Just forget it - The semantics and enforcement of information erasure

Abstract. There are many settings in which sensitive information is made available to a system or organisation for a specific purpose, on the understanding that it will be erased once that purpose has been fulfilled. A familiar example is that of online credit card transactions: a customer typically provides credit card details to a payment system on the understanding that the following promises are kept: (i) Noninterference (NI): the card details may flow to the bank (in order that the payment can be authorised) but not to other users of the system; (ii) Erasure: the payment system will not retain any record of the card details once the transaction is complete. This example shows that we need to reason about NI and erasure in combination, and that we need to consider interactive systems: the card details are used in the interaction between the principals, and then erased; without the interaction, the card details could be dispensed with altogether and erasure would be unnecessary. The contributions of this paper are as follows. (i) We show that an end-to-end erasure property can be encoded as a “flow sensitive ” noninterference property. (ii) By a judicious choice of language construct to support erasur

Radiometric correction procedure study

A comparison of MSS radiometric processing techniques identified as a preferred radiometric processing technique a procedure which equalizes the mean and standard deviation of detector-specific histograms of uncalibrated scene data. Evaluation of MSS calibration data demonstrated that the relationship between detector responses is essentially linear over the range of intensities typically observed in MSS data, and that the calibration wedge data possess a high degree of temporal stability. An analysis of the preferred radiometric processing technique showed that it could be incorporated into the MDP-MSS system without a major redesign of the system, and with minimal impact on system throughput

Termination-insensitive noninterference leaks more than just a bit

Current tools for analysing information flow in programs build upon ideas going back to Denning's work from the 70's. These systems enforce an imperfect notion of information flow which has become known as termination-insensitive noninterference. Under this version of noninterference, information leaks are permitted if they are transmitted purely by the program's termination behaviour (i.e., whether it terminates or not). This imperfection is the price to pay for having a security condition which is relatively liberal (e.g. allowing while-loops whose termination may depend on the value of a secret) and easy to check. But what is the price exactly? We argue that, in the presence of output, the price is higher than the “one bit” often claimed informally in the literature, and effectively such programs can leak all of their secrets. In this paper we develop a definition of termination-insensitive noninterference suitable for reasoning about programs with outputs. We show that the definition generalises “batch-job” style definitions from the literature and that it is indeed satisfied by a Denning-style program analysis with output. Although more than a bit of information can be leaked by programs satisfying this condition, we show that the best an attacker can do is a brute-force attack, which means that the attacker cannot reliably (in a technical sense) learn the secret in polynomial time in the size of the secret. If we further assume that secrets are uniformly distributed, we show that the advantage the attacker gains when guessing the secret after observing a polynomial amount of output is negligible in the size of the secret

The Intensity Profile of the Solar Supergranulation

We have measured the average radial (cell center to network boundary) profile of the continuum intensity contrast associated with supergranular flows using data from the Precision Solar Photometric Telescope (PSPT) at the Mauna Loa Solar Observatory (MLSO). After removing the contribution of the network flux elements by the application of masks based on Ca II K intensity and averaging over more than 10^5 supergranular cells, we find a ~ 0.1% decrease in red and blue continuum intensity from the supergranular cell centers outward, corresponding to a ~ 1.0 K decrease in brightness temperature across the cells. The radial intensity profile may be caused either by the thermal signal associated with the supergranular flows or a variation in the packing density of unresolved magnetic flux elements. These are not unambiguously distinguished by the observations, and we raise the possibility that the network magnetic fields play an active role in supergranular scale selection by enhancing the radiative cooling of the deep photosphere at the cell boundaries.Comment: Accepted to Ap

Bone marrow transplantation alters the tremor phenotype in the murine model of globoid-cell leukodystrophy

Tremor is a prominent phenotype of the twitcher mouse, an authentic genetic model of Globoid-Cell Leukodystrophy (GLD, Krabbe’s disease). In the current study, the tremor was quantified using a force-plate actometer designed to accommodate low-weight mice. The actometer records the force oscillations caused by a mouse’s movements, and the rhythmic structure of the force variations can be revealed. Results showed that twitcher mice had significantly increased power across a broad band of higher frequencies compared to wildtype mice. Bone marrow transplantation (BMT), the only available therapy for GLD, worsened the tremor in the twitcher mice and induced a measureable alteration of movement phenotype in the wildtype mice. These data highlight the damaging effects of conditioning radiation and BMT in the neonatal period. The behavioral methodology used herein provides a quantitative approach for assessing the efficacy of potential therapeutic interventions for Krabbe’s disease