Search

Lower-end IoT devices typically have strict cost constraints that rule out usual security mechanisms available in general-purpose computers or higher-end devices. To secure low-end devices, various low-cost security architectures have been proposed for remote verification of their software state via integrity proofs. These proofs vary in terms of expressiveness, with simpler ones confirming correct binary presence, while more expressive ones support verification of arbitrary code execution. This article provides a holistic and systematic treatment of this family of architectures. It also compares (qualitatively and quantitatively) the types of software integrity proofs, respective architectural support, and associated costs. Finally, we outline some research directions and emerging challenges.

The rise in IoT-driven distributed data analytics, coupled with increasing privacy concerns, has led to a demand for effective privacy-preserving and federated data collection/model training mechanisms. In response, approaches such as Federated Learning (FL) and Local Differential Privacy (LDP) have been proposed and attracted much attention over the past few years. However, they still share the common limitation of being vulnerable to poisoning attacks wherein adversaries compromising edge devices feed forged (a.k.a. poisoned) data to aggregation back-ends, undermining the integrity of FL/LDP results. In this work, we propose a system-level approach to remedy this issue based on a novel security notion of Proofs of Stateful Execution (PoSX) for IoT/embedded devices' software. To realize the PoSX concept, we design SLAPP: a System-Level Approach for Poisoning Prevention. SLAPP leverages commodity security features of embedded devices - in particular ARM TrustZoneM security extensions - to verifiably bind raw sensed data to their correct usage as part of FL/LDP edge device routines. As a consequence, it offers robust security guarantees against poisoning. Our evaluation, based on real-world prototypes featuring multiple cryptographic primitives and data collection schemes, showcases SLAPP's security and low overhead.

Cookies provide a state management mechanism for the web and are often used for authentication, storing a user's session ID, and replacing their credentials in subsequent requests. These ``session cookies'' are valuable targets of attacks such as Session Hijacking and Fixation that attempt to steal them and gain unauthorized access to user accounts. Multiple controls such as the Secure and HttpOnly cookie attributes restrict cookie accessibility, effectively mitigating attacks from the network or malicious websites, but often ignoring untrusted extensions within the user's browser. Extensions are third-party HTML/JavaScript add-ons with access to several privileged APIs and can run on multiple websites at once. Unfortunately, this can provide malicious/compromised extensions with unrestricted access to session cookies. In this work, we first conduct a study assessing the prevalence of extensions with these ``risky'' APIs (i.e., those enabling cookie modification and theft) and find that they are currently used by hundreds of millions of users. Motivated by this, we propose browser controls based on two new cookie attributes that protect cookies from malicious extensions: BrowserOnly and Tracked. The BrowserOnly attribute prevents accessing cookies from extensions altogether. While effective, not all cookies can be inaccessible. Cookies with the Tracked attribute remain accessible, are tied to a single browser, and record any modifications made by extensions. Thus, stolen Tracked cookies become unusable outside their original browser and servers can verify any modifications. To demonstrate these features' practicality, we implement CREAM (Cookie Restrictions for Extension Abuse Mitigation): a modified version of Chromium realizing these controls. Our evaluation indicates that CREAM controls effectively protect cookies from malicious extensions while incurring small run-time overheads.

The wide adoption of IoT gadgets and Cyber-Physical Systems (CPS) makes embedded devices increasingly important. While some of these devices perform mission-critical tasks, they are usually implemented using Micro-Controller Units (MCUs) that lack security mechanisms on par with those available to general-purpose computers, making them more susceptible to remote exploits that could corrupt their software integrity. Motivated by this problem, prior work has proposed techniques to remotely assess the trustworthiness of embedded MCU software. Among them, Control Flow Attestation (CFA) enables remote detection of runtime abuses that illegally modify the program's control flow during execution. Despite these advances, current CFA methods share a fundamental limitation: they preclude interrupts during the execution of the software operation being attested. Simply put, existing CFA techniques are insecure unless interrupts are disabled on the MCU. On the other hand, we argue that the lack of interruptability can obscure CFA usefulness, as most embedded applications depend on interrupts to process asynchronous events in real-time. To address this limitation, we propose Interrupt-Safe Control Flow Attestation (ISC-FLAT): a CFA technique that is compatible with existing MCUs and enables interrupt handling without compromising the authenticity of CFA reports. Similar to other CFA techniques that do not require customized hardware modifications, ISC-FLAT leverages a Trusted Execution Environment (TEE) (in particular, our prototype is built on ARM TrustZone-M) to securely generate unforgeable CFA reports without precluding applications from processing interrupts. We implement a fully functional ISC-FLAT prototype on the ARM Cortex-M33 MCU and demonstrate that it incurs minimal runtime overhead when compared to existing TEE-based CFA methods that do not support interrupts., Comment: Article to appear in RTAS '23 Proceedings of the 29th IEEE Real-Time and Embedded Technology and Applications Symposium

Low-end embedded devices are increasingly used in various smart applications and spaces. They are implemented under strict cost and energy budgets, using microcontroller units (MCUs) that lack security features available in general-purpose processors. In this context, Remote Attestation (RA) was proposed as an inexpensive security service to enable a verifier (Vrf) to remotely detect illegal modifications to a software binary installed on a low-end prover MCU (Prv). Since attacks that hijack the software's control flow can evade RA, Control Flow Attestation (CFA) augments RA with information about the exact order in which instructions in the binary are executed, enabling detection of control flow attacks. We observe that current CFA architectures can not guarantee that Vrf ever receives control flow reports in case of attacks. In turn, while they support exploit detection, they provide no means to pinpoint the exploit origin. Furthermore, existing CFA requires either binary instrumentation, incurring significant runtime overhead and code size increase, or relatively expensive hardware support, such as hash engines. In addition, current techniques are neither continuous (only meant to attest self-contained operations) nor active (offer no secure means to remotely remediate detected compromises). To jointly address these challenges, we propose ACFA: a hybrid (hardware/software) architecture for Active CFA. ACFA enables continuous monitoring of all control flow transfers in the MCU and does not require binary instrumentation. It also leverages the recently proposed concept of Active Roots-of-Trust to enable secure auditing of vulnerability sources and guaranteed remediation when a compromise is detected. We provide an open-source reference implementation of ACFA on top of a commodity low-end MCU (TI MSP430) and evaluate it to demonstrate its security and cost-effectiveness., Comment: In 29th USENIX Security Symposium (USENIX Security 23), 2023

Micro-controller units (MCUs) implement the de facto interface between the physical and digital worlds. As a consequence, they appear in a variety of sensing/actuation applications, from smart personal spaces to complex industrial control systems and safety-critical medical equipment. While many of these devices perform safety- and time-critical tasks, they often lack support for security features compatible with their importance to overall system functions. This lack of architectural support leaves them vulnerable to run-time attacks that can remotely alter their intended behavior, with potentially catastrophic consequences. In particular, we note that MCU software often includes untrusted third-party libraries (some of them closed-source) that are blindly used within MCU programs, without proper isolation from the rest of the system. In turn, a single vulnerability (or intentional backdoor) in one such third-party software can often compromise the entire MCU software state. In this paper, we tackle this problem by proposing, demonstrating security, and formally verifying the implementation of UCCA: an Untrusted Code Compartment Architecture. UCCA provides flexible hardware-enforced isolation of untrusted code sections (e.g., third-party software modules) in resource-constrained and time-critical MCUs. To demonstrate UCCA's practicality, we implement an open-source version of the design on a real resource-constrained MCU: the well-known TI MSP430. Our evaluation shows that UCCA incurs little overhead and is affordable even to lowest-end MCUs, requiring significantly less overhead and assumptions than prior related work.

Intermittently powered devices rely on opportunistic energy-harvesting to function, leading to recurrent power interruptions. This paper introduces DiCA, a proposal for a hardware/software co-design to create differential check-points in intermittent devices. DiCA leverages an affordable hardware module that simplifies the check-pointing process, reducing the check-point generation time and energy consumption. This hardware module continuously monitors volatile memory, efficiently tracking modifications and determining optimal check-point times. To minimize energy waste, the module dynamically estimates the energy required to create and store the check-point based on tracked memory modifications, triggering the check-pointing routine optimally via a nonmaskable interrupt. Experimental results show the cost-effectiveness and energy efficiency of DiCA, enabling extended application activity cycles in intermittently powered embedded devices., Comment: 8 pages and 7 figures. To be published at IEEE/ACM International Conference on Computer-Aided Design (ICCAD) 2023

Widespread adoption and growing popularity of embedded/IoT/CPS devices make them attractive attack targets. On low-to-mid-range devices, security features are typically few or none due to various constraints. Such devices are thus subject to malware-based compromise. One popular defensive measure is Remote Attestation (RA) which allows a trusted entity to determine the current software integrity of an untrusted remote device. For higher-end devices, RA is achievable via secure hardware components. For low-end (bare metal) devices, minimalistic hybrid (hardware/software) RA is effective, which incurs some hardware modifications. That leaves certain mid-range devices (e.g., ARM Cortex-A family) equipped with standard hardware components, e.g., a memory management unit (MMU) and perhaps a secure boot facility. In this space, seL4 (a verified microkernel with guaranteed process isolation) is a promising platform for attaining RA. HYDRA made a first step towards this, albeit without achieving any verifiability or provable guarantees. This paper picks up where HYDRA left off by constructing a PARseL architecture, that separates all user-dependent components from the TCB. This leads to much stronger isolation guarantees, based on seL4 alone, and facilitates formal verification. In PARseL, We use formal verification to obtain several security properties for the isolated RA TCB, including: memory safety, functional correctness, and secret independence. We implement PARseL in F* and specify/prove expected properties using Hoare logic. Next, we automatically translate the F* implementation to C using KaRaMeL, which preserves verified properties of PARseL C implementation (atop seL4). Finally, we instantiate and evaluate PARseL on a commodity platform -- a SabreLite embedded device., Comment: 8 pages and 8 figures. To be published at IEEE/ACM International Conference on Computer-Aided Design (ICCAD) 2023

Modern society is increasingly surrounded by, and is growing accustomed to, a wide range of Cyber-Physical Systems (CPS), Internet-of-Things (IoT), and smart devices. They often perform safety-critical functions, e.g., personal medical devices, automotive CPS as well as industrial and residential automation (such as sensor-alarm combinations). On the lower end of the scale, these devices are small, cheap, and specialized sensors and/or actuators. They tend to host small CPUs, have small amounts of memory, and run simple software. If such devices are left unprotected, consequences of forged sensor readings or ignored actuation commands can be catastrophic, particularly, in safety-critical settings. This prompts the following questions: (1) How to trust data produced, or guarantee that actions will be performed, by a simple remote embedded device?, (2) How to bind actions and results to the execution of expected software? and, (3) Can (1) and (2) be attained even if all software on a device can be modified and/or compromised (e.g., by malware) at any given time?This dissertation presents a set of hardware/software co-designs for obtaining several security services – namely remote attestation, TOCTOU-avoidance, proofs of execution, and root of trust availability – which can be used to assure the integrity and availability of software and its execution, even on some of the most resource-constrained micro-controllers. We realize these services with four formally verified and publicly available architectures (VRASED, RATA, APEX, and TAROT) and show how they have been securely implemented atop the TI MSP430 micro-controller at a relatively low cost.

Modern society is increasingly surrounded by, and is growing accustomed to, a wide range of Cyber-Physical Systems (CPS), Internet-of-Things (IoT), and smart devices. They often perform safety-critical functions, e.g., personal medical devices, automotive CPS as well as industrial and residential automation (such as sensor-alarm combinations). On the lower end of the scale, these devices are small, cheap, and specialized sensors and/or actuators. They tend to host small CPUs, have small amounts of memory, and run simple software. If such devices are left unprotected, consequences of forged sensor readings or ignored actuation commands can be catastrophic, particularly, in safety-critical settings. This prompts the following questions: (1) How to trust data produced, or guarantee that actions will be performed, by a simple remote embedded device?, (2) How to bind actions and results to the execution of expected software? and, (3) Can (1) and (2) be attained even if all software on a device can be modified and/or compromised (e.g., by malware) at any given time?This dissertation presents a set of hardware/software co-designs for obtaining several security services – namely remote attestation, TOCTOU-avoidance, proofs of execution, and root of trust availability – which can be used to assure the integrity and availability of software and its execution, even on some of the most resource-constrained micro-controllers. We realize these services with four formally verified and publicly available architectures (VRASED, RATA, APEX, and TAROT) and show how they have been securely implemented atop the TI MSP430 micro-controller at a relatively low cost.

Modern society is increasingly surrounded by, and is growing accustomed to, a wide range of Cyber-Physical Systems (CPS), Internet-of-Things (IoT), and smart devices. They often perform safety-critical functions, e.g., personal medical devices, automotive CPS as well as industrial and residential automation (such as sensor-alarm combinations). On the lower end of the scale, these devices are small, cheap, and specialized sensors and/or actuators. They tend to host small CPUs, have small amounts of memory, and run simple software. If such devices are left unprotected, consequences of forged sensor readings or ignored actuation commands can be catastrophic, particularly, in safety-critical settings. This prompts the following questions: (1) How to trust data produced, or guarantee that actions will be performed, by a simple remote embedded device?, (2) How to bind actions and results to the execution of expected software? and, (3) Can (1) and (2) be attained even if all software on a device can be modified and/or compromised (e.g., by malware) at any given time?This dissertation presents a set of hardware/software co-designs for obtaining several security services – namely remote attestation, TOCTOU-avoidance, proofs of execution, and root of trust availability – which can be used to assure the integrity and availability of software and its execution, even on some of the most resource-constrained micro-controllers. We realize these services with four formally verified and publicly available architectures (VRASED, RATA, APEX, and TAROT) and show how they have been securely implemented atop the TI MSP430 micro-controller at a relatively low cost.

Guaranteeing runtime integrity of embedded system software is an open problem. Trade-offs between security and other priorities (e.g., cost or performance) are inherent, and resolving them is both challenging and important. The proliferation of runtime attacks that introduce malicious code (e.g., by injection) into embedded devices has prompted a range of mitigation techniques. One popular approach is Remote Attestation (RA), whereby a trusted entity (verifier) checks the current software state of an untrusted remote device (prover). RA yields a timely authenticated snapshot of prover state that verifier uses to decide whether an attack occurred. Current RA schemes require verifier to explicitly initiate RA, based on some unclear criteria. Thus, in case of prover's compromise, verifier only learns about it late, upon the next RA instance. While sufficient for compromise detection, some applications would benefit from a more proactive, prevention-based approach. To this end, we construct CASU: Compromise Avoidance via Secure Updates. CASU is an inexpensive hardware/software co-design enforcing: (i) runtime software immutability, thus precluding any illegal software modification, and (ii) authenticated updates as the sole means of modifying software. In CASU, a successful RA instance serves as a proof of successful update, and continuous subsequent software integrity is implicit, due to the runtime immutability guarantee. This obviates the need for RA in between software updates and leads to unobtrusive integrity assurance with guarantees akin to those of prior RA techniques, with better overall performance., Comment: 10 pages, 9 figures, To appear at ICCAD 2022

There are many well-known techniques to secure sensed data in IoT/CPS systems, e.g., by authenticating communication end-points, encrypting data before transmission, and obfuscating traffic patterns. Such techniques protect sensed data from external adversaries while assuming that the sensing device itself is secure. Meanwhile, both the scale and frequency of IoT-focused attacks are growing. This prompts a natural question: how to protect sensed data even if all software on the device is compromised? Ideally, in order to achieve this, sensed data must be protected from its genesis, i.e., from the time when a physical analog quantity is converted into its digital counterpart and becomes accessible to software. We refer to this property as PfB: Privacy-from-Birth. In this work, we formalize PfB and design Verified Remote Sensing Authorization (VERSA) -- a provably secure and formally verified architecture guaranteeing that only correct execution of expected and explicitly authorized software can access and manipulate sensing interfaces, specifically, General Purpose Input/Output (GPIO), which is the usual boundary between analog and digital worlds on IoT devices. This guarantee is obtained with minimal hardware support and holds even if all device software is compromised. VERSA ensures that malware can neither gain access to sensed data on the GPIO-mapped memory nor obtain any trace thereof. VERSA is formally verified and its open-sourced implementation targets resource-constrained IoT edge devices, commonly used for sensing. Experimental results show that PfB is both achievable and affordable for such devices., Comment: 13 pages paper and 4 pages appendix. To be published at 2022 IEEE Symposium on Security and Privacy

Embedded devices are increasingly ubiquitous and their importance is hard to overestimate. While they often support safety-critical functions (e.g., in medical devices and sensor-alarm combinations), they are usually implemented under strict cost/energy budgets, using low-end microcontroller units (MCUs) that lack sophisticated security mechanisms. Motivated by this issue, recent work developed architectures capable of generating Proofs of Execution (PoX) for the correct/expected software in potentially compromised low-end MCUs. In practice, this capability can be leveraged to provide "integrity from birth" to sensor data, by binding the sensed results/outputs to an unforgeable cryptographic proof of execution of the expected sensing process. Despite this significant progress, current PoX schemes for low-end MCUs ignore the real-time needs of many applications. In particular, security of current PoX schemes precludes any interrupts during the execution being proved. We argue that lack of asynchronous capabilities (i.e., interrupts within PoX) can obscure PoX usefulness, as several applications require processing real-time and asynchronous events. To bridge this gap, we propose, implement, and evaluate an Architecture for Secure Asynchronous Processing in PoX (ASAP). ASAP is secure under full software compromise, enables asynchronous PoX, and incurs less hardware overhead than prior work., Comment: 2022 59th ACM/IEEE Design Automation Conference (DAC)

Using an integrative approach (morphology of the adult and larvae, bioacoustics, osteology, karyotype, and molecular data), we described a new tetraploid species of Odontophrynus to the Mantiqueira mountain range, in southeastern Brazil. The data suggest that Odontophrynus toledoi sp. nov., O. juquinha and Odontophrynus sp. (aff. juquinha) comprise a clade with specimens distributed along three distinct mountain ranges in Brazil: Mantiqueira (O. toledoi sp. nov.) and Espinhaço (O. juquinha) mountains, both in southeastern Brazil, and Diamantina Plateau (O. aff. juquinha), in northeastern Brazil. The new species is morphologically similar and closely related to O. juquinha, but is distinguished in morphology (both adult and larval), karyotype (O. toledoi sp. nov. is tetraploid and O. juquinha is diploid), and corroborated by phylogenetic inferences. We also show that these species do not exchange haplotypes in the 16s gene. Furthermore, although the raw acoustic parameters of Odontophrynus toledoi sp. nov. and O. juquinha overlap at the limits of their ranges, we found a clear difference in the acoustic space structure.

Secondary wastewaters from the dairy industry may cause eutrophication of water bodies when not properly treated, mainly because they contain nutrients such as phosphorus and nitrogen. Tertiary treatment using microalgae could be an adequate solution for Minas Gerais State, the largest Brazilian milk producer, contributing to the reduction of environmental impacts, as well as providing biomass for oil extraction, and obtaining active compounds and inputs (including proteins) for animal feeding. In this work, dilutions (with distilled water) of the secondary wastewater from the dairy industry were evaluated to cultivate Chlorella vulgaris in a bench-scale tubular photobioreactor. Theresults indicate the feasibility of using wastewater from the dairy industry, after secondary treatment, to cultivate microalgae, showing cell growth like that obtained in control cultures (Bold basal medium). The secondary wastewater without dilution (100% wastewater) provided the best condition for biomass production. The biomass obtained in wastewater showed no differences from the biomass obtained in the Bold basal medium (control) in terms of protein, lipid content, or fatty acid profile., Efluentes secundários da indústria de laticínios, quando não tratados adequadamente, podem provocar eutrofização de corpos d’água, principalmente por conter nutrientes como fósforo e nitrogênio. O tratamento terciário empregando microalgas poderia ser uma solução adequada para o estado de Minas Gerais, maior produtor brasileiro de leite, contribuindo na redução de impactos ambientais, bem como fornecendo biomassa para extração de óleos e obtenção de compostos ativos e insumos (incluindo proteínas) para nutrição animal. Neste trabalho, avaliaram-se diluições (com água destilada) do efluente secundário da indústria de laticínios para cultivo de Chlorella vulgaris em fotobiorreator tubular em escala de bancada. Os resultados encontrados indicam a viabilidade do uso de efluente de indústria de laticínios, pós tratamento secundário, para o cultivo de microalgas, apresentando crescimento similar àquele obtido em cultivos padrões (meio basal Bold). O efluente secundário sem diluição (100% efluente) foi o que apresentou melhor desempenho na produção de biomassa. Além disso, a biomassa obtida em efluentes não apresentou diferenças em relação àquela obtida em meio basal Bold (controle), no que se refere a teores de proteínas, lipídios ou perfil de ácidos graxos.

Secondary wastewaters from the dairy industry may cause eutrophication of water bodies when not properly treated, mainly because they contain nutrients such as phosphorus and nitrogen. Tertiary treatment using microalgae could be an adequate solution for Minas Gerais State, the largest Brazilian milk producer, contributing to the reduction of environmental impacts, as well as providing biomass for oil extraction, and obtaining active compounds and inputs (including proteins) for animal feeding. In this work, dilutions (with distilled water) of the secondary wastewater from the dairy industry were evaluated to cultivate Chlorella vulgaris in a bench-scale tubular photobioreactor. Theresults indicate the feasibility of using wastewater from the dairy industry, after secondary treatment, to cultivate microalgae, showing cell growth like that obtained in control cultures (Bold basal medium). The secondary wastewater without dilution (100% wastewater) provided the best condition for biomass production. The biomass obtained in wastewater showed no differences from the biomass obtained in the Bold basal medium (control) in terms of protein, lipid content, or fatty acid profile., Efluentes secundários da indústria de laticínios, quando não tratados adequadamente, podem provocar eutrofização de corpos d’água, principalmente por conter nutrientes como fósforo e nitrogênio. O tratamento terciário empregando microalgas poderia ser uma solução adequada para o estado de Minas Gerais, maior produtor brasileiro de leite, contribuindo na redução de impactos ambientais, bem como fornecendo biomassa para extração de óleos e obtenção de compostos ativos e insumos (incluindo proteínas) para nutrição animal. Neste trabalho, avaliaram-se diluições (com água destilada) do efluente secundário da indústria de laticínios para cultivo de Chlorella vulgaris em fotobiorreator tubular em escala de bancada. Os resultados encontrados indicam a viabilidade do uso de efluente de indústria de laticínios, pós tratamento secundário, para o cultivo de microalgas, apresentando crescimento similar àquele obtido em cultivos padrões (meio basal Bold). O efluente secundário sem diluição (100% efluente) foi o que apresentou melhor desempenho na produção de biomassa. Além disso, a biomassa obtida em efluentes não apresentou diferenças em relação àquela obtida em meio basal Bold (controle), no que se refere a teores de proteínas, lipídios ou perfil de ácidos graxos.

Efluentes secundários da indústria de laticínios, quando não tratados adequadamente, podem provocar eutrofização de corpos d’água, principalmente por conter nutrientes como fósforo e nitrogênio. O tratamento terciário empregando microalgas poderia ser uma solução adequada para o estado de Minas Gerais, maior produtor brasileiro de leite, contribuindo na redução de impactos ambientais, bem como fornecendo biomassa para extração de óleos e obtenção de compostos ativos e insumos (incluindo proteínas) para nutrição animal. Neste trabalho, avaliaram-se diluições (com água destilada) do efluente secundário da indústria de laticínios para cultivo de Chlorella vulgaris em fotobiorreator tubular em escala de bancada. Os resultados encontrados indicam a viabilidade do uso de efluente de indústria de laticínios, pós tratamento secundário, para o cultivo de microalgas, apresentando crescimento similar àquele obtido em cultivos padrões (meio basal Bold). O efluente secundário sem diluição (100% efluente) foi o que apresentou melhor desempenho na produção de biomassa. Além disso, a biomassa obtida em efluentes não apresentou diferenças em relação àquela obtida em meio basal Bold (controle), no que se refere a teores de proteínas, lipídios ou perfil de ácidos graxos., Secondary wastewaters from the dairy industry may cause eutrophication of water bodies when not properly treated, mainly because they contain nutrients such as phosphorus and nitrogen. Tertiary treatment using microalgae could be an adequate solution for Minas Gerais State, the largest Brazilian milk producer, contributing to the reduction of environmental impacts, as well as providing biomass for oil extraction, and obtaining active compounds and inputs (including proteins) for animal feeding. In this work, dilutions (with distilled water) of the secondary wastewater from the dairy industry were evaluated to cultivate Chlorella vulgaris in a bench-scale tubular photobioreactor. Theresults indicate the feasibility of using wastewater from the dairy industry, after secondary treatment, to cultivate microalgae, showing cell growth like that obtained in control cultures (Bold basal medium). The secondary wastewater without dilution (100% wastewater) provided the best condition for biomass production. The biomass obtained in wastewater showed no differences from the biomass obtained in the Bold basal medium (control) in terms of protein, lipid content, or fatty acid profile.

Efluentes secundários da indústria de laticínios, quando não tratados adequadamente, podem provocar eutrofização de corpos d’água, principalmente por conter nutrientes como fósforo e nitrogênio. O tratamento terciário empregando microalgas poderia ser uma solução adequada para o estado de Minas Gerais, maior produtor brasileiro de leite, contribuindo na redução de impactos ambientais, bem como fornecendo biomassa para extração de óleos e obtenção de compostos ativos e insumos (incluindo proteínas) para nutrição animal. Neste trabalho, avaliaram-se diluições (com água destilada) do efluente secundário da indústria de laticínios para cultivo de Chlorella vulgaris em fotobiorreator tubular em escala de bancada. Os resultados encontrados indicam a viabilidade do uso de efluente de indústria de laticínios, pós tratamento secundário, para o cultivo de microalgas, apresentando crescimento similar àquele obtido em cultivos padrões (meio basal Bold). O efluente secundário sem diluição (100% efluente) foi o que apresentou melhor desempenho na produção de biomassa. Além disso, a biomassa obtida em efluentes não apresentou diferenças em relação àquela obtida em meio basal Bold (controle), no que se refere a teores de proteínas, lipídios ou perfil de ácidos graxos., Secondary wastewaters from the dairy industry may cause eutrophication of water bodies when not properly treated, mainly because they contain nutrients such as phosphorus and nitrogen. Tertiary treatment using microalgae could be an adequate solution for Minas Gerais State, the largest Brazilian milk producer, contributing to the reduction of environmental impacts, as well as providing biomass for oil extraction, and obtaining active compounds and inputs (including proteins) for animal feeding. In this work, dilutions (with distilled water) of the secondary wastewater from the dairy industry were evaluated to cultivate Chlorella vulgaris in a bench-scale tubular photobioreactor. Theresults indicate the feasibility of using wastewater from the dairy industry, after secondary treatment, to cultivate microalgae, showing cell growth like that obtained in control cultures (Bold basal medium). The secondary wastewater without dilution (100% wastewater) provided the best condition for biomass production. The biomass obtained in wastewater showed no differences from the biomass obtained in the Bold basal medium (control) in terms of protein, lipid content, or fatty acid profile.

Secondary wastewaters from the dairy industry may cause eutrophication of water bodies when not properly treated, mainly because they contain nutrients such as phosphorus and nitrogen. Tertiary treatment using microalgae could be an adequate solution for Minas Gerais State, the largest Brazilian milk producer, contributing to the reduction of environmental impacts, as well as providing biomass for oil extraction, and obtaining active compounds and inputs (including proteins) for animal feeding. In this work, dilutions (with distilled water) of the secondary wastewater from the dairy industry were evaluated to cultivate Chlorella vulgaris in a bench-scale tubular photobioreactor. Theresults indicate the feasibility of using wastewater from the dairy industry, after secondary treatment, to cultivate microalgae, showing cell growth like that obtained in control cultures (Bold basal medium). The secondary wastewater without dilution (100% wastewater) provided the best condition for biomass production. The biomass obtained in wastewater showed no differences from the biomass obtained in the Bold basal medium (control) in terms of protein, lipid content, or fatty acid profile., Efluentes secundários da indústria de laticínios, quando não tratados adequadamente, podem provocar eutrofização de corpos d’água, principalmente por conter nutrientes como fósforo e nitrogênio. O tratamento terciário empregando microalgas poderia ser uma solução adequada para o estado de Minas Gerais, maior produtor brasileiro de leite, contribuindo na redução de impactos ambientais, bem como fornecendo biomassa para extração de óleos e obtenção de compostos ativos e insumos (incluindo proteínas) para nutrição animal. Neste trabalho, avaliaram-se diluições (com água destilada) do efluente secundário da indústria de laticínios para cultivo de Chlorella vulgaris em fotobiorreator tubular em escala de bancada. Os resultados encontrados indicam a viabilidade do uso de efluente de indústria de laticínios, pós tratamento secundário, para o cultivo de microalgas, apresentando crescimento similar àquele obtido em cultivos padrões (meio basal Bold). O efluente secundário sem diluição (100% efluente) foi o que apresentou melhor desempenho na produção de biomassa. Além disso, a biomassa obtida em efluentes não apresentou diferenças em relação àquela obtida em meio basal Bold (controle), no que se refere a teores de proteínas, lipídios ou perfil de ácidos graxos.

Secondary wastewaters from the dairy industry may cause eutrophication of water bodies when not properly treated, mainly because they contain nutrients such as phosphorus and nitrogen. Tertiary treatment using microalgae could be an adequate solution for Minas Gerais State, the largest Brazilian milk producer, contributing to the reduction of environmental impacts, as well as providing biomass for oil extraction, and obtaining active compounds and inputs (including proteins) for animal feeding. In this work, dilutions (with distilled water) of the secondary wastewater from the dairy industry were evaluated to cultivate Chlorella vulgaris in a bench-scale tubular photobioreactor. Theresults indicate the feasibility of using wastewater from the dairy industry, after secondary treatment, to cultivate microalgae, showing cell growth like that obtained in control cultures (Bold basal medium). The secondary wastewater without dilution (100% wastewater) provided the best condition for biomass production. The biomass obtained in wastewater showed no differences from the biomass obtained in the Bold basal medium (control) in terms of protein, lipid content, or fatty acid profile., Efluentes secundários da indústria de laticínios, quando não tratados adequadamente, podem provocar eutrofização de corpos d’água, principalmente por conter nutrientes como fósforo e nitrogênio. O tratamento terciário empregando microalgas poderia ser uma solução adequada para o estado de Minas Gerais, maior produtor brasileiro de leite, contribuindo na redução de impactos ambientais, bem como fornecendo biomassa para extração de óleos e obtenção de compostos ativos e insumos (incluindo proteínas) para nutrição animal. Neste trabalho, avaliaram-se diluições (com água destilada) do efluente secundário da indústria de laticínios para cultivo de Chlorella vulgaris em fotobiorreator tubular em escala de bancada. Os resultados encontrados indicam a viabilidade do uso de efluente de indústria de laticínios, pós tratamento secundário, para o cultivo de microalgas, apresentando crescimento similar àquele obtido em cultivos padrões (meio basal Bold). O efluente secundário sem diluição (100% efluente) foi o que apresentou melhor desempenho na produção de biomassa. Além disso, a biomassa obtida em efluentes não apresentou diferenças em relação àquela obtida em meio basal Bold (controle), no que se refere a teores de proteínas, lipídios ou perfil de ácidos graxos.

Verifying integrity of software execution in low-end micro-controller units (MCUs) is a well-known open problem. The central challenge is how to securely detect software exploits with minimal overhead, since these MCUs are designed for low cost, low energy and small size. Some recent work yielded inexpensive hardware/software co-designs for remotely verifying code and execution integrity. In particular, a means of detecting unauthorized code modifications and control-flow attacks were proposed, referred to as Remote Attestation (RA) and Control-Flow Attestation (CFA), respectively. Despite this progress, detection of data-only attacks remains elusive. Such attacks exploit software vulnerabilities to corrupt intermediate computation results stored in data memory, changing neither the program code nor its control flow. Motivated by lack of any current techniques (for low-end MCUs) that detect these attacks, in this paper we propose, implement and evaluate DIALED, the first Data-Flow Attestation (DFA) technique applicable to the most resource-constrained embedded devices (e.g., TI MSP430). DIALED works in tandem with a companion CFA scheme to detect all (currently known) types of runtime software exploits at fairly low cost., Comment: 6 pages, to be published in DAC 2021

In this paper, we set out to systematically design a minimal active RoT for tiny low-end MCU-s. We begin with the following questions: (1) What functions and hardware support are required to guarantee actions in the presence of malware?, (2) How to implement this efficiently?, and (3) What security benefits stem from such an active RoT architecture? We then design, implement, formally verify, and evaluate GAROTA: Generalized Active Root-Of-Trust Architecture. We believe that GAROTA is the first clean-slate design of an active RoT for low-end MCU-s. We show how GAROTA guarantees that even a fully software-compromised low-end MCU performs a desired action. We demonstrate its practicality by implementing GAROTA in the context of three types of applications where actions are triggered by: sensing hardware, network events and timers. We also formally specify and verify GAROTA functionality and properties.

We propose Remote Attestation with TOCTOU Avoidance (RATA): a provably secure approach to address the RA TOCTOU problem. With RATA, even malware that erases itself before execution of the next RA, can not hide its ephemeral presence. RATA targets hybrid RA architectures (implemented as Hardware/Software co-designs), which are aimed at low-end embedded devices. We present two alternative techniques - RATAa and RATAb - suitable for devices with and without real-time clocks, respectively. Each is shown to be secure and accompanied by a publicly available and formally verified implementation. Our evaluation demonstrates low hardware overhead of both techniques. Compared with current RA architectures - that offer no TOCTOU protection - RATA incurs no extra runtime overhead. In fact, RATA substantially reduces computational costs of RA execution.

The design of tiny trust anchors has received significant attention over the past decade, to secure low-end MCU-s that cannot afford expensive security mechanisms. In particular, hardware/software (hybrid) co-designs offer low hardware cost, while retaining similar security guarantees as (more expensive) hardware-based techniques. Hybrid trust anchors support security services, such as remote attestation, proofs of software update/erasure/reset, proofs of remote software execution, in resource-constrained MCU-s, e.g., MSP430 and AVR AtMega32. Despite these advances, detection of control-flow attacks in low-end MCU-s remains a challenge, since hardware requirements of the cheapest related architectures are often more expensive than the MCU-s themselves. In this work, we tackle this challenge by designing Tiny-CFA - a control-flow attestation (CFA) technique with a single hardware requirement - the ability to generate proofs of remote software execution (PoX). In turn, PoX can be implemented very efficiently and securely in low-end MCU-s. Consequently, our design achieves the lowest hardware overhead of any CFA architecture (i.e., two orders of magnitude cheaper), while relying on a formally verified PoX architecture as its sole hardware requirement. With respect to runtime overhead, Tiny-CFA also achieves better performance than prior CFA techniques based on code instrumentation. We implement and evaluate Tiny-CFA, analyze its security, and demonstrate its practicality using real-world publicly available applications.

Root of Trust Identification (RTI) refers to determining whether a given security service or task is being performed by the particular root of trust (e.g., a TEE) within a specific physical device. Despite its importance, this problem has been mostly overlooked. We formalize the RTI problem and argue that security of RTI protocols is especially challenging due to local adversaries, cuckoo adversaries, and the combination thereof. To cope with this problem we propose a simple and effective protocol based on biometrics. Unlike biometric-based user authentication, our approach is not concerned with verifying user identity, and requires neither pre-enrollment nor persistent storage for biometric templates. Instead, it takes advantage of the difficulty of cloning a biometric in real-time to securely identify the root of trust of a given physical device, by using the biometric as a challenge. Security of the proposed protocol is analyzed in the combined Local and Cuckoo adversarial model. Also, a prototype implementation is used to demonstrate the protocol's feasibility and practicality. We further propose a Proxy RTI protocol, wherein a previously identified RoT assists a remote verifier in identifying new RoTs.

Modern society is increasingly surrounded by, and accustomed to, a wide range of Cyber-Physical Systems (CPS), Internet-of-Things (IoT), and smart devices. They often perform safety-critical functions, e.g., personal medical devices, automotive CPS and industrial automation (smart factories). Some devices are small, cheap and specialized sensors and/or actuators. They tend to run simple software and operate under control of a more sophisticated central control unit. The latter is responsible for the decision-making and orchestrating the entire system. If devices are left unprotected, consequences of forged sensor readings or ignored actuation commands can be catastrophic, particularly, in safety-critical settings. This prompts the following three questions: (1) How to trust data produced by a simple remote embedded device? and (2) How to ascertain that this data was produced via execution of expected software? Furthermore, (3) Is it possible to attain (1) and (2) under the assumption that all software on the remote device could be modified or compromised? In this paper we answer these questions by designing, proving security of, and formally verifying, VAPE: Verified Architecture for Proofs of Execution. To the best of our knowledge, this is the first of its kind result for low-end embedded systems. Our work has a range of applications, especially, to authenticated sensing and trustworthy actuation, which are increasingly relevant in the context of safety-critical systems. VAPE architecture is publicly available and our evaluation demonstrates that it incurs low overhead, affordable even for lowest-end embedded devices, e.g., those based on MSP430 or ARV ATMega processors.

In this work, we take the first step towards formal verification of Remote Attestation (RA) by designing and verifying an architecture called VRASED: Verifiable Remote Attestation for Simple Embedded Devices. VRASED instantiates a hybrid (HW/SW) RA co-design aimed at low-end embedded systems, e.g., simple IoT devices. VRASED provides a level of security comparable to HW-based approaches, while relying on SW to minimize additional HW costs. Since security properties must be jointly guaranteed by HW and SW, verification is a challenging task, which has never been attempted before in the context of RA. We believe that VRASED is the first formally verified RA scheme. To the best of our knowledge, it is also the first formal verification of a HW/SW implementation of any security service. To demonstrate VRASED's practicality and low overhead, we instantiate and evaluate it on a commodity platform (TI MSP430). VRASED's publicly available implementation was deployed on the Basys3 FPGA.

Content-Centric Networking (CCN) is an internetworking paradigm that offers an alternative to today's IP-based Internet Architecture. Instead of focusing on hosts and their locations, CCN emphasizes addressable named content. By decoupling content from its location, CCN allows opportunistic in-network content caching, thus enabling better network utilization, at least for scalable content distribution. However, in order to be considered seriously, CCN must support basic security services, including content authenticity, integrity, confidentiality, authorization and access control. Current approaches rely on content producers to perform authorization and access control. This general approach has several disadvantages. First, consumer privacy vis-a-vis producers is not preserved. Second, identity management and access control impose high computational overhead on producers. Also, unnecessary repeated authentication and access control decisions must be made for each content request. These issues motivate our design of KRB-CCN - a complete authorization and access control system for private CCNs. Inspired by Kerberos in IP-based networks, KRB-CCN involves distinct authentication and authorization authorities. By doing so, KRB-CCN obviates the need for producers to make consumer authentication and access control decisions. KRB-CCN preserves consumer privacy since producers are unaware of consumer identities. Producers are also not required to keep any hard state and only need to perform two symmetric key operations to guarantee that sensitive content is confidentially delivered only to authenticated and authorized consumers. Most importantly, unlike prior designs, KRB-CCN leaves the network (i.e., CCN routers) out of any authorization, access control or confidentiality issues. We describe KRB-CCN design and implementation, analyze its security, and report on its performance.

In this work we propose, implement, and evaluate GRM, a novel mobility model that accounts for the role of group meeting dynamics and regularity in human mobility. Specifically, we show that existing mobility models for humans do not capture the regularity of human group meetings which is present in real mobility traces. Next, we characterize the statistical properties of such group meetings in real mobility traces and design GRM accordingly. We show that GRM maintains the typical pairwise contact properties of real traces, such as contact duration and inter-contact time distributions. In addition, GRM accounts for the role of group mobility, presenting group meetings regularity and social communities' structure. Finally, we evaluate state-of-art social-aware protocols for opportunistic routing using a synthetic contact trace generated by our model. The results show that the behavior of such protocols in our model is similar to their behavior in real mobility traces.

In the next generation cellular networks, device-to-device (D2D) communication is already considered a fundamental feature. A problem of multi-hop D2D networks is on how to define forwarding algorithms that achieve, at the same time, high delivery ratio and low network overhead. In this paper we aim to understand group meetings' properties by looking at their structure and regularity with the final goal of applying such knowledge in the design of a forwarding algorithm for D2D multi-hop networks. We introduce a forwarding protocol, namely GROUPS-NET, which is aware of social group meetings and their evolution over time. Our algorithm is parameter-calibration free and does not require any knowledge about the social network structure of the system. In particular, different from the state of the art algorithms, GROUPS-NET does not need communities detection, which is a complex and expensive task. We validate our algorithm using different publicly available data-sources. In real large scale scenarios, our algorithm achieves approximately the same delivery ratio of the state-of-art solution with up to 40% less network overhead., Comment: arXiv admin note: text overlap with arXiv:1512.04828

IT Outsourcing (ITO) is used widely by Multinational Companies (MNCs) as a sourcing strategy today. ITO relationship between service buyer and provider then becomes a crucial issue in achieving expected objectives. This research sheds light on the influence of organizational culture (OC) of the buyer company on its ITO relationship with the provider. More specifically, the influence that OC can have on four significant dimensions of trust, cooperation, communication and commitment in ITO is studied through a qualitative analysis. IT managers of six MNCs were interviewed which exposed the connection between OC and ITO relationship factors. An open communication culture, speed of adaption to change, receiving innovative solutions, flat or hierarchical structures and responsibility degree appeared as the most visible differences between OCs of MNCs influencing ITO relationships. The results can be used for improving the ITO by considering the influence of OC to gain more benefits from outsourcing., QC 20160126

In the era of mobile computing, understanding human mobility patterns is crucial in order to better design protocols and applications. Many studies focus on different aspects of human mobility such as people's points of interests, routes, traffic, individual mobility patterns, among others. In this work, we propose to look at human mobility through a social perspective, i.e., analyze the impact of social groups in mobility patterns. We use the MIT Reality Mining proximity trace to detect, track and investigate group's evolution throughout time. Our results show that group meetings happen in a periodical fashion and present daily and weekly periodicity. We analyze how groups' dynamics change over day hours and find that group meetings lasting longer are those with less changes in members composition and with members having stronger social bonds with each other. Our findings can be used to propose meeting prediction algorithms, opportunistic routing and information diffusion protocols, taking advantage of those revealed properties.

Globalization has affected the organizations in many aspects such as structure, architecture, internal/external strategies and sourcing management. Outsourcing is one of the recent business strategies used to provide IT needs via external agents. The relationship between the service buyer and provider companies is a constituent playing a significant role in IT outsourcing success or failure. This research has a focus on the influence of organizational culture of buyer companies on the specific factors of trust, cooperation, communication and commitment in their relationship with the IT service provider. Two explorative case studies are done in global companies using ITO which revealed the presence of organizational culture effect. Particularly, being innovative, having open discussion as an organizational culture and looking for extending contracts with providers as a strategy, appeared as the major difference between the two cases organizational culture; which influences the studied factors of ITO relationship in this research.

Globalization has affected the organizations in different aspects such as structure, architecture, internal/external strategies and sourcing management. Outsourcing is one of the recent business strategies used to provide IT needs via external agents. The relationship between the service buyer and provider companies is a constituent playing a significant role in IT outsourcing success or failure. The questions in this research is" what is the role of organizational culture in ITO (IT Outsourcing) relationships?" This research has a focus on the influence of organizational culture of buyer companies on the specific factors of trust, cooperation, communication and commitment in their relationship with the IT service provider. A qualitative approach has been used and six global companies using ITO are selected to have interviews with their relevant managers which revealed the presence of organizational culture effect. Particularly, being innovative, having open discussion as an organizational culture, looking for extending contracts with providers as a strategy in organizational structure and responsibility and roles clarifying after outsourcing, appeared as the major differences between the six companies organizational cultures which influence the focusing aspects of ITO relationships in this research. Additionally there were some external factors found after the analysis phase which were out of the scope of the research theoretical framework such as previous experience of buyer company in outsourcing, IT governance and the value of IT in the buyer company. These extra issues can be linked to the organizational culture of the buyer company and affect their IT outsourcing relationships.

Globalization has affected the organizations in different aspects such as structure, architecture, internal/external strategies and sourcing management. Outsourcing is one of the recent business strategies used to provide IT needs via external agents. The relationship between the service buyer and provider companies is a constituent playing a significant role in IT outsourcing success or failure. The questions in this research is" what is the role of organizational culture in ITO (IT Outsourcing) relationships?" This research has a focus on the influence of organizational culture of buyer companies on the specific factors of trust, cooperation, communication and commitment in their relationship with the IT service provider. A qualitative approach has been used and six global companies using ITO are selected to have interviews with their relevant managers which revealed the presence of organizational culture effect. Particularly, being innovative, having open discussion as an organizational culture, looking for extending contracts with providers as a strategy in organizational structure and responsibility and roles clarifying after outsourcing, appeared as the major differences between the six companies organizational cultures which influence the focusing aspects of ITO relationships in this research. Additionally there were some external factors found after the analysis phase which were out of the scope of the research theoretical framework such as previous experience of buyer company in outsourcing, IT governance and the value of IT in the buyer company. These extra issues can be linked to the organizational culture of the buyer company and affect their IT outsourcing relationships.