Eric Freudenthal

dRBAC: distributed role-based access control for dynamic coalition environments

distributed role-based access control (dRBAC) is a scalable, decentralized trust-management and access-control mechanism for systems that span multiple administrative domains. dRBAC utilizes PKI identities to define trust domains, roles to define controlled activities, and role delegation across domains to represent permissions to these activities. The mapping of controlled actions to roles enables their namespaces to serve as policy roots. dRBAC distinguishes itself from previous approaches by providing three features: (1) third-party delegation of roles from outside a domains namespace, relying upon an explicit delegation of assignment; (2) modulation of transferred permissions using scalar valued attributes associated with roles; and (3) continuous monitoring of trust relationships over long-lived interactions. The paper describes the dRBAC model and its scalable implementation using a graph approach to credential discovery and validation.

Suitability of NFC for Medical Device Communication and Power Delivery

Near Field Communications (NFC) is a 13.56 MHz inductively coupled power delivery and communication protocol that extends the ISO 14443 RFID standard. Low cost NFC scanner subsystems are anticipated to be widely incorporated in coming generations of commodity cellular phones. We consider the potential of this emerging infrastructure to provide convenient and low cost power distribution and communication channels for a range of medical devices. For example, an NFC device within a cell phone could relay measurements collected from a defibrillator-pacemaker to a monitoring physician, remotely control an insulin pump, or activate an implanted neural simulation system. NFC devices pose similar bio-compatibility challenges to other implanted electronics without requiring the provisioning of battery power to support communication. Furthermore, an NFC communication subsystems power-independence provides a measure of defense against potential denial-of-service attacks that consume power in order to discharge a capacity-limited power source. The 13.56 MHz band has minimal interaction with human and animal tissues. We conducted several successful proof-of- concept experiments communicating with with ISO 14443 tags implanted at multiple locations within a human cadaver. Magnetic field strength decays with the cube of distance-to- antenna, limiting limits the range of potential eavesdroppers. At present, NFC protocols do not provide an appropriate set of privacy properties for implanted medical applications. However, NFC devices are implemented using embedded general purpose processors and thus only software modifications would be required to support protocol extensions with enhanced privacy.

MPCT: media propelled computational thinking

Media-Propelled Computational Thinking (MPCT - pronounced impact) is a course designed to introduce programming in the context of engaging problems in media computation, math, and physics. Programming concepts are introduced as incremental steps needed to solve pragmatic problems students already understand. The problems, graphical API, and hands-on program features are intended to expose fundamental concepts in mathematics and quantitative science. MPCT is offered in an entering students program for freshmen who plan to specialize in a variety of STEM (science, technology, engineering and math) and non-STEM subjects. The curriculum is intended to strengthen student intuition and interest in mathematical modeling and programming by engaging students in the direct manipulation of simple mathematical systems that model and display familiar physical phenomena. MPCT uses programs as concrete and manipulatable examples of fundamental concepts to engage a diverse range of students including women and underrepresented minorities. Variants of MPCT are being developed for high schools, and as a means to introduce computational science to upper division undergraduates studying non-computational STEM disciplines. This paper provides an overview of MPCT and representative problem studies including models of ballistics and resonant systems. The evaluation plan is described and very preliminary results are presented.

Switchboard: secure, monitored connections for client-server communication

Prolonged secure communication requires trust relationships that extend throughout a connections life cycle. Current tools to establish secure connections such as SSL/TLS and SSH authenticate PKI identities, validate credentials and authorize a trust relationship at the time a connection is established, but do not monitor the trust relationship thereafter To maintain security over the duration of a prolonged connection, we extend the semantics of SSL to support continuous monitoring of a credentials liveness and the trust relationships that authorize it. Our implementation isolates trust management into a pluggable trust authorization module. We also present an initial design for a host-level secure communication resource that provides secure channels for multiple connections.

Work in progress — Eliciting integrated understandings of high school STEM curricula through programming

We describe our early investigation of the integration of educational modules originally developed for a college-level entering students program (ESP) titled “Media Propelled Computational Thinking” (MPCT) into high school science, math, and engineering/technology courses. Primary objectives of MPCT include introducing students to imperative programming and reinforcement of foundational mathematical concepts. This report describes this evolving integration including early informal experiments and potential extensions using programming functions of ubiquitous graphing calculators.

DisCo: middleware for securely deploying decomposable services in partly trusted environments

The DisCo middleware infrastructure facilitates the construction and deployment of decomposable applications for environments with dynamic network connectivity properties and unstable trust relationships spanning multiple administrative domains. Consumers of these services, who are mutually anonymous, must be able to discover, securely acquire the code for, and install service components over the network with only minimal a priori knowledge of their locations. Once installed, these components must be able to intemperate securely and reliably across the network. Solutions exist that address individual challenges posed by such an environment, but they rely upon mutually incompatible authorization models that are frequently insufficiently expressive. The primary contributions of DisCo are (1) a middleware toolkit for constructing such applications, (2) a unifying authorization abstraction, and (3) a realization of this authorization well suited for expressing partial trust relationships typical of such environments. We focus on the first two of these contributions, [E. Freudenthal et al., (2002)] presents the third.

An Optimization Approach using Soft Constraints for the Cascade Vulnerability Problem

In the discipline of computer security, the field of trust management design is dedicated to the design of trusted systems, in particular trusted networks. One common trusted mechanism used these days is the multi-level security (MLS) mechanism, that allows simultaneous access to systems by users with different levels of security clearance in an interconnected network. Vulnerability arises when an intruder takes advantage of the network connectivity and creates an inappropriate flow of information across the network, leading to the so-called cascade vulnerability problem (CVP). In this article, we extend an existent approach to this problem proposed by Bistarelli et al. [1] that models, detects and properly eliminates the CVP in a network. This particular approach expresses a solution of the problem using constraint programming. We incorporate real-world criteria to consider into this approach, such as the bandwidth, electricity, cost of connections. Considering such features in CVP results in generating a constraint optimization problem.

Latent learning - What your net also learned

A neural net can learn to discriminate among a set of classes without explicitly training to do so. It does not even need exposure to any instances of those classes. The learning occurs while the net is being trained to discriminate among a set of related classes. This form of transfer learning is referred to as ‘Latent Learning’ by psychologists, because until specifically elicited, the knowledge remains latent. Evidence that latent learning has occurred lies in the existence of consistent, unique responses to the unseen classes. Standard supervised learning can improve the accuracy of those responses with exceedingly small sets of labeled images. In this paper, we use a convolutional neural net (CNN) to demonstrate not only a method of determining a nets latent responses, but also simple ways to optimize latent learning. Additionally, we take advantage of the fact that CNNs are deep nets in order to show how the latently learned accuracy of the CNN may be greatly improved by allowing only its output layer to train. We compare our results both to those obtained with standard backpropagation training of the CNN on small datasets without any transfer learning and to a related set of current published results.

Responding to Java-centric CS curricula: Integration of C into a course in computer organization

This paper describes the reform of a sophomore-level course in computer organization for the Computer Science BS curriculum at The University of Texas at El Paso, where Java and integrated IDEs have been adopted as the first and primary language and development environments. This effort was motivated by faculty observations and industry feedback indicating that upper-division students and graduates were failing to achieve mastery of non-garbage-collected, strictly imperative languages, such as C. The similarity of C variable semantics to the underlying machine model enables simultaneous mastery of both C and assembly language programming and exposes implementation details that are difficult to teach independently, such as subroutine linkage and management of stack frames. An online lab manual has been developed for this course that is freely available for extension or use by other institutions.

Work in progress - initial evaluation of an introductory course in programming that assists in career choices

We present initial results from an effort to investigate the effectiveness of programming-centric computer literacy courses at the University of Texas at El Paso (UTEP). UTEP is an urban university serving a largely Hispanic student population principally drawn from the sister cities of El Paso, TX, USA, and Ciudad Juarez, Chihuahua, MX. This course is based on the creatively engaging ldquomedia programmingrdquo approach of Dr. Mark Guzdial of Georgia Tech. In this course, which was designed for Liberal Arts students, students are introduced to the Jython programming language. Class projects implement and extend algorithms that directly manipulate multimedia and expose students to digital representations of images and sounds in a sequence of aesthetically focused projects. We are investigating whether (1) there is value in modifying this curriculum to complement common occupational traits for student cohorts enrolled in engineering and computer-science programs and (2) such courses can assist students in career choices and improve long-term student success.