The Four Types of Aspect-Oriented Programming (AOP) Weavers

At the Institute for Cyber Security, we use many different technologies to help accomplish our goals. One such technology is Aspect-Oriented Programming (AOP)., where one can "weave" cross-cutting concerns into source code, separating them from core concerns.

While compile-time weaving is common, the weaving process itself can take place at one of four different times: compile-time, post-compile time, load-time, and run-time. The run-time behavior of an application are the same regardless of the approach chosen.

• Compile-time weaving: this is the simplest approach. A compile-time weaver will compile from source and produce woven class files as output. The aspects themselves may be in source or binary form.
• Binary-weaving (also called post-compile-time weaving): this is used to weave existing class files and JAR files. As with compile-time weaving, the aspects used for weaving may be in source or binary form, and may themselves be woven by aspects.
• Load-time weaving: here, binary weaving is defered until the point that a class loader loads a class file and defines the class to the system. To support this, one or more "weaving class loaders", either provided explicitly by the run-time environment or enabled through a "weaving agent" are required. 
• Run-time weaving: this is the weaving of classes that have already been defined to the system without reloading those classes, making it a more dynamic load-time weaver.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

Comodo and SafeMashups Partner on MashSSL Technology

SafeMashups, Inc., the latest startup from the Institute for Cyber Security to go live, has teamed up with Comodo to further secure web 2.0 protocols. Comodo is a large SSL certificate authority and only the latest in growing number of SSL CAs to interoperate with SafeMashup's free Web Toolkit and SafeMashups Community Service.

As Ravi Ganesan, founder and CEO of SafeMashups states, "MashSSL has the potential to fill a significant hole in the fabric of the Internet with a secure and standard protocol. MashSSL will also drive the adoption of SSL certificates, including EV-SSL certificates in a significant fashion." Both companies reiterated their commitment to work with other partners to rapidly make the standard completely open.

Look for more good news from SafeMashups soon!

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

The Basics of Base64

At the Institute for Cyber Security, much of our work with our startups in incubation or research involves transmitting data using Base64. Whether in the form of files or images, data between machines with incompatible data definitions, or encrypted information, Base64 is used almost as a de facto standard for content transfer encoding.

Almost any high-level language will has a library that will encode and decode data from Base64 and back, but it's worth knowing the underlying principle behind the transform. The way it works is simple: whether text, image, or encrypted information, every bit of data is a number stored in memory. By reading that data in blocks of six bits (2⁶ = 64) and mapping each number to a character (0 = 'A', 1 = 'B', and so on, until 62 = '+' and 63 = '/'; see the figure up above), binary data of any size can be encoded into a string. See Figure 1 for an example, taking a string to its constituent bytes, then reading each group of six bits into a new Base64 character:

Figure 1: Encoding "Hello!" in Base64

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

C# and VB Enhancements in Visual Studio 2010

Yesterday I came across an interesting MSDN blog posted article on the upcoming features in VB.NET and C#. We here at the Institute for Cyber Security use .NET for many of our research and incubator programs, and look forward to their (and Java 7's eventual) release.

C# Updates:

• "Dynamic lookup", allowing object manipulation from IronPython, IronRuby, JavaScript, or a standard .NET library in the same way.
• New "dynamic" keyword, to allow a type to be resolved dynamically (at runtime) rather than statically (at compile-time).
• Optional parameters with a default value in the method signature, along with named arguments, both useful for COM-manipulation.

Visual Basic Updates:

• Auto-implemented properties.
• Simpler collection initializers and array literals.
• Lambdas can now contain expressions that don’t return a value.
• Improved IronPython/IronRuby interoperation.

More can be found at the original post.

Erhan J. kartaltepe,
erhan.kartaltepe-at-utsa.edu

Free Programming and Cloud Computing Ebooks

We at the Institute for Cyber Security are more than just a crack team of architects, developers, and security experts; we're also learners. So when we come across free books, we cannot say no. Today, three free ebooks came our way that we thought were worth a look.

About C# Development: C# Development ("The Yellow Book") covers programming from hardware up, through the basics of object-oriented programming and into advanced topics such as graphical development and debugging.

About C# From Java: From Rob Miles: "This is based my original journey from Java to C#. If you are an experienced Java programmer who wants to find out what C# is all about you might find it useful."

About Understanding Microsoft Virtualization Solutions:This guide will teach you about the benefits of the latest virtualization technologies and how to plan, implement, and manage virtual infrastructure solutions. The technologies covered include: Windows Server 2008 Hyper-V, System Center Virtual Machine Manager 2008, Microsoft Application Virtualization 4.5, Microsoft Enterprise Desktop Virtualization, and Microsoft Virtual Desktop Infrastructure.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

Microsoft Cloud Security Survey and Results

Two weeks ago, J. D. Meier at Microsoft conducted a survey on cloud security practices in cloud computing security, and earlier today he posted a quick summary of the results. Most respondents were architects, though developers and testers answered as well.

Some interesting tidbits:

• There is significant interest in infrastructure and process related security issues such as SLA’s, policies, and intellectual property.
• There is significant interest in threats and countermeasures.
• There is some interest in OpenID as an authentication/authorization approach.

To see all the rest, take a look at his article.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

ICS in the News: Ravi Sandhu Named Editor of Top Computer Security Journal Press Release

As covered earlier in the week in the UTSA Today and as mentioned here before, Ravi Sandhu, the executive director of the Institute for Cyber Security, has been named editor-in-chief of IEEE's prestigious Transactions on Dependable and Secure Computing (TDSC) journal. Read the press release below:

UTSA researcher named editor of top computer security journal

San Antonio /PRAvenueNW/ -- The Institute of Electrical and Electronics Engineers Inc (IEEE) Computer Society has named University of Texas at San Antonio (UTSA) professor Ravinderpal “Ravi” Sandhu editor-in-chief of its scholarly journal, IEEE Transactions on Dependable and Secure Computing.  Sandhu’s two-year term begins Jan. 1, 2010.  An internationally renowned expert in information assurance, security and trust, Sandhu is the Lutcher Brown Distinguished Chair in Cyber Security in UTSA’s College of Sciences.  He is also the executive director of the university’s Institute for Cyber Security.

“Professor Sandhu has a keen pulse on current trends in information assurance and security, and his ability to focus that knowledge on research with practical applications is one of the things that makes him such a leader in the field,” said Robert Gracy, UTSA’s vice president for research.  “This new IEEE editorial appointment is a testament to Professor Sandhu’s successful career.  He is certainly well-qualified to oversee the IEEE’s highly-respected journal.”

“Although individuals in cyber space want to keep their information secure, they also value the performance of their computers,” said George Perry, dean of UTSA’s College of Sciences.  “The editors at Transactions on Dependable and Secure Computing understand this challenge.  The journal’s presentation of innovative systems, networks and evaluation protocols offers the industry the best possible solutions to the delicate balance of safety and performance.”

Sandhu’s notable career in security spans more than 35 years.  Prior to joining the faculty at UTSA, Sandhu held positions at Ohio State University and George Mason University, becoming one of the most frequently cited security researchers in the security industry.  He is an author on the top two most-cited scholarly papers in Access Control.  One of those papers, “Role-Based Access Control Models,” originally published in IEEE Computer in Feb. 1996, has been cited more than 3,500 times.  In addition, he holds thirteen U.S. patents for security technology and has received more than 30 sponsored research grants.

In 2000, Sandhu founded TriCipher, a corporation that markets software to protect businesses and their customers from online fraud.  Prior to that, he consulted with numerous organizations, including McAfee, Trusted Information Systems, National Institute of Standards and Technology, Verizon, SETA Corporation, Argonne National Laboratory, Singapore Management University, Northrop Grumman and Integris Health.  He has also presented short courses, tutorials and invited lectures in Asia, Australia, Europe and both Americas.  Today, Sandhu continues to conduct world-leading research at UTSA.

“The best source of scientific truth still lies in the rigor and authority of the peer review process, even as research journals must accelerate their traditional leisurely pace of submission to publication,” said Sandhu.

Sandhu was the founding editor-in-chief of the ACM Transactions on Information and System Security and served from 1997 to 2004.  He holds a bachelor’s degree and a master’s degree in electrical engineering from the Indian Institutes of Technology in Bombay and New Delhi, respectively, as well as master’s and doctoral degrees in computer science from Rutgers University.

#  #  #
 
The University of Texas at San Antonio is one of the fastest growing higher education institutions in Texas and the second largest of nine academic universities and six health institutions in the UT System.  As a multicultural institution of access and excellence, UTSA aims to be a premier public research university providing access to educational excellence and preparing citizen leaders for the global environment.

UTSA serves more than 28,400 students in 64 bachelor’s, 47 master’s and 21 doctoral degree programs in the colleges of Architecture, Business, Education and Human Development, Engineering, Honors, Liberal and Fine Arts, Public Policy, Sciences and Graduate School.  Founded in 1969, UTSA is an intellectual and creative resource center and a socioeconomic development catalyst for Texas and beyond.
 
#  #  #

Erhan J. Kartaltepe
erhan.kartaltepe-at-utsa.edu

Articles on Ravi Sandhu's Appointment as Top Computer Security Journal Editor

Yahoo! Finance had an article following the press release on Dr. Ravi Sandhu, the Institute for Cyber Security's executive director. Ravi has been named editor-in-chief of IEEE's prestigious Transactions on Dependable and Secure Computing (TDSC) journal, due to take over in January. UTSA Today also covered the news in an article.

"Professor Sandhu has a keen pulse on current trends in information assurance and security, and his ability to focus that knowledge on research with practical applications is one of the things that makes him such a leader in the field," said UTSA's vice president for research, Dr. Robert Gracy.

Also of note: he is the author of the top two most-cited scholarly papers in access control, including the seminal "Role-Based Access Control Models," originally published in IEEE Computer in February 1996, has been cited more than 3,500 times. Moreover, he holds 13 U.S. patents for security technology and has received more than 30 sponsored research grants.

We at ICS are proud of Ravi's latest accomplishments, and look forward to continued success in the security arena!

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

Implications of the Department of Defense Reviewing Social Network Security Implications

TechNewsWorld has an article on how the Department of Defense (DoD) will conduct an overall review of the security implications of allowing members of the military to interact with social networks. According to the article, marines have been banned from using military networks to access FaceBook, MySpace, and Twitter, while the army has complete freedom in that regard. In the meantime, the DoD will review the security risks and values of social networking sites, with a new policy expected by the end of the year.

Of course, banning only three popular social networking sites only from military networks is treating a symptom rather than a cause. As Michael Sutton, vice president of Zscaler's security research department, mentions, "Banning three social networking sites is going to have a negligible impact on network security...and in the end, you're throwing the baby out with the bath water."

This is an interesting case of threat modeling, where one wants to manage risk instead. It'll be interesting to see where the new policy goes.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

IronRuby and IronPython--What Dynamic Languages Have Wrought

Earlier this week, version 0.9 of IronRuby was released, the last beta before the final 1.0 version. About two weeks before that, the IronPython project released its feature complete 2.6 beta of the most widely used version of Python. The "iron" prefix implies that these languages are meant to execute on the .NET runtime and interoperate with the .NET framework and classes.

At the Institute for Cyber Security, dynamic languages such as Python and Ruby are used in a wide variety of projects, and the .NET framework, along with Java, a mainstay for our developers and architects working on desktop, service, and web applications. While dynamic languages have moved into the .NET and Java frameworks through new languages or features, it's more in line with .NET's paradigm to have any languages run and interoperate on the same VM (as languages such as NetCOBOL would attest to). With the recent envelope-pushing of modern dynamic languages into the .NET framework, and to a degree in Java, it'll be interesting to see what the next few years has in store for both natural competitors.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu