge amount of model data stored in a variety of different formats represented in XML (e. g. SBML) or OWL (e. g. BioPAX). As a result, there is an urgent need for the conversion of data between different formats, especially between XML and OWL data. The fact that that transformation is hard to realize hampers the integration of data in the area. Addressing this problem, the following article proposes a general, semi-automatic solution by suggesting the transformation of XML Schema based data into an OWL format. The general solution presented here will support biologists by offering them a way to query data of any format and as well compare different data files or schemas to each other using OWL as a common format for matching and providing a backwards transformation to XML Schema. The paper presents a first architectural approach and its prototype implementation. The evaluation showed that the approach is promising.

Nowadays, biologists use a number of large biological databanks to find relevant information for their research. Users of these databanks face a number of problems. One problem is that users are required to have good knowledge about the contents, implementations and conceptual models of many databanks to be able to ask precise and relevant questions. Further, the terminology that is used in the different databanks may be different. Also, when asking complex queries to multiple databanks, users need to construct a query plan on their own possibly leading to poor performance or not even obtaining results. To alleviate these problems we define an architecture for systems that deal with these problems by allowing for a transparent and integrated way to query the multiple sources. The contribution of this paper is threefold. First, we describe a study of current biological databanks. Then, we propose a base query language that contains operators that should be present in any query language for biological databanks. Further, we present an architecture for a system supporting such a language and providing integrated access to the highly distributed and heterogeneous environment of biological databanks.

Much information is nowadays stored electronically in document bases. Users retrieve information from these document bases by browsing and querying. While a large number of tools are available nowadays, not much work has been done on tools that support queries involving all the characteristics of documents as well as the use of domain knowledge during the search for information. In this paper we propose a query language that allows for querying documents using content information, information about the logical structure of the documents as well as information about properties of the documents. Domain knowledge is taken into account during the search as well. We also present an architecture for a system supporting such a language and we describe a prototype implementation together with test results.