Code Polymorphism Meets Code Encryption: Confidentiality and Side-Channel Protection of Software Components

Cyber-attacks combine several techniques to compromise device's functionality, recover sensitive data or unveil IP design. Combined counter-measures are needed to address these complex attacks as a whole. We address attacks that rely on reverse engineering to recover application code and side-channel attacks to access sensitive data. We present POLEN, a toolchain and a processor architecture that combines two countermeasures: code encryption and code polymorphism to thwart such complex attacks. Code encryption reduces the useful information in memory dumps, preventing reverse engineering, by encrypting machine instructions before its deployment, and instructions are only decrypted inside the CPU. Code polymorphism regularly changes the observable behaviour of the program, making it unpredictable for an attacker, and reducing the possibility to exploit side-channel leakages. Using many configuration parameters, POLEN gives the developer the ability to adapt the security level to its application. We present our prototype implementation, based on the RISC-V Spike simulator and a modified LLVM toolchain. We demonstrate that POLEN reduces side-channel leakages through leakage assessments metrics. We show that POLEN achieves a good level of security against side-channel attacks while maintaining acceptable overheads on program performance.

Hospitable Non-verbal Staff Behaviour as a Means to Create Value to Customers

Background and aim: Service providers need to be competent in the provision of hospitality. However, the question is, how to operationalize the experience of hospitality? Existing literature shows limited concrete service characteristics that lead to a hospitable experience in service environments. This article presents user-centred research into human-related aspects that influence the hospitality experience of guests. Methods/methodology: Four case studies were performed in a public swimming pool and a catering setting. Due to COVID-19 restrictions, in three of the four cases, regular customers of the organizations were approached by email and asked to rate the importance of behaviours related to hospitable service. In the case of the public swimming pool, part of the data was collected prior to closing of the pool, allowing data collection via survey, on site or via email, depending on visitors’ preferences. Results: The results show which non-verbal employee characteristics contribute to the distinctive factors of hospitality, especially observable behaviour. The factors ‘modest appearance’ and ‘representative appearance’ seem to be of medium importance, and the factor ‘paralanguage’ seems to be the least important factor. Practical implications: This article shows that it is possible to identify concrete characteristics of employee behaviour that people associate with hospitality.

Danaher’s Ethical Behaviourism: An Adequate Guide to Assessing the Moral Status of a Robot?

This paper critically assesses John Danaher’s ‘ethical behaviourism’, a theory on how the moral status of robots should be determined. The basic idea of this theory is that a robot’s moral status is determined decisively on the basis of its observable behaviour. If it behaves sufficiently similar to some entity that has moral status, such as a human or an animal, then we should ascribe the same moral status to the robot as we do to this human or animal. The paper argues against ethical behaviourism by making four main points. First, it is argued that the strongest version of ethical behaviourism understands the theory as relying on inferences to the best explanation when inferring moral status. Second, as a consequence, ethical behaviourism cannot stick with merely looking at the robot’s behaviour, while remaining neutral with regard to the difficult question of which property grounds moral status. Third, not only behavioural evidence ought to play a role in inferring a robot’s moral status, but knowledge of the design process of the robot and of its designer’s intention ought to be taken into account as well. Fourth, knowledge of a robot’s ontology and how that relates to human biology often is epistemically relevant for inferring moral status as well. The paper closes with some concluding observations.

ARMv8-A System Semantics: Instruction Fetch in Relaxed Architectures

Computing relies on architecture specifications to decouple hardware and software development. Historically these have been prose documents, with all the problems that entails, but research over the last ten years has developed rigorous and executable-as-test-oracle specifications of mainstream architecture instruction sets and “user-mode” concurrency, clarifying architectures and bringing them into the scope of programming-language semantics and verification. However, the system semantics, of instruction-fetch and cache maintenance, exceptions and interrupts, and address translation, remains obscure, leaving us without a solid foundation for verification of security-critical systems software.In this paper we establish a robust model for one aspect of system semantics: instruction fetch and cache maintenance for ARMv8-A. Systems code relies on executing instructions that were written by data writes, e.g. in program loading, dynamic linking, JIT compilation, debugging, and OS configuration, but hardware implementations are often highly optimised, e.g. with instruction caches, linefill buffers, out-of-order fetching, branch prediction, and instruction prefetching, which can affect programmer-observable behaviour. It is essential, both for programming and verification, to abstract from such microarchitectural details as much as possible, but no more. We explore the key architecture design questions with a series of examples, discussed in detail with senior Arm staff; capture the architectural intent in operational and axiomatic semantic models, extending previous work on “user-mode” concurrency; make these models executable as test oracles for small examples; and experimentally validate them against hardware behaviour (finding a bug in one hardware device). We thereby bring these subtle issues into the mathematical domain, clarifying the architecture and enabling future work on system software verification.

A Curry-style Semantics of Interaction: From Untyped to Second-Order Lazy $$\lambda \mu $$-Calculus

We propose a “Curry-style” semantics of programs in which a nominal labelled transition system of types, characterizing observable behaviour, is overlaid on a nominal LTS of untyped computation. This leads to a notion of program equivalence as typed bisimulation.Our semantics reflects the role of types as hiding operators, firstly via an axiomatic characterization of “parallel composition with hiding” which yields a general technique for establishing congruence results for typed bisimulation, and secondly via an example which captures the hiding of implementations in abstract data types: a typed bisimulation for the (Curry-style) lazy $$\lambda \mu $$ λ μ -calculus with polymorphic types. This is built on an abstract machine for CPS evaluation of $$\lambda \mu $$ λ μ -terms: we first give a basic typing system for this LTS which characterizes acyclicity of the environment and local control flow, and then refine this to a polymorphic typing system which uses equational constraints on instantiated type variables, inferred from observable interaction, to capture behaviour at polymorphic and abstract types.

Impact of Clone Refactoring on External Quality Attributes of Open Source Softwares

Code refactoring is a “Process of restructuring an existing source code.”. It also helps in improving the internal structure of the code without really affecting its external behaviour”. It changes a source code in such a way that it does not alter the external behaviour yet still it improves its internal structure. It is a way to clean up code that minimizes the chances of introducing bugs. Refactoring is a change made to the internal structure of a software component to make it easier to understand and cheaper to modify, without changing the observable behaviour of that software component. Bad smells indicate that there is something wrong in the code that have to refactor. There are different tools that are available to identify and emove these bad smells. A software has two types of quality attributes- Internal and external. In this paper we will study the effect of clone refactoring on software quality attributes.

Conclusion

If the state in democracies like India engages in violence, then is this state still accepted by the people? The conception of legitimacy in this study is about observable behaviour, about if and why people accept power holders as authority, and not about whether it is the ideal way to engage with violent power holders within the discourses of normative political theory. And what we see in both the field-sites of this study, is acceptance, though it may be slow and appear flickering or contextual at time. The specific vision that the nation-state is, marked by geographical boundaries and internal sovereignty often needs to use violence to legitimize its existence. Such use of violence does not appear to be leading to a dis-illusionment with the form or the institutions of the state.

Development of the concept

Over time, concepts have evolved from the idea of a constitutional basis for behavioural problems, through unitary neurological formulations, to the recognition of neurocognitive heterogeneity and the impact of the social environment. Diagnoses have altered accordingly. ADHD and hyperkinetic disorder have different historical traditions, and still generate international differences in practice; however, they have succeeded in keeping research and clinical practice in touch with each other. This chapter takes a historical approach to describe the influences on the development of the concepts. Concepts are still changing, in response both to the historical context and to improving scientific knowledge. It may well be that recognition of heterogeneity at neural, psychological, and genetic levels will lead to more and better differentiated behavioural concepts. For the moment, however, the clinical utility of diagnosis based on observable behaviour is likely to maintain ADHD as the dominant idea organizing the field.