User Permissions Research Articles

A Design of Remote Control System for Robot Based on Internet

Combining with some research achievements in remote control of robot at home and abroad, this paper analyzes general principle of it and designs a remote control system for robot. The system can be realized through network, and it utilizes browser/server mode and applies CGI program which is written in VB. Through the CGI program, the communication between server and browser is realized. Not only does the design describe the control process, but also it defines a scheme of the remote control system which determines integrated structure. Besides, a user interface which includes user permissions and function modules is developed. Finally, a preliminary control test for system is taken and the performance of the system is analyzed.

ProHits: integrated software for mass spectrometry–based interaction proteomics

ProHits: integrated software for mass spectrometry–based interaction proteomics

The role mining problem

Devising a complete and correct set of roles has been recognized as one of the most important and challenging tasks in implementing role-based access control. A key problem related to this is the notion of goodness/interestingness—when is a role good/interesting? In this article, we define the Role Mining Problem (RMP) as the problem of discovering an optimal set of roles from existing user permissions. The main contribution of this article is to formally define RMP and analyze its theoretical bounds. In addition to the above basic RMP, we introduce two different variations of the RMP, called the δ-Approx RMP and the minimal-noise RMP that have pragmatic implications. We reduce the known “Set Basis Problem” to RMP to show that RMP is an NP-complete problem. An important contribution of this article is also to show the relation of the RMP to several problems already identified in the data mining and data analysis literature. By showing that the RMP is in essence reducible to these known problems, we can directly borrow the existing implementation solutions and guide further research in this direction. We also develop a heuristic solution based on the previously proposed FastMiner algorithm, which is very accurate and efficient.

Security Web Release and Visualization of Remote Sensing Images

The growth of applications and the drastic increase in release of remote sensing images makes security as a mandatory requirement. In this paper, based on pre-existing web release system, a security web release and visualization scheme of remote sensing images is proposed. Firstly, user permission control is used to ensure that users with different permission obtain different quality levels images as well as different images processing function and operating function in Web release system. Secondly, the lightweight encryption method is introduced based on the characteristics of highresolution remote sensing images data and application requirements. The method includes security areas needing to provide confidentiality in remote sensing images selection and classification and lightweight disruption of security areas based on format compliance with different degree. Additionally, the security stocking processing of remote sensing images is introduced and threedimensional exaggeration of post-security processing images is showed. The experimental and analysis results approve the effectiveness of the proposed method which is suitable for practical use in the secure web release of high-resolution remote sensing images.

경량화 프로세스 추적을 통한 중요 데이터 유출 방지

컴퓨터와 개인 휴대 단말장치 사용의 대중화와 함께 이들 장치들을 이용한 개인정보 혹은 사업상 중요 데이터를 처리하고 저장하는 행위도 따라 증가하게 되었다. 따라서 이들 장치로부터 사용자의 허락 없이 중요 데이터가 자신의 장치로부터 빠져나가는 행위가 일어나서는 안 된다. 본 논문에서는 중요 파일과 관련된 파일 오픈 시스템 콜을 호출하는 프로세스를 일정시간 추적하여 네트워킹 인터페이스를 통해 이들 중요 데이터가 빠져 나가는 것을 방지하는 간단한 방법을 제시하였다. 제안된 방법은 기존 인증 혹은 암호화를 이용한 방법과 비교해 해킹 기술 발전과 하드웨어 및 소프트웨어의 새로운 취약점 발견과 무관하게 안정적으로 동작하는 이점이 있다. 특히, 본 논문에서는 리눅스 환경의 사용자와 커널 영역에서 제안된 알고리즘을 직접 구현하여 타당성을 검증하였다. As the usage of computers and mobile handsets is popularized, the processing and storing of private and business data are increased. Hence we note that these sensitive data should never be transferred out of these personal devices without user's permission. In this paper, we propose a simple method to prevent transferring the sensitive data out of personal computing devices through their networking interfaces. The proposed method determines which processes invoke open system call related to the sensitive data, and then traces them within a specific duration. The proposed scheme has advantage over the existing ones using authentication or encryption because it could be still working well independent upon the new attack technologies or the latest vulnerabilities of hardware and software. In order to verify the proposed algorithm, we test it by implementing the necessary codes at the user and kernel spaces of Linux.

Formal modelling and analysis of XML firewall for service-oriented systems

Firewalls have been designed as a major component to protect a network or a server from being attacked. However, due to their emphasis on packet filtering rather than verifying user permissions and examining packet contents, conventional firewalls are not suitable for protecting service-oriented systems from unauthorised service invocations. In this paper, we present a formal XML firewall security model for service-oriented systems, which supports user authentication and role-based user authorisation according to policy rules that can be updated dynamically. The formal model consists of two major components, namely the application model and the XML firewall model, which are designed compositionally using coloured Petri nets. We analyse both the application model and the XML firewall model using an existing Petri net tool, and demonstrate how key properties of the formal models can be verified, and how design errors can be detected and corrected at an early design stage.

Experience With Computerized Chemotherapy Order Entry

The elimination of errors related to chemotherapy administration remains an elusive goal. Computerized order entry has been shown to reduce errors. We assessed a chemotherapy computer order entry system for errors related to dosing and for the time required to prepare chemotherapy orders. A prospective study of all patients treated with chemotherapy over a 12-month period was performed. Chemotherapy order sets done via computerized order entry were reviewed for errors related to drug selection, dose calculations, decimal-point errors, and for exceeding a warning level set within the system. We also measured the time required to produce three order sets by hand versus by computer. There were no errors in dose calculations, decimal points, or drug selection for 2,558 drug administrations in 235 patients treated with 26 different chemotherapy regimens. The dose warning level was exceeded in 152 (6%) of drug administrations, but never without user permission to override the warning. The average time saved per order set using computer order entry was 10 minutes (P < .05). By using computer order entry with error-checking algorithms, it may be possible to eliminate a number of types of errors associated with chemotherapy administration without sacrificing efficiency.

QxDB: An open‐ended, generic database for quantitative physiology

Based on the generic data model of the Quantitative Kidney DataBase, QKDB (http://www.lami.univ-evry.fr/~srthomas/qkdb), we have built an open-source MySQL/PHP/Apache database package, QxDB (http://www.lami.univ-evry/~srthomas/qxdb), that is easily adapted for any research domain. As with QKDB, this package is designed particularly for quantitative results needed for hypothesis-based mathematical models. Since these are typically heterogeneous data-types (transport parameters, times-series, anatomical features, images, …), a central concern was the ability to easily add new data descriptors. Thus, adaptation to new domains is a simple matter of changing the entries in the DB “fields” table. Results curated in QxDB are supplemented by comments from the contributing experts, giving their evaluations of experimental techniques, breadth of validity of results, etc. Useful features of the web interface include: three levels of user permissions: simple user, contributor, and administrator; multi-criteria search using dynamic roll-down lists or full-text search; convenient entry of bibliographic references by hand, by file upload (formats EndNote, BibTeX, PubMed XML), or by pubmed id number; provision for simple, online extension of the descriptors lists during data entry; administrator management of users, correction/deletion/update of data records. By providing centralized storage for quantitative parameters from the experimental literature, this resource can serve not only to streamline the development of mathematical models, but will also be valuable for the general research community, in the spirit of the IUPS Physiome.

Experience With Computerized Chemotherapy Order Entry

Purpose The elimination of errors related to chemotherapy administration remains an elusive goal. Computerized order entry has been shown to reduce errors. We assessed a chemotherapy computer order entry system for errors related to dosing and for the time required to prepare chemotherapy orders. Methods A prospective study of all patients treated with chemotherapy over a 12-month period was performed. Chemotherapy order sets done via computerized order entry were reviewed for errors related to drug selection, dose calculations, decimal-point errors, and for exceeding a warning level set within the system. We also measured the time required to produce three order sets by hand versus by computer. Results There were no errors in dose calculations, decimal points, or drug selection for 2,558 drug administrations in 235 patients treated with 26 different chemotherapy regimens. The dose warning level was exceeded in 152 (6%) of drug administrations, but never without user permission to override the warning. The average time saved per order set using computer order entry was 10 minutes (P < .05). Conclusion By using computer order entry with error-checking algorithms, it may be possible to eliminate a number of types of errors associated with chemotherapy administration without sacrificing efficiency.

Chemical Inventory Management Solutions from CambridgeSoft

Managing a chemical inventory consists of tracking the usage, disposal, and ordering of substances that are at the heart of an enterprise’s endeavors.[...]

How to win an evolutionary arms race

To keep up with malware writers, software producers in both the commercial and open-source software worlds have adopted various automatic software update mechanisms. Some of these mechanisms distribute updates after requesting a user's permission; others install updates automatically. Although such systems provide some short-term relief, they will likely soon become ineffective, and further, they will also become extremely dangerous once they are inevitably co-opted by attackers. If we want the Internet to remain a viable way to communicate and collaborate, we must adopt another, perhaps radically different, model for securing our computers. To better understand this conclusion, we should first re-examine why developers and users are embracing automated update systems.

Design of the TJ-II remote participation system

The TJ-II remote participation design has focused initially on providing remote access to elements that depend exclusively on characteristics of the TJ-II environment: data acquisition, data access, and diagnostics control systems. Aspects related to advanced display tools, audio information from the control room or videoconference sessions can be addressed, at least in a first step, by using standard solutions. Remote access will be accomplished through http servers and web browsers as they are standard elements available on all platforms. Access security rests on a validation scheme in which users are identified through a username and password, these data being transferred in a secure way by using a secure socket layer (SSL). After username and password validation, the security system assigns a session ticket to the user, in which the user profile (access authorization list) is encoded. User profiles determine several access levels to the system. Such levels delimit the authorizations for accessing different services according to the allowed degree of interaction of remote users with the TJ-II environment. The ticket will be sent in every user query, in order to test user permission for the requested action. Services can be classified into five groups: Measurement channel setup, read/write access to the TJ-II databases (raw data, analyzed data, elaborated data, and relational databases), diagnostic control system monitoring/programming, advanced data acquisition system configuration and, finally, reading/writing information on TJ-II operation logbook. The TJ-II remote participation system is strongly coupled with the local data acquisition system.

Programming a view-based active access-control system for healthcare environments

Modern healthcare information systems need active security mechanisms that are capable of controlling access to medical data, according to the current need-to-know requirements of users. An access-control model that fits the above requirements is the already known C-TMAC (Context-based Team Access Control) model, which incorporates active security features and provides tight and just-in-time management of user permissions. In this paper, an implementation approach of an access control system that is based on the C-TMAC model is proposed. To further enforce fine-grained access control, we adopt view-based protection that permits the use of flexible granularities to define the objects to be protected. For this purpose, a simple case in a healthcare environment is assumed and a detailed description of setting up the corresponding access rules in a view-based fashion is presented. An implementation paradigm of the access control process that takes place on the presence of a user request is demonstrated.

Implementing context and team based access control in healthcare intranets.

The establishment of an efficient access control system in healthcare intranets is a critical security issue directly related to the protection of patients' privacy. Our C-TMAC (Context and Team-based Access Control) model is an active security access control model that layers dynamic access control concepts on top of RBAC (Role-based) and TMAC (Team-based) access control models. It also extends them in the sense that contextual information concerning collaborative activities is associated with teams of users and user permissions are dynamically filtered during runtime. These features of C-TMAC meet the specific security requirements of healthcare applications. In this paper, an experimental implementation of the C-TMAC model is described. More specifically, we present the operational architecture of the system that is used to implement C-TMAC security components in a healthcare intranet. Based on the technological platform of an Oracle Data Base Management System and Application Server, the application logic is coded with stored PL/SQL procedures that include Dynamic SQL routines for runtime value binding purposes. The resulting active security system adapts to current need-to-know requirements of users during runtime and provides fine-grained permission granularity. Apart from identity certificates for authentication, it uses attribute certificates for communicating critical security metadata, such as role membership and team participation of users.

Service design and inventory system &amp;#x2014; An object-oriented reusable software asset

Competition and the fast pace of technological evolution in today's global telecommunications industry are placing unique demands on the flexibility of operations support software systems. The industry must be capable of rapidly introducing new services, technologies, and organizational structures. Networks must be capable of being partitioned for various applications and administered based on complex ownership relationships among the various network components. User permissions must be readily adaptable to reflect various combinations of services, network partitions, and work functions. To meet the time constraints of the market, telecommunications providers require the ability to configure systems to meet their needs without relying on traditional software development intervals and external software development resources. Traditional software development methodologies generally do not provide the timeliness and flexibility required. The Service Design and Inventory (SDI) system — also known as the Attribute Design Database System (ADDS) — has achieved a high degree of reusability and customer-configurable adaptability through a unique application of object-oriented technology.