Health Information Systems (HIS) make extensive use of Information and Communication Technologies (ICT). The use of ICT aids in improving the quality and efficiency of healthcare services by making healthcare information available at the point of care (Goldstein, Groen, Ponkshe, and Wine, 2007). The increasing availability of healthcare data presents security and privacy issues which have not yet been fully addressed (Liu, Caelli, May, and Croll, 2008a). Healthcare organisations have to comply with the security and privacy requirements stated in laws, regulations and ethical standards, while managing healthcare information. Protecting the security and privacy of healthcare information is a very complex task (Liu, May, Caelli and Croll, 2008b). In order to simplify the complexity of providing security and privacy in HIS, appropriate information security services and mechanisms have to be implemented. Solutions at the application layer have already been implemented in HIS such as those existing in healthcare web services (Weaver et al., 2003). In addition, Discretionary Access Control (DAC) is the most commonly implemented access control model to restrict access to resources at the OS layer (Liu, Caelli, May, Croll and Henricksen, 2007a). Nevertheless, the combination of application security mechanisms and DAC at the OS layer has been stated to be insufficient in satisfying security requirements in computer systems (Loscocco et al., 1998). This thesis investigates the feasibility of implementing Security Enhanced Linux (SELinux) to enforce a Role-Based Access Control (RBAC) policy to help protect resources at the Operating System (OS) layer. SELinux provides Mandatory Access Control (MAC) mechanisms at the OS layer. These mechanisms can contain the damage from compromised applications and restrict access to resources according to the security policy implemented. The main contribution of this research is to provide a modern framework to implement and manage SELinux in HIS. The proposed framework introduces SELinux Profiles to restrict access permissions over the system resources to authorised users. The feasibility of using SELinux profiles in HIS was demonstrated through the creation of a prototype, which was submitted to various attack scenarios. The prototype was also subjected to testing during emergency scenarios, where changes to the security policies had to be made on the spot. Attack scenarios were based on vulnerabilities common at the application layer. SELinux demonstrated that it could effectively contain attacks at the application layer and provide adequate flexibility during emergency situations. However, even with the use of current tools, the development of SELinux policies can be very complex. Further research has to be made in order to simplify the management of SELinux policies and access permissions. In addition, SELinux related technologies, such as the Policy Management Server by Tresys Technologies, need to be researched in order to provide solutions at different layers of protection.

Grids, multi-clusters, NUMA systems, and ad-hoc collections of distributed computing devices all present diverse environments in which distributed computing applications can be run. Due to the diversity of features provided by these environments a distributed application that is to perform well must be specifically designed and optimised for the environment in which it is deployed. Such optimisations generally affect the application's communication structure, its consistency protocols, and its communication protocols. This thesis explores approaches to improving the ability of distributed applications to share consistent data efficiently and with improved functionality over wide-area and diverse environments. We identify a fundamental separation of concerns for distributed applications. This is used to propose a new model, called the view model, which is a hybrid, cost-conscious approach to remote data sharing. It provides the necessary mechanisms and interconnects to improve the flexibility and functionality of data sharing without defining new programming models or protocols. We employ the view model to adapt distributed applications to their run-time environment without modifying the application or inventing new consistency or communication protocols. We explore the use of view model properties on several programming models and their consistency protocols. In particular, we focus on programming models used in distributed-shared-memory middleware and applications, as these can benefit significantly from the properties of the view model. Our evaluation demonstrates the benefits, side effects and potential short-comings of the view model by comparing our model with traditional models when running distributed applications across several multi-clusters scenarios. In particular, we show that the view model improves the performance of distributed applications while reducing resource usage and communication overheads.

CNPq / Sistemas embarcados são sistemas computacionais projetados para aplicações específicas, os quais estão presentes em praticamente todos os dispositivos eletrônicos atuais. A utilização de um sistema operacional (SO) é uma maneira de simplificar o desenvolvimento de software, livrando os programadores do gerenciamento do hardware de baixo nível e fornecendo uma interface de programação simples para tarefas que ocorrem com frequência. A alta complexidade dos computadores pessoais atuais torna a utilização de um SO indispensável. Por outro lado, sistemas embarcados são arquiteturas limitadas, geralmente com muitas restrições de custo e consumo. Devido às demandas adicionais impostas por um SO, os desenvolvedores de sistemas embarcados enfrentam a crítica decisão quanto à adoção ou não de um SO. Nesta dissertação, apresenta-se uma série de critérios a fim de auxiliar os projetistas de sistemas embarcados na decisão quanto ao uso ou não de um SO. Além disso, outros critérios são apresentados com o intuito de guiar a seleção do SO mais adequado às características do projeto. Adicionalmente, escolheu-se 15 sistemas operacionais para serem analisados de acordo com os critérios apresentados, os quais podem ser utilizados como base para o processo de seleção de um SO. Adicionalmente, a fim de avaliar o impacto da adoção de um SO em um projeto embarcado, apresenta-se um estudo de caso no qual uma aplicação modelo (uma estação meteorológica embarcada) foi desenvolvida em três diferentes cenários: sem um SO, usando um SO de tempo real (µC/OS-II), e usando um SO de propósito geral (uClinux). Uma FPGA e um SoPC foram utilizados para obter uma plataforma flexível de hardware apta para acomodar as três configurações. A adoção de um SO proporcionou uma redução de até 48% no tempo de desenvolvimento; em contrapartida, isto aumentou os requisitos de memória de programa em pelo menos 71%. / An embedded system (ES) is a computing system designed for a specific purpose, present essentially in every electronic device. The use of an operating system (OS) is advocated as a means to simplify software development, freeing programmers from managing low-level hardware and providing a simpler programming interface for common tasks. The high complexity of modern desktop computers makes an OS indispensable; embedded systems, on the other hand, are limited architectures, usually severely cost- and power-constrained. Because of the additional demands imposed by an OS, embedded developers are faced with the crucial decision of whether to adopt an OS or not. In this work, we introduce a set of criteria to help determine whether an OS should be adopted in an embedded design. We then go further and establish a series of rules to help decide which OS to pick, if one should be used. In addition, we present a case study in which a sample application (an embedded weather station) was developed under three different scenarios: without any OS, using the µC/OS-II real-time OS, and using the uClinux general-purpose OS. An FPGA and a SoPC were used to provide a flexible hardware platform able to accommodate all three configurations. The adoption of an OS provided a reduction of up to 48% in development time; on the other hand, it increased program memory requirements in at least 71%.

La thèse porte sur deux enjeux importants de sécurité. Le premier concerne l’amélioration de la sécurité des systèmes Linux présents dans le calcul intensif et le second la protection des postes de travail Windows. Elle propose une méthode commune pour l’observation des appels système et la répartition d’observateurs afin de renforcer la sécurité et mesurer les performances obtenues. Elle vise des observateurs du type moniteur de référence afin de garantir de la confidentialité et de l’intégrité. Une solution utilisant une méthode de calcul intensif est mise en oeuvre pour réduire les surcoûts de communication entre les deux moniteurs de référence SELinux et PIGA. L’évaluation des performances montre les surcoûts engendrés par les moniteurs répartis et analyse la faisabilité pour les différents noeuds d’environnements de calcul intensif. Concernant la sécurité des postes de travail, un moniteur de référence est proposé pour Windows. Il repose sur les meilleures protections obligatoires issues des systèmes Linux et simplifie l’administration. Nous présentons une utilisation de ce nouveau moniteur pour analyser le fonctionnement de logiciels malveillants. L’analyse permet une protection avancée qui contrôle l’ensemble du scénario d’attaque de façon optimiste. Ainsi, la sécurité est renforcée sans nuire aux activités légitimes. / This thesis deals with two major issues in the computer security field. The first is enhancing the security of Linux systems for scientific computation, the second is the protection of Windows workstations. In order to strengthen the security and measure the performances, we offer a common method for the distributed observation of system calls. It relies on reference monitors to ensure confidentiality and integrity. Our solution uses specific high performance computing technologies to lower the communication latencies between the SELinux and PIGA monitors. Benchmarks study the integration of these distributed monitors in the scientific computation. Regarding workstation security, we propose a new reference monitor implementing state of the art protection models from Linux and simplifying administration. We present how to use our monitor to analyze the behavior of malware. This analysis enables an advanced protection to prevent attack scenarii in an optimistic manner. Thus, security is enforced while allowing legitimate activities.

In today's highly competitive global economy, information resources representing enterprise-wide information are essential to the survival of an organization. The development of and increase in the use of personal computers and data communication networks are supporting or, in many cases, replacing the traditional computer mainstay of corporations. The client/server model incorporates mainframe programming with desktop applications on personal computers. The aim of the research is to compile a technology model for the development of client/server software. A comprehensive overview of the individual components of the client/server system is given. The different methodologies, tools and techniques that can be used are reviewed, as well as client/server-specific design issues. The research is intended to create a road map in the form of a Technology Reference Model for Client/Server Software Development. / Computing / M. Sc. (Information Systems)

The way in which application systems and software are built has changed dramatically over the past few years. This is mainly due to advances in hardware technology, programming languages, as well as the requirement to build better software application systems in less time. The importance of mondial (worldwide) communication between systems is also growing exponentially. People are using network-based applications daily, communicating not only locally, but also globally. The Internet, the global network, therefore plays a significant role in the development of new software. Distributed object computing is one of the computing paradigms that promise to solve the need to develop clienVserver application systems, communicating over heterogeneous environments. This study, of limited scope, concentrates on one crucial element without which distributed object computing cannot be implemented. This element is the communication software, also called middleware, which allows objects situated on different hardware platforms to communicate over a network. Two of the most important middleware standards for distributed object computing today are the Common Object Request Broker Architecture (CORBA) from the Object Management Group, and the Distributed Component Object Model (DCOM) from Microsoft Corporation. Each of these standards is implemented in commercially available products, allowing distributed objects to communicate over heterogeneous networks. In studying each of the middleware standards, a formal way of comparing CORBA and DCOM is presented, namely meta-modelling. For each of these two distributed object infrastructures (middleware), meta-models are constructed. Based on this uniform and unbiased approach, a comparison of the two distributed object infrastructures is then performed. The results are given as a set of tables in which the differences and similarities of each distributed object infrastructure are exhibited. By adopting this approach, errors caused by misunderstanding or misinterpretation are minimised. Consequently, an accurate and unbiased comparison between CORBA and DCOM is made possible, which constitutes the main aim of this dissertation. / Computing / M. Sc. (Computer Science)

Les systèmes temps-réels sont des systèmes qui sont soumis à "des contraintes de temps", comme par exemple le délais de réponse d'un système à un événement physique. Souvent les temps de réponse sont de l'ordre du milliseconde et parfois même du microseconde. Construire des systèmes temps-réels nécessite l'utilisation de méthodologies de conception et de mise en œuvre qui garantissent la propriété de respect des contraintes de temps, par exemple un système doit réagir dans les limites définies par l'utilisateur tels que les délais et la périodicité. Un délai non respecté dans systèmes temps-réel critique est catastrophique, comme par exemple dans les systèmes automobiles. Si un airbag se déclanche tard dans un accident de voiture, même quelques millisecondes trop tard peuvent conduire à des répercussions graves. Dans les systèmes temps-réels non critiques, une perte significative de performance et de QoS peuvent se produire, comme par exemple dans les réseaux de systèmes multimédia. Contribution: Nous fournissons une méthode de conception rigoureuse des systèmes temps-réel. L'implèmentation est générée à partir d'une application logicielle temps-réel et une plate-forme cible, en utilisant les deux modèles suivants: * Un modèle abstrait représentant le comportement de l'application logicielle en temps réel sous forme d' un automate temporisé. Celui-ci décrit des contraintes temporelles définies par l'utilisateur qui sont indépendantes de la plateforme. Ses transitions sont intemporelles et correspondent à l'exécution des différentes instructions de l'application. * Un modèle physique représentant le comportement du logiciel en temps réel s'exécutant sur une plate-forme donnée. Il est obtenu par l'attribution des temps d'exécution aux transitions du modèle abstrait. Une condition nécessaire pour garantir l'implémentabilité dy système est la "time-safety", c'est à dire, toute séquence d'exécution du modèle physique est également une séquence d'exécution du modèle abstrait. "Time-safety" signifie que la plate-forme est assez rapide pour répondre aux exigences de synchronisation de l'application. Comme les temps d'exécution des actions ne sont pas connus avec exactitude, "time-safety" est vérifiée pour les temps d'exécution pire cas es actions en faisant l' hypothèse de la robustesse. La robustesse signifie que la "time-safety" est préservée lorsqu'on augmente la vitesse de la plate-forme d'exécution. Pour des logiciels et plate-forme d'exécution correspondant à un modèle robuste, nous définissons un moteur d'exécution qui coordonne l'exécution du logiciel d'application afin de répondre à ses contraintes temporelles. En outre, en cas de non-robustesse, le moteur d'exécution permet de détecter les violations de contraintes temporelles en arrêtant l'exécution. Nous avons mis en place le moteur d'exécution pour les programmes BIP. Nous avons validé la méthode pour la conception et la mise en œuvre du robot Dala. Nous montrons les avantages obtenus en termes d'utilisation du processeur et l'amélioration de la latence de la réaction. / Context: Real-time systems are systems that are subject to "real-time constraints"— e.g. operational deadlines from event to system response. Often real-time response times are understood to be in the order of milliseconds and sometimes microseconds. Building real-time systems requires the use of design and implementation methodologies that ensure the property of meeting timing constraints e.g. a system has to react within user-defined bounds such as deadlines and periodicity. A missed deadline in hard real-time systems is catastrophic, like for example in automotive systems, for example if an airbag is fined too late in a car accident, even one ms too late leads to serious repercussions. In soft real-time systems it can lead to a significant loss of performance and QoS like for example in networked multimedia systems. Contribution: We provide a rigorous design and implementation method for the implementation of real-time systems. The implementation is generated from a given real-time application software and a target platform by using two models: * An abstract model representing the behavior of real-time software as a timed automaton. The latter describes user-defined platform-independent timing constraints. Its transitions are timeless and correspond to the execution of statements of the real-time software. * A physical model representing the behavior of the real-time software running on a given platform. It is obtained by assigning execution times to the transitions of the abstract model. A necessary condition for implementability is time-safety, that is, any (timed) execution sequence of the physical model is also an execution sequence of the abstract model. Time-safety means that the platform is fast enough to meet the timing requirements. As execution times of actions are not known exactly, time-safety is checked for worst-case execution times of actions by making an assumption of time-robustness: time-safety is preserved when speed of the execution platform increases. For given real-time software and execution platform corresponding to a time-robust model, we define an execution Engine that coordinates the execution of the application software so as to meet its timing constraints. Furthermore, in case of non-robustness, the execution Engine can detect violations of time-safety and stop execution. We have implemented the execution Engine for BIP programs with real-time constraints. We have validated the method for the design and implementation of the Dala rover robot. We show the benefits obtained in terms of CPU utilization and amelioration in the latency of reaction.

Submitted by Milena Rubi (milenarubi@ufscar.br) on 2016-10-25T21:55:38Z No. of bitstreams: 1 FACHINI_Elizeu_2016.pdf: 7355773 bytes, checksum: 57880fc3ade64c5d25c3ec2901d87e9b (MD5) / Approved for entry into archive by Milena Rubi (milenarubi@ufscar.br) on 2016-10-25T21:55:54Z (GMT) No. of bitstreams: 1 FACHINI_Elizeu_2016.pdf: 7355773 bytes, checksum: 57880fc3ade64c5d25c3ec2901d87e9b (MD5) / Approved for entry into archive by Milena Rubi (milenarubi@ufscar.br) on 2016-10-25T21:56:04Z (GMT) No. of bitstreams: 1 FACHINI_Elizeu_2016.pdf: 7355773 bytes, checksum: 57880fc3ade64c5d25c3ec2901d87e9b (MD5) / Made available in DSpace on 2016-10-25T21:56:15Z (GMT). No. of bitstreams: 1 FACHINI_Elizeu_2016.pdf: 7355773 bytes, checksum: 57880fc3ade64c5d25c3ec2901d87e9b (MD5) Previous issue date: 2016-02-24 / Não recebi financiamento / Monitoring is the act of collecting information concerning the characteristics and status of resources of interest. It can be used to the management and allocation of resources, detection and correction of failures and also to the evaluation of performance parameters. To automatically accomplish the monitoring a tool is needed that has functionalities related the acquiring, processing, distributing and presenting of monitoring events. In this work we are interested in a monitoring system to give support to the experimental execution of distributed algorithms, with the objective of correlating the device status with the execution data and, this way, make possible an analysis of cluster resources used by the application. Then, it’s needed a tool with particular characteristics, such as the ability to collect data with a small time period, with low intrusiveness and making the full data available. As was not possible find in the literature a tool with the features required, we developed a new monitoring tool named MSPlus. The features of this tool were evaluated through experiments with the isolated tool and comparing it with other tool. Additionally, we apply the tool in a distribucted system to monitor a distribucted algorithm. / O monitoramento é o ato de coletar informações referentes às características e estado dos recursos de interesse. Ele pode ser utilizado para gerência e alocação de recursos, detec- ção e correção de falhas e também para avaliação de parâmetros de desempenho. Para realizar o monitoramento de modo automático é necessário a utilização de ferramentas, que tem funcionalidades referentes a captação, processamento, distribuição e apresentação dos eventos de monitoramento. Neste trabalho temos interesse em um sistema de monitoramento para dar suporte à execução experimental de algoritmos distribuídos, com o objetivo de relacionar o estado dos dispositivos com os dados da execução e, desta forma, permitir uma análise do uso de recursos do aglomerado pela aplicação. É necessário então uma ferramenta com características particulares como fazer a coleta de informações com pequeno intervalo de tempo, com baixa intrusividade e realizar o armazenamento total dos dados. Como não foi possível encontrar na literatura uma ferramenta com as características desejadas, desenvolvemos uma nova ferramenta de monitoramento chamada MSPlus. As características dessa nova ferramenta foram analisadas através de experimentos de forma isolada e em comparação a outra ferramenta. Adicionalmente, aplicamos a ferramenta em um sistema distribuído monitorando um algoritmo distribuído.

Submitted by Milena Rubi (milenarubi@ufscar.br) on 2017-06-01T17:22:55Z No. of bitstreams: 1 BARBIERI_Rodrigo_2016.pdf: 14770872 bytes, checksum: 86ee1d6f53ed262fa0977a741b0d1d78 (MD5) / Approved for entry into archive by Milena Rubi (milenarubi@ufscar.br) on 2017-06-01T17:23:03Z (GMT) No. of bitstreams: 1 BARBIERI_Rodrigo_2016.pdf: 14770872 bytes, checksum: 86ee1d6f53ed262fa0977a741b0d1d78 (MD5) / Approved for entry into archive by Milena Rubi (milenarubi@ufscar.br) on 2017-06-01T17:23:08Z (GMT) No. of bitstreams: 1 BARBIERI_Rodrigo_2016.pdf: 14770872 bytes, checksum: 86ee1d6f53ed262fa0977a741b0d1d78 (MD5) / Made available in DSpace on 2017-06-01T17:23:13Z (GMT). No. of bitstreams: 1 BARBIERI_Rodrigo_2016.pdf: 14770872 bytes, checksum: 86ee1d6f53ed262fa0977a741b0d1d78 (MD5) Previous issue date: 2016-08-04 / Não recebi financiamento / Due to the widespread adoption of distributed systems when building applications, demand for reliability and availability has increased. These properties can be achieved through replication techniques using algorithms that must be capable of tolerating faults. Certain faults such as arbitrary faults, however, may be more difficult to tolerate, resulting in more complex and resource intensive algorithms that end up being not very practical to use. Using an existing benign fault-tolerant middleware based on Paxos, we propose and experiment with the usage of consistency validation techniques and a distributed validation mechanism to harden it, thus allowing any application built on top of this hardened middleware to tolerate non-malicious arbitrary faults. / Devido a crescente adoção de sistemas distribuídos ao se desenvolver aplicações, a demanda por confiabilidade e disponibilidade tem aumentado. Essas propriedades podem ser alcançadas através de técnicas de replicação que utilizam algoritmos capazes de tolerar falhas. Alguns tipos de falhas como falhas arbitrárias, porém, podem ser mais difíceis de tolerar, resultando em algoritmos mais complexos e custosos que acabam não sendo tão viáveis de serem usados. Utilizando um middleware tolerante a falhas benignas já existente baseado em Paxos, nós propomos e experimentamos o uso de técnicas de validação de consistência e um mecanismo de validação distribuída para fortalecê-lo, permitindo então que qualquer aplicação desenvolvida em cima deste middleware fortalecido tolere falhas arbitrárias não-maliciosas.

Esta tese propõe um método denominado PM-MDA para o desenvolvimento de Modelos de Plataforma (Platform Model - PM) no contexto da abordagem Model Driven Architecture (MDA). O método PM-MDA tem como foco o desenvolvimento de projetos de Software embarcado baseados em Sistemas Operacionais em Tempo Real (Real-Time Operating System - RTOS). Adicionalmente, este estudo define um perfil UML 2.0 para modelagem da aplicação e plataforma de software embarcado denominado Profile for modeling Application and Platform of Embedded Software (PROAPES) que é usado no método PM-MDA. Tal perfil define um conjunto de estereótipos para descrever genericamente Modelos de Plataforma e Modelos Independentes de Plataforma (Platform Independent Model - PIM). Além disso, são definidas extensões desse perfil, tal como o perfil PROAPESX que permite a modelagem de PMs para versões do RTOS X Real-Time Kernel e hardware associados. Além disso, o perfil PROAPES possibilita vincular um PIM a um PM, permitindo que esses modelos sejam inseridos como atributos de entrada em uma Transformação de Modelos. No contexto da MDA, esse perfil constitui-se em um metamodelo de plataforma (um metamodelo de uma família de plataformas similares) para a construção de modelos de plataforma. Desse modo, um PM é usado como parte fundamental para o desenvolvimento de software embarcado na abordagem MDA, fornecendo meios de obter independência de plataforma. Em abordagens atuais de MDA, as transformações de modelos empregam implicitamente os modelos de plataforma. Como os interesses referentes à plataforma não são separados dos interesses referentes às transformações de modelos, para cada plataforma requerida deve existir uma ou mais transformações de modelos correspondentes que são configuradas especificamente para aquela plataforma. O resultado são processos de transformações de modelos difíceis de serem automatizados. No domínio de sistemas embarcados, o uso de MDA é ainda mais importante devido à heterogeneidade de plataformas e à complexidade destes sistemas. O método PM-MDA, que faz uso do perfil PROAPES, visa sistematizar o processo de criação e disponibilização de modelos de plataforma separados do processo de transformação de modelos, possibilitando a geração de processos de transformações de modelos eficientes e adaptáveis. / This thesis proposes a method called PM-MDA for the development of Platform Models in the context of Model Driven Architecture (MDA). The PM-MDA method focuses on the development of embedded software projects based on Real-Time Operating Systems (RTOS). Additionally, this study defines a UML 2.0 Profile for Modeling Application and Platform of Embedded Software (PROAPES), which is used in the PM-MDA method. Such profile defines a set of stereotypes to generically describe Platform Models (PMs) and Platform Independent Models (PIMs). Further, extensions are defined in this profile, e.g. the PROAPESX profile, allowing the modeling of PMs into versions of the X RTOS Real-Time Kernel and associated hardware. In its turn, the PROAPES profile enables the link of a PIM to a PM, allowing these models to be entered as input attributes in a Model Transformation. In the context of MDA, this profile is a platform metamodel for building PMs, i.e., a metamodel of a family of similar platforms. In this way, a PM is used as a fundamental part in the development of embedded software in the MDA approach by providing means of obtaining platform independence. In current MDA approaches, model transformations implicitly employ PMs. As the concerns regarding the platform are not separated from the concerns related to model transformations, for each required platform there must be one or more corresponding model transformations that are configured specifically for that platform. This results in model transformation processes that are expensive and difficult to be automated. In some application domains such as embedded systems, the use of MDA is more motivating because of the heterogeneity of platforms and the complexity of these systems. The PM-MDA method, which makes use of the PROAPES profile, aims to systematize the process of creating and providing platform models separated from the model transformation process, enabling the generation of efficient and adaptable model transformations.