10 research outputs found
Cybersecurity in implantable medical devices
Mención Internacional en el título de doctorImplantable Medical Devices (IMDs) are electronic devices implanted within
the body to treat a medical condition, monitor the state or improve the
functioning of some body part, or just to provide the patient with a capability
that he did not possess before [86]. Current examples of IMDs
include pacemakers and defibrillators to monitor and treat cardiac conditions;
neurostimulators for deep brain stimulation in cases such as epilepsy
or Parkinson; drug delivery systems in the form of infusion pumps; and a
variety of biosensors to acquire and process different biosignals.
Some of the newest IMDs have started to incorporate numerous communication
and networking functions—usually known as “telemetry”—,
as well as increasingly more sophisticated computing capabilities. This
has provided implants with more intelligence and patients with more autonomy,
as medical personnel can access data and reconfigure the implant
remotely (i.e., without the patient being physically present in medical facilities).
Apart from a significant cost reduction, telemetry and computing
capabilities also allow healthcare providers to constantly monitor the patient’s
condition and to develop new diagnostic techniques based on an
Intra Body Network (IBN) of medical devices [25, 26, 201].
Evolving from a mere electromechanical IMD to one with more advanced
computing and communication capabilities has many benefits but
also entails numerous security and privacy risks for the patient. The majority
of such risks are relatively well known in classical computing scenarios,
though in many respects their repercussions are far more critical in the case
of implants. Attacks against an IMD can put at risk the safety of the patient
who carries it, with fatal consequences in certain cases. Causing an intentional
malfunction of an implant can lead to death and, as recognized by the
U.S. Food and Drug Administration (FDA), such deliberate attacks could
be far more difficult to detect than accidental ones [61]. Furthermore, these
devices store and transmit very sensitive medical information that requires
protection, as dictated by European (e.g., Directive 95/46/ECC) and U.S.
(e.g., CFR 164.312) Directives [94, 204].
The wireless communication capabilities present in many modern IMDs
are a major source of security risks, particularly while the patient is in open
(i.e., non-medical) environments. To begin with, the implant becomes no
longer “invisible”, as its presence could be remotely detected [48]. Furthermore,
it facilitates the access to transmitted data by eavesdroppers who
simply listen to the (insecure) channel [83]. This could result in a major privacy breach, as IMDs store sensitive information such as vital signals,
diagnosed conditions, therapies, and a variety of personal data (e.g., birth
date, name, and other medically relevant identifiers). A vulnerable communication
channel also makes it easier to attack the implant in ways similar
to those used against more common computing devices [118, 129, 156],
i.e., by forging, altering, or replying previously captured messages [82].
This could potentially allow an adversary to monitor and modify the implant
without necessarily being close to the victim [164]. In this regard,
the concerns of former U.S. vice-president Dick Cheney constitute an excellent
example: he had his Implantable Cardioverter Defibrillator (ICD)
replaced by another without WiFi capability [219].
While there are still no known real-world incidents, several attacks on
IMDs have been successfully demonstrated in the lab [83, 133, 143]. These
attacks have shown how an adversary can disable or reprogram therapies
on an ICD with wireless connectivity, and even inducing a shock state to
the patient [65]. Other attacks deplete the battery and render the device
inoperative [91], which often implies that the patient must undergo a surgical
procedure to have the IMD replaced. Moreover, in the case of cardiac
implants, they have a switch that can be turned off merely by applying a
magnetic field [149]. The existence of this mechanism is motivated by the
need to shield ICDs to electromagnetic fields, for instance when the patient
undergoes cardiac surgery using electrocautery devices [47]. However, this
could be easily exploited by an attacker, since activating such a primitive
mechanism does not require any kind of authentication.
In order to prevent attacks, it is imperative that the new generation of
IMDs will be equipped with strong mechanisms guaranteeing basic security
properties such as confidentiality, integrity, and availability. For example,
mutual authentication between the IMD and medical personnel is
essential, as both parties must be confident that the other end is who claims
to be. In the case of the IMD, only commands coming from authenticated
parties should be considered, while medical personnel should not trust any
message claiming to come from the IMD unless sufficient guarantees are
given.
Preserving the confidentiality of the information stored in and transmitted
by the IMD is another mandatory aspect. The device must implement
appropriate security policies that restrict what entities can reconfigure the
IMD or get access to the information stored in it, ensuring that only authorized
operations are executed. Similarly, security mechanisms have to
be implemented to protect the content of messages exchanged through an insecure wireless channel.
Integrity protection is equally important to ensure that information has
not been modified in transit. For example, if the information sent by the
implant to the Programmer is altered, the doctor might make a wrong decision.
Conversely, if a command sent to the implant is forged, modified,
or simply contains errors, its execution could result in a compromise of the
patient’s physical integrity.
Technical security mechanisms should be incorporated in the design
phase and complemented with appropriate legal and administrative measures.
Current legislation is rather permissive in this regard, allowing the
use of implants like ICDs that do not incorporate any security mechanisms.
Regulatory authorities like the FDA in the U.S or the EMA (European
Medicines Agency) in Europe should promote metrics and frameworks for
assessing the security of IMDs. These assessments should be mandatory
by law, requiring an adequate security level for an implant before approving
its use. Moreover, both the security measures supported on each IMD
and the security assessment results should be made public.
Prudent engineering practices well known in the safety and security domains
should be followed in the design of IMDs. If hardware errors are
detected, it often entails a replacement of the implant, with the associated
risks linked to a surgery. One of the main sources of failure when treating
or monitoring a patient is precisely malfunctions of the device itself.
These failures are known as “recalls” or “advisories”, and it is estimated
that they affect around 2.6% of patients carrying an implant. Furthermore,
the software running on the device should strictly support the functionalities
required to perform the medical and operational tasks for what it was
designed, and no more [66, 134, 213].
In Chapter 1, we present a survey of security and privacy issues in
IMDs, discuss the most relevant mechanisms proposed to address these
challenges, and analyze their suitability, advantages, and main drawbacks.
In Chapter 2, we show how the use of highly compressed electrocardiogram
(ECG) signals (only 24 coefficients of Hadamard Transform) is enough
to unequivocally identify individuals with a high performance (classification
accuracy of 97% and with identification system errors in the order of
10−2). In Chapter 3 we introduce a new Continuous Authentication scheme
that, contrarily to previous works in this area, considers ECG signals as
continuous data streams. The proposed ECG-based CA system is intended
for real-time applications and is able to offer an accuracy up to 96%, with
an almost perfect system performance (kappa statistic > 80%). In Chapter 4, we propose a distance bounding protocol to manage access control of
IMDs: ACIMD. ACIMD combines two features namely identity verification
(authentication) and proximity verification (distance checking). The
authentication mechanism we developed conforms to the ISO/IEC 9798-2
standard and is performed using the whole ECG signal of a device holder,
which is hardly replicable by a distant attacker. We evaluate the performance
of ACIMD using ECG signals of 199 individuals over 24 hours,
considering three adversary strategies. Results show that an accuracy of
87.07% in authentication can be achieved. Finally, in Chapter 5 we extract
some conclusions and summarize the published works (i.e., scientific
journals with high impact factor and prestigious international conferences).Los Dispositivos Médicos Implantables (DMIs) son dispositivos electrónicos
implantados dentro del cuerpo para tratar una enfermedad, controlar
el estado o mejorar el funcionamiento de alguna parte del cuerpo, o simplemente
para proporcionar al paciente una capacidad que no poseía antes
[86]. Ejemplos actuales de DMI incluyen marcapasos y desfibriladores
para monitorear y tratar afecciones cardíacas; neuroestimuladores para la
estimulación cerebral profunda en casos como la epilepsia o el Parkinson;
sistemas de administración de fármacos en forma de bombas de infusión; y
una variedad de biosensores para adquirir y procesar diferentes bioseñales.
Los DMIs más modernos han comenzado a incorporar numerosas funciones
de comunicación y redes (generalmente conocidas como telemetría)
así como capacidades de computación cada vez más sofisticadas. Esto
ha propiciado implantes con mayor inteligencia y pacientes con más autonomía,
ya que el personal médico puede acceder a los datos y reconfigurar
el implante de forma remota (es decir, sin que el paciente esté
físicamente presente en las instalaciones médicas). Aparte de una importante
reducción de costos, las capacidades de telemetría y cómputo también
permiten a los profesionales de la atención médica monitorear constantemente
la condición del paciente y desarrollar nuevas técnicas de diagnóstico
basadas en una Intra Body Network (IBN) de dispositivos médicos
[25, 26, 201].
Evolucionar desde un DMI electromecánico a uno con capacidades de
cómputo y de comunicación más avanzadas tiene muchos beneficios pero
también conlleva numerosos riesgos de seguridad y privacidad para el paciente.
La mayoría de estos riesgos son relativamente bien conocidos en los
escenarios clásicos de comunicaciones entre dispositivos, aunque en muchos
aspectos sus repercusiones son mucho más críticas en el caso de los
implantes. Los ataques contra un DMI pueden poner en riesgo la seguridad
del paciente que lo porta, con consecuencias fatales en ciertos casos.
Causar un mal funcionamiento intencionado en un implante puede causar
la muerte y, tal como lo reconoce la Food and Drug Administration (FDA)
de EE.UU, tales ataques deliberados podrían ser mucho más difíciles de
detectar que los ataques accidentales [61]. Además, estos dispositivos almacenan
y transmiten información médica muy delicada que requiere se
protegida, según lo dictado por las directivas europeas (por ejemplo, la Directiva 95/46/ECC) y estadunidenses (por ejemplo, la Directiva CFR
164.312) [94, 204].
Si bien todavía no se conocen incidentes reales, se han demostrado con
éxito varios ataques contra DMIs en el laboratorio [83, 133, 143]. Estos
ataques han demostrado cómo un adversario puede desactivar o reprogramar
terapias en un marcapasos con conectividad inalámbrica e incluso
inducir un estado de shock al paciente [65]. Otros ataques agotan
la batería y dejan al dispositivo inoperativo [91], lo que a menudo implica
que el paciente deba someterse a un procedimiento quirúrgico para reemplazar
la batería del DMI. Además, en el caso de los implantes cardíacos,
tienen un interruptor cuya posición de desconexión se consigue simplemente
aplicando un campo magnético intenso [149]. La existencia de este
mecanismo está motivada por la necesidad de proteger a los DMIs frete
a posibles campos electromagnéticos, por ejemplo, cuando el paciente se
somete a una cirugía cardíaca usando dispositivos de electrocauterización
[47]. Sin embargo, esto podría ser explotado fácilmente por un atacante,
ya que la activación de dicho mecanismo primitivo no requiere ningún tipo
de autenticación.
Garantizar la confidencialidad de la información almacenada y transmitida
por el DMI es otro aspecto obligatorio. El dispositivo debe implementar
políticas de seguridad apropiadas que restrinjan qué entidades
pueden reconfigurar el DMI o acceder a la información almacenada en él,
asegurando que sólo se ejecuten las operaciones autorizadas. De la misma
manera, mecanismos de seguridad deben ser implementados para proteger
el contenido de los mensajes intercambiados a través de un canal inalámbrico
no seguro.
La protección de la integridad es igualmente importante para garantizar
que la información no se haya modificado durante el tránsito. Por ejemplo,
si la información enviada por el implante al programador se altera, el
médico podría tomar una decisión equivocada. Por el contrario, si un comando
enviado al implante se falsifica, modifica o simplemente contiene
errores, su ejecución podría comprometer la integridad física del paciente.
Los mecanismos de seguridad deberían incorporarse en la fase de diseño
y complementarse con medidas legales y administrativas apropiadas.
La legislación actual es bastante permisiva a este respecto, lo que permite
el uso de implantes como marcapasos que no incorporen ningún mecanismo
de seguridad. Las autoridades reguladoras como la FDA en los Estados
Unidos o la EMA (Agencia Europea de Medicamentos) en Europa deberían
promover métricas y marcos para evaluar la seguridad de los DMIs.
Estas evaluaciones deberían ser obligatorias por ley, requiriendo un nivel
de seguridad adecuado para un implante antes de aprobar su uso. Además,
tanto las medidas de seguridad implementadas en cada DMI como los resultados
de la evaluación de su seguridad deberían hacerse públicos.
Buenas prácticas de ingeniería en los dominios de la protección y la
seguridad deberían seguirse en el diseño de los DMIs. Si se detectan errores
de hardware, a menudo esto implica un reemplazo del implante, con
los riesgos asociados y vinculados a una cirugía. Una de las principales
fuentes de fallo al tratar o monitorear a un paciente es precisamente el
mal funcionamiento del dispositivo. Estos fallos se conocen como “retiradas”,
y se estima que afectan a aproximadamente el 2,6 % de los pacientes
que llevan un implante. Además, el software que se ejecuta en el
dispositivo debe soportar estrictamente las funcionalidades requeridas para
realizar las tareas médicas y operativas para las que fue diseñado, y no más
[66, 134, 213].
En el Capítulo 1, presentamos un estado de la cuestión sobre cuestiones
de seguridad y privacidad en DMIs, discutimos los mecanismos más relevantes
propuestos para abordar estos desafíos y analizamos su idoneidad,
ventajas y principales inconvenientes. En el Capítulo 2, mostramos
cómo el uso de señales electrocardiográficas (ECGs) altamente comprimidas
(sólo 24 coeficientes de la Transformada Hadamard) es suficiente para
identificar inequívocamente individuos con un alto rendimiento (precisión
de clasificación del 97% y errores del sistema de identificación del orden
de 10−2). En el Capítulo 3 presentamos un nuevo esquema de Autenticación
Continua (AC) que, contrariamente a los trabajos previos en esta
área, considera las señales ECG como flujos de datos continuos. El sistema
propuesto de AC basado en señales cardíacas está diseñado para aplicaciones
en tiempo real y puede ofrecer una precisión de hasta el 96%,
con un rendimiento del sistema casi perfecto (estadístico kappa > 80 %).
En el Capítulo 4, proponemos un protocolo de verificación de la distancia
para gestionar el control de acceso al DMI: ACIMD. ACIMD combina
dos características, verificación de identidad (autenticación) y verificación
de la proximidad (comprobación de la distancia). El mecanismo de autenticación
es compatible con el estándar ISO/IEC 9798-2 y se realiza utilizando
la señal ECG con todas sus ondas, lo cual es difícilmente replicable
por un atacante que se encuentre distante. Hemos evaluado el rendimiento
de ACIMD usando señales ECG de 199 individuos durante 24 horas, y
hemos considerando tres estrategias posibles para el adversario. Los resultados
muestran que se puede lograr una precisión del 87.07% en la au tenticación. Finalmente, en el Capítulo 5 extraemos algunas conclusiones
y resumimos los trabajos publicados (es decir, revistas científicas con alto
factor de impacto y conferencias internacionales prestigiosas).Programa Oficial de Doctorado en Ciencia y Tecnología InformáticaPresidente: Arturo Ribagorda Garnacho.- Secretario: Jorge Blasco Alís.- Vocal: Jesús García López de Lacall
Brainjacking: Implant Security Issues in Invasive Neuromodulation
The security of medical devices is critical to good patient care, especially when the devices are implanted. In light of recent developments in information security, there is reason to be concerned that medical implants are vulnerable to attack. The ability of attackers to exert malicious control over brain implants (“brainjacking”) has unique challenges that we address in this review, with particular focus on deep brain stimulation implants. To illustrate the potential severity of this risk, we identify several mechanisms through which attackers could manipulate patients if unauthorized access to an implant can be achieved. These include blind attacks in which the attacker requires no patient-specific knowledge and targeted attacks that require patient-specific information. Blind attacks include cessation of stimulation, draining implant batteries, inducing tissue damage, and information theft. Targeted attacks include impairment of motor function, alteration of impulse control, modification of emotions or affect, induction of pain, and modulation of the reward system. We also discuss the limitations inherent in designing implants and the trade-offs that must be made to balance device security with battery life and practicality. We conclude that researchers, clinicians, manufacturers, and regulatory bodies should cooperate to minimize the risk posed by brainjacking
An Empirical Analysis of Security and Privacy in Health and Medical Systems
Healthcare reform, regulation, and adoption of technology such as wearables are substantially changing both the quality of care and how we receive it. For example, health and fitness devices contain sensors that collect data, wireless interfaces to transmit data, and cloud infrastructures to aggregate, analyze, and share data. FDA-defined class III devices such as pacemakers will soon share these capabilities. While technological growth in health care is clearly beneficial, it also brings new security and privacy challenges for systems, users, and regulators.
We group these concepts under health and medical systems to connect and emphasize their importance to healthcare. Challenges include how to keep user health data private, how to limit and protect access to data, and how to securely store and transmit data while maintaining interoperability with other systems. The most critical challenge unique to healthcare is how to balance security and privacy with safety and utility concerns. Specifically, a life-critical medical device must fail-open (i.e., work regardless) in the event of an active threat or attack.
This dissertation examines some of these challenges and introduces new systems that not only improve security and privacy but also enhance workflow and usability. Usability is important in this context because a secure system that inhibits workflow is often improperly used or circumvented. We present this concern and our solution in its respective chapter. Each chapter of this dissertation presents a unique challenge, or unanswered question, and solution based on empirical analysis.
We present a survey of related work in embedded health and medical systems. The academic and regulatory communities greatly scrutinize the security and privacy of these devices because of their primary function of providing critical care. What we find is that securing embedded health and medical systems is hard, done incorrectly, and is analogous to non-embedded health and medical systems such as hospital servers, terminals, and personally owned mobile devices. A policy called bring your own device (BYOD) allows the use and integration of mobile devices in the workplace. We perform an analysis of Apple iMessage which both implicates BYOD in healthcare and secure messaging protocols used by health and medical systems.
We analyze direct memory access engines, a special-purpose piece of hardware to transfer data into and out of main memory, and show that we can chain together memory transfers to perform arbitrary computation. This result potentially affects all computing systems used for healthcare. We also examine HTML5 web workers as they provide stealthy computation and covert communication. This finding is relevant to web applications such as personal and electronic health record portals.
We design and implement two novel and secure health and medical systems. One is a wearable device that addresses the problem of authenticating a user (e.g., physician) to a terminal in a usable way. The other is a light-weight and low-cost wireless device we call Beacon+. This device extends the design of Apple's iBeacon specification with unspoofable, temporal, and authenticated advertisements; of which, enables secure location sensing applications that could improve numerous healthcare processes
Understanding and Leveraging Virtualization Technology in Commodity Computing Systems
Commodity computing platforms are imperfect, requiring various enhancements for performance and security purposes. In the past decade, virtualization technology has emerged as a promising trend for commodity computing platforms, ushering many opportunities to optimize the allocation of hardware resources. However, many abstractions offered by virtualization not only make enhancements more challenging, but also complicate the proper understanding of virtualized systems. The current understanding and analysis of these abstractions are far from being satisfactory. This dissertation aims to tackle this problem from a holistic view, by systematically studying the system behaviors. The focus of our work lies in performance implication and security vulnerabilities of a virtualized system.;We start with the first abstraction---an intensive memory multiplexing for I/O of Virtual Machines (VMs)---and present a new technique, called Batmem, to effectively reduce the memory multiplexing overhead of VMs and emulated devices by optimizing the operations of the conventional emulated Memory Mapped I/O in hypervisors. Then we analyze another particular abstraction---a nested file system---and attempt to both quantify and understand the crucial aspects of performance in a variety of settings. Our investigation demonstrates that the choice of a file system at both the guest and hypervisor levels has significant impact upon I/O performance.;Finally, leveraging utilities to manage VM disk images, we present a new patch management framework, called Shadow Patching, to achieve effective software updates. This framework allows system administrators to still take the offline patching approach but retain most of the benefits of live patching by using commonly available virtualization techniques. to demonstrate the effectiveness of the approach, we conduct a series of experiments applying a wide variety of software patches. Our results show that our framework incurs only small overhead in running systems, but can significantly reduce maintenance window
Privacy-preserving spatiotemporal multicast for mobile information services
Mobile devices have become essential for accessing information services anywhere at any time. While the so-called geographic multicast (geocast) has been considered in detail in existing research, it only focuses on delivering messages to all mobile devices that are currently residing within a certain geographic area. This thesis extends this notion by introducing a Spatiotemporal Multicast (STM), which can informally be described as a "geocast into the past". Instead of addressing users based on their current locations, this concept relates to the challenge of sending a message to all devices that have resided within a geographic area at a certain time in the past. While a wide variety of applications can be envisioned for this concept, it presents several challenges to be solved. In order to deliver messages to all past visitors of a certain location, an STM service would have to fully track all user movements at all times. However, collecting this kind of information is not desirable considering the underlying privacy implications, i.e., users may not wish to be identified by the sender of a message as this can disclose sensitive personal information. Consequently, this thesis aims to provide a privacy-preserving notion of STM. In order to realize such a service, this work first presents a detailed overview of possible applications. Based on those, functional, non-functional, as well as security and privacy objectives are proposed. These objectives provide the foundation for an in-depth literature review of potential mechanisms for realizing an STM service. Among the suggested options, the most promising relies on Rendezvous Points (RPs) for datagram delivery. In simple terms, RPs represent "anonymous mailboxes" that are responsible for certain spatiotemporal regions. Messages are deposited at RPs so that users can retrieve them later on. Protecting the privacy of users then translates to obfuscating the responsibilities of RPs for specific spatiotemporal regions. This work proposes two realizations: CSTM, which relies on cryptographic hashing, and OSTM, which considers the use of order-preserving encryption in a CAN overlay. Both approaches are evaluated and compared in detail with respect to the given objectives. While OSTM yields superior performance-related properties, CSTM provides an increased ability of protecting the privacy of users.Mobilgeräte bilden heute die Grundlage allgegenwärtiger Informationsdienste. Während der sogenannte geografische Multicast (Geocast) hier bereits ausführlich erforscht worden ist, so bezieht sich dieser nur auf Geräte, welche sich aktuell innerhalb einer geografischen Zielregion befinden. Diese Arbeit erweitert dieses Konzept durch einen räumlich-zeitlichen Multicast, welcher sich informell als "Geocast in die Vergangenheit" beschreiben lässt. Dabei wird die Zustellung einer Nachricht an alle Nutzer betrachtet, die sich in der Vergangenheit an einem bestimmten Ort aufgehalten haben. Während eine Vielzahl von Anwendungen für dieses Konzept denkbar ist, so ergeben sich hier mehrere Herausforderungen. Um Nachrichten an ehemalige Besucher eines Ortes senden zu können, müsste ein räumlich-zeitlicher Multicast-Dienst die Bewegungen aller Nutzer vollständig erfassen. Aus Gründen des Datenschutzes ist das zentralisierte Sammeln solch sensibler personenbezogener Daten jedoch nicht wünschenswert. Diese Arbeit befasst sich daher insbesondere mit dem Schutz der Privatsphäre von Nutzern eines solchen Dienstes. Zur Entwicklung eines räumlich-zeitlichen Multicast-Dienstes erörtert diese Arbeit zunächst mögliche Anwendungen. Darauf aufbauend werden funktionale, nicht-funktionale, sowie Sicherheits- und Privatsphäre-relevante Anforderungen definiert. Diese bilden die Grundlage einer umfangreichen Literaturrecherche relevanter Realisierungstechniken. Der vielversprechendste Ansatz basiert hierbei auf der Hinterlegung von Nachrichten in sogenannten Rendezvous Points. Vereinfacht betrachtet stellen diese "anonyme Briefkästen" für bestimmte räumlich-zeitliche Regionen dar. Nachrichten werden in diesen so hinterlegt, dass legitime Empfänger sie dort später abholen können. Der Schutz der Nutzer-Privatsphäre entspricht dann der Verschleierung der Zuständigkeiten von Rendezvous Points für verschiedene räumlich-zeitliche Regionen. Diese Arbeit schlägt zwei Ansätze vor: CSTM, welches kryptografische Hashfunktionen nutzt, sowie OSTM, welches ordnungserhaltende Verschlüsselung in einem CAN Overlay einsetzt. Beide Optionen werden detailliert analytisch sowie empirisch bezüglich ihrer Diensteigenschaften untersucht und verglichen. Dabei zeigt sich, dass OSTM vorteilhaftere Leistungseigenschaften besitzt, während CSTM einen besseren Schutz der Nutzer-Privatsphäre bietet
Establishing mandatory access control on Android OS
Common characteristic of all mobile operating systems for smart devices is an extensive middleware that provides a feature-rich API for the onboard sensors and user’s data (e.g., contacts). To effectively protect the device’s integrity, the user’s privacy, and to ensure non-interference between mutually distrusting apps, it is imperative that the middleware enforces rigid security and privacy policies.
This thesis presents a line of work that integrates mandatory access control (MAC) mechanisms into the middleware of the popular, open source Android OS. While our early work established a basic understanding for the integration of enforcement hooks and targeted very specific use-cases, such as multi-persona phones, our most recent works adopt important lessons learned and design patterns from established MAC architectures on commodity systems and intertwine them with the particular security requirements of mobile OS architectures like Android. Our most recent work also complemented the Android IPC mechanism with provisioning of better provenance information on the origins of IPC communication. Such information is a crucial building block for any access control mechanism on Android. Lastly, this dissertation outlines further directions of ongoing and future research on access control on modern mobile operating systems.Gemeinsame Charakteristik aller modernen mobilen Betriebssysteme für sog. ”smart devices” ist eine umfangreiche Diensteschicht, die funktionsreiche Programmierschnittstellen zu der Gerätehardware sowie den Endbenutzerdaten (z.B. Adressbuch) bereitstellt. Um die Systemintegrität, die Privatsphäre des Endbenutzers, sowie die Abgrenzung sich gegenseitig nicht vertrauender Apps effektiv zu gewährleisten, ist es unabdingbar, dass diese Diensteschichten rigide Sicherheitspolitiken umsetzen.
Diese Dissertation präsentiert mehrere Forschungsarbeiten, die “Mandatory Access Control” (MAC) in die Diensteschicht des weit verbreiteten Android Betriebssystems integrieren. Die ersten dieser Arbeiten schufen ein grundlegendes Verständnis für die Integration von Zugriffsmechanismen in das Android Betriebssystem und waren auf sehr spezielle Anwendungsszenarien ausgerichtet. Neuere Arbeiten haben hingegen wichtige Erkenntnisse und Designprinzipien etablierter MAC Architekturen auf herkömmlichen Betriebssystemen für Android adaptiert und mit den speziellen Sicherheitsanforderungen mobiler Systeme verflochten. Die letzte Arbeit in dieser Reihe hat zudem Androids IPC Mechanismus untersucht und dahingehend ergänzt, dass er bessere Informationen über den Ursprung von IPC Nachrichten bereitstellt. Diese Informationen sind fundamental für jedwede Art von Zugriffskontrolle auf Android. Zuletzt diskutiert diese Dissertation aktuelle und zukünftige Forschungsthemen für Zugriffskontrollen auf modernen, mobilen Endgeräten
TABLETOP ROLE-PLAYING GAMES AS AUTISM PSYCHOTHERAPY: A VIDEO-CUED MULTIVOCAL CLINICAL ETHNOGRAPHY
This qualitative study is a video-cued multivocal ethnography that analyzed the clinical reasoning and perspectives of psychotherapists using Tabletop Role-Playing Games (TRPG) as a therapeutic treatment for children and adolescents diagnosed with Autism Spectrum conditions. With a growing number of TRPG therapists nationwide using this modality in their clinical practices, this study aimed to develop a clearer understanding of the ways in which their therapeutic orientation, gaming practices, and knowledge of Autism Spectrum Conditions informs their use of TRPG psychotherapy with Autistic clients.
Research that focuses on clinical decision-making and the knowledge that informs clinical interventions and technique generally refers to these as “clinical reasoning”. By observing therapy and interviewing therapists about their clinical practice, this study collected data about the different types of clinical reasoning TRPG therapists use when working with Autistic clients. Through the use of video-cued multivocal clinical ethnography, one TRPG therapist was observed and interviewed as she conducted TRPG therapy with Autistic clients and described the clinical reasoning behind the design and implementation of this treatment modality. Using ethnographic semi-structured interviewing and Brief Structured Recall (BSR), the video footage of the TRPG therapy served as a video cue for interviews with three other TRPG therapists, allowing the therapists to authentically reflect on the theoretical underpinnings behind their clinical judgement and decisions.
As Autism psychotherapies have been expanding to include approaches integrative of behavioral as well as psychodynamic orientations, TRPG therapy as a “semi-directive” treatment offers an emergent treatment option that integrates directive and non-directive approaches to Autism treatment. TRPG therapists discussed the ongoing tension between non-directive and directive approaches to treatment, which simultaneously mirrored historical debates between these two approaches in play psychotherapy for Autistic patients. The results of this study reveal how TRPG therapists’ perspectives diverge from mainstream and previously held clinical views on Autism diagnosis and treatment. The results of this study show the alternative ways in which TRPG therapists view Autism symptomatology (i.e. sensorimotor needs, Theory of Mind, sociality) and the evolving nature of Autistic comportment that emerges through and is mediated by player immersion in the gaming space and interactions with the game’s structure and mechanics. Operating both as Dungeon Master and Therapist, the TRPG therapists discussed how they simultaneously utilized and integrated these multiple roles with competing paradigmatic perspectives while grappling with gaming, clinical, and cultural perspectives of Autism diagnosis and Autism treatment