On two models of noninterference: Rushby and Greve, Wilding, and Vanfleet

Contains fulltext : 135068.pdf (preprint version ) (Closed access)Computer Safety, Reliability, and Security 33rd International Conference, SAFECOMP 2014, Florence, Italy, September 10-12, 201

Human Sweat Analysis Using a Portable Device Based on a Screen‐printed Electrolyte Sensor

Analysis of ammonium in human sweat during physical strain using a portable sensor device and enzymatic measurements are compared. The portable device is based on a screen‐printed electrolyte sensor connected with an evaluation board for data acquisition and transfer. During performance tests with artificial sweat, the sensor shows a low detection limit of 0.3 mM. Thus, the typical concentration range of ammonium in sweat lies within the working range of the sensor. We also demonstrate the necessity of the comparison measurement for verification of the correct performance of screen‐printed sensors and show how other components of human sweat influence the measured potential. Regarding the change in ammonium concentration during different levels of work out intensity, we point out a different behavior of what is expected physiologically. With this the importance of consideration of several parameters during sweating, like the sweat rate and other ingredients in human sweat, was demonstrated for correct determination of the ammonium concentration

Using Isabelle/HOL to develop and maintain separation invariants for an operating system

We describe work on an Isabelle/HOL model for the specification of a separation kernel done within the EURO-MILS (http://www.euromils.eu/) project. We chose to extensible records to specify the state. By an example of a theory specifying a group of "event" API calls, it is shown how lemmas on local state are used for obtaining proof obligations for a global separation property

On two models of noninterference: Rushby and Greve, Wilding, and Vanfleet

We formally compare two industrially relevant and popular models of noninterference, namely, the model defined by Rushby and the one defined by Greve, Wilding, and Vanfleet (GWV). We create a mapping between the objects and relations of the two models. We prove a number of theorems showing under which assumptions a system identified as "secure" in one model is also identified as "secure" in the other model. Using two examples, we illustrate and discuss some of these assumptions. Our main conclusion is that the GWV model is more discriminating than the Rushby model. All systems satisfying GWV’s Separation also satisfy Rushby’s noninterference. The other direction only holds if we additionally assume that GWV systems are such that every partition is assigned at most one memory segment. All of our proofs have been checked using the Isabelle/HOL proof assistant. Keywords: Noninterference; information flow security; formal model