No description available.

No description available.

No description available.

No description available.

Most modern software attacks are rooted in memory corruption vulnerabilities. They redirect security-sensitive data values (e.g., return address, function pointer, and heap metadata) to an unintended value. Current state-of-the-art policies, such as Data-Flow Integrity (DFI) and Control-Flow Integrity (CFI), are effective but often struggle to balance precision, generality, and runtime overhead. In this thesis, we propose Data-Value Integrity (DVI), a new defense policy that enforces the integrity of "data value" for security-sensitive control and non-control data. DVI breaks an essential step of memory corruption based attacks by asserting the compromised security-sensitive data value. To show the efficacy of DVI, we present HyperSpace, a prototype that enforces DVI to provide four representative security mechanisms. These include Code Pointer Separation (DVI-CPS) and Code Pointer Integrity (DVI-CPI) based on HyperSpace. We evaluate HyperSpace with SPEC CPU2006 and real-world servers. We also test HyperSpace against memory corruption based attacks, including three real-world exploits and six attacks that bypass existing defenses. Our evaluation shows that HyperSpace successfully detects all attacks and introduces low runtime performance and memory overhead: 1.02% and 6.35% performance overhead for DVI-CPS and DVI-CPI, respectively, and overall approximately 15% memory overhead. / Master of Science / Many modern attacks originate from memory corruption vulnerabilities. These attacks, such as buffer overflow, allow an adversary to compromise a system by executing arbitrary code or escalating their access privilege for malicious actions. Unfortunately, this is due to today's common programming languages such as C/C++ being especially prone to memory corruption. These languages build the foundation of our software stack thus, many applications such as web browsers and database servers that are written using these vulnerable programming languages inherit these shortcomings. There have been numerous security mechanisms that are widely adopted to address this issue but they all fall short in providing complete memory security. Since then, security researchers have proposed various solutions to mitigate these ever-growing shortcomings of memory safety techniques. Nonetheless, these defense techniques are either too narrow-scoped, incur high runtime overhead, or require significant additional hardware resources. This results in them being unscalable for bigger applications or requiring it to be used in combination with other techniques to provide a stronger security guarantee. This thesis presents Data Value Integrity (DVI), a new defense policy that enforces the integrity of "data value" for sensitive C/C++ data which includes, function pointers, virtual function table pointers, and inline heap metadata. DVI can offer wide-scoped security while being able to scale, making it a versatile and elegant solution to address various memory corruption vulnerabilities. This thesis also introduces HyperSpace, a prototype that enforces DVI. The evaluation shows that HyperSpace performs better than state-of-the-art defense mechanisms while having less performance and memory overhead and also providing stronger and more general security guarantees.

This thesis considers the problem of recovering from failures of distributable threads with assured timeliness. When a node hosting a portion of a distributable thread fails, it causes orphans—i.e., thread segments that are disconnected from the thread's root. A termination model is considered for recovering from such failures. In this model the orphans must be detected and cleaned up, and failure-exception notification must be delivered to the farthest, contiguous surviving thread segment for resuming thread execution. Two real-time scheduling algorithms (AUA and HUA) and three distributable thread integrity protocols (TPR, D-TPR and W-TPR) are presented. We show that AUA combined with any of the protocols presented bounds the orphan cleanup and recovery time, thereby bounding thread starvation durations and maximizing the total thread accrued timeliness utility. The algorithms and the protocols are implemented in a real-time middleware that supports distributable threads. The experimental studies with the implementation validate the algorithm/protocols' time-bounded recovery property and confirm their effectiveness. / Master of Science

Academic dishonesty is a major dilemma for institutions of higher learning. Cheating behaviors among students have been documented as early as 1941 when Drake conducted a study that indicated that 23% of students cheated. Since then percentages of students involved in cheating and academic dishonesty have increased. Students are now cheating at an alarming rate as evidenced in a study by McCabe and Trevino (1993) where 52% of 6,000 undergraduate students surveyed admitted cheating on an exam by copying from another student. The purpose of this study was to analyze the extent to which academic integrity policies, standards, and programs differ by institutional type. Specifically, the study focused on the academic integrity policy of each institution, the promotion of standards, and the academic integrity program. Data were collected using the Academic Integrity Survey originally developed by Kibler (1993) and modified for use in this study. The survey consisted of 48 questions designed to measure the differences between academic integrity policies, standards, and programs by institution type. The findings revealed significant difference in three of the five areas. These findings suggest that private institutions are developing honor code systems, training faculty more, and seeing better results from their academic dishonesty initiatives than private institutions. / Master of Arts

Denne studiens hensikt er dels å belyse den økede sårbarheten hos personer med begynnende demens i forhold til omsorgspersoner, og dels å undersøke hva omsorgspersoner mener bør endres med henblikk på utvikling av kunnskap og kompetanse for integritetsstyrkende omsorg og pleie til denne pasientgruppen. Studien er en del av samarbeidsprosjektet: Helsefremmende og forebyggende psykisk helsearbeid i lokalsamfunnet, som er et samarbeidsprosjekt mellom Høgskolen i Hedmark og to kommuner, en by- og en landkommune. Dataene er skapt på grunnlag av åtte fokusgruppeintervjuer med hjemmehjelpere og pårørende og dialogbasert undervisning i de respektive kommuner i peioden okt. 2003-mars 2004. Dataene er analysert ved hjelp av kvalitativ innholdsanalyse. Resultatene viser at intervjupersonene erfarer at personer med begynnende demens har en spesiell sårbarhet og opplever både lidelse og krenkelser i sin hverdag. Hjemmehjelperne etterlyste kontinuitet i tjenesten og ”tilstrekkelig tid” i samhandligssituasjoner med personer med begynnende demens. Pårørende ønsket rutiner for oppfølging både av pasient og pårørende etter utredning og diagnostisering. I tillegg ønsket de bedre rutiner for kommunikasjon og samarbeid mellom pårørende og de hjemmebaserte tjenester.Både pårørende og hjemmehjelper ønsket et relevant faglig undervisningsopplegg for personer som har omsorgsansvar for personer med begynnende demens. / The aim of this MPH thesis is partly to show the increased vulnerability at early stages of dementia related to their caretakers, and partly to investigate what the caretakers think should be changed when it comes to development of knowledge and competence necessary for promoting a care based on the respect for the integrity of this group of patients. The study is part of a research collaboration between Hedmark University College and two municipalities, one urban and one rural municipality: Promotive and preventive mental health work in the local community. Data is created on the basis of eight focus group interviews with home care workers and family carers (spouses and children) from two municipalities during October-03 through March-04. Data was analysed by means of qualitative content analyses. The results show that the persons interviewed had experienced that persons suffering from dementia experienced vulnerability and different kinds of threats against their integrity in their daily life. The home care workers wanted continuance in the service and “time enough” in the caring situations with the patients suffering from dementia to be able to give security and confidence. The family carers wanted collaboration- and communication routines to be able to take better care of the patient. They also felt very much left alone in the care of the patient. / <p>ISBN 91-7997-118-0</p>

<div>Control-flow hijacking attacks allow adversaries to take over seemingly benign software, e.g., a web browser, and cause it to perform malicious actions, i.e., grant attackers a shell on</div><div>a system. Such control-flow hijacking attacks exploit a gap between high level language semantics and the machine language that they are compiled to. In particular, systems</div><div>software such as web browsers and servers are implemented in C/C++ which provide no runtime safety guarantees, leaving memory and type safety exclusively to programmers. Compilers are ideally situated to perform the required analysis and close the semantic gap between C/C++ and machine languages by adding instrumentation to enforce full or partial memory safety.</div><div><br></div><div><div>In unprotected C/C++, adversaries must be assumed to be able to control to the contents of any writeable memory location (arbitrary writes), and to read the contents of any readable memory location (arbitrary reads). Defenses against such attacks range from enforcing full memory safety to protecting only select information, normally code pointers to prevent control-flow hijacking attacks. We advance the state of the art for control-flow hijacking</div><div>defenses by improving the enforcement of full memory safety, as well as partial memory safety schemes for protecting code pointers.</div></div><div><br></div><div><div>We demonstrate a novel mechanism for enforcing full memory safety, which denies attackers both arbitrary reads and arbitrary writes at half the performance overhead of the</div><div>prior state of the art mechanism. Our mechanism relies on a novel metadata scheme for maintaining bounds information about memory objects. Further, we maintain the application</div><div>binary interface (ABI), support all C/C++ language features, and are mature enough to protect all of user space, and in particular libc.</div></div><div><br></div><div><div>Backwards control-flow transfers, i.e., returns, are a common target for attackers. In particular, return-oriented-programming (ROP) is a code-reuse attack technique built around corrupting return addresses. Shadow stacks prevent ROP attacks by providing partial memory safety for programs, namely integrity protecting the return address. We provide a full taxonomy of shadow stack designs, including two previously unexplored designs, and demonstrate that with compiler support shadow stacks can be deployed in practice. Further we examine the state of hardware support for integrity protected memory regions within a process’ address space. Control-Flow Integrity (CFI) is a popular technique for securing forward edges, e.g., indirect function calls, from being used for control-flow hijacking attacks. CFI is a form of partial memory safety that provides weak integrity for function pointers by restricting them to a statically determined set of values based on the program’s control-flow graph. We survey existing techniques, and quantify the protection they provide on a per callsite basis.</div><div>Building off this work, we propose a new security policy, Object Type Integrity, which provides full integrity protection for virtual table pointers on a per object basis for C++</div><div>polymorphic objects.</div></div>

Previous research has shown that there is a relationship between trust and organizational commitment. Our research questions were if the three trust-variables ability, benevolence and integrity predict organizational commitment differently. Further we examined if the length of employment affected the relationship between benevolence and organizational commitment. Due to the fact that past studies has shown that benevolence develop during a longer period of time than do the other trust-variables. We made a survey using questionnaires (n=50) in a “caretaking facility” and using a multiple regression analysis we found that ability was a significant predictor (p=0.032) for organizational commitment. The result of a partial correlation test showed that the length of employment did not affect the relationship between benevolence and organizational commitment. Finally we discussed reasons why ability was the only predictor that could explain organizational commitment in this study. / Tidigare forskning har visat att det finns en relation mellan tillit och engagemang för organisationen. Våra frågeställningar var om de tre tillitsvariablerna Ability, Benevolence och Integrity predicerar engagemang för organisationen olika mycket. Vidare undersökte vi om anställningstiden påverkade relationen mellan Benevolence och engagemang för organisationen. Eftersom tidigare studier visat att Benevolence tar längre tid att utveckla än de övriga tillitsvariablerna. Vi gjorde en enkätundersökning (n=50) på en omsorgsverksamhet och fann genom en multipel regressionsanalys att Ability var en signifikant prediktor (p=0.032) till engagemang för organisationen.  Resultatet av en partiell korrelation visade att anställningstiden inte påverkade relationen mellan Benevolence och engagemanget. Slutligen diskuterade vi varför Ability var den enda prediktorn som kunde predicera engagemang för organisationen i denna studie.