Because information flow control mechanisms often rely on an underlying authorization mechanism, their security guarantees can be subverted by weaknesses in authorization. Conversely, the security of authorization can be subverted by information flows that leak information or that influence how authority is delegated between principals. We argue that interactions between information flow and au...

Designing bug-free medical device software is difficult, especially in complex implantable devices that may be used in unanticipated contexts. Safety recalls of pacemakers and implantable cardioverter defibrillators due to firmware problems between 1990 and 2000 affected over 200,000 devices, comprising 41% of the devices recalled and are increasing in frequency. There is currently no formal me...

A fundamental requirement for achieving rapid turn-round and short timeto-market in embedded software and system development is to achieve high level of reuse. Platform-based design offers a systematic way to make tradeoff between the conflicting requirements of flexibility and reuse. This paper describes a modelintegrated approach in controlling and exploiting flexibility via the disciplined c...

Nominal techniques are based on the idea of sets with a finitelysupported atoms-permutation action. In this paper we consider the idea of sets with a finitely-supported atoms-renaming action (renamings can identify atoms; permutations cannot). We show that these exhibit many of the useful qualities found in traditional nominal techniques; an elementary sets-based presentation, inductive datatyp...

We propose a new global SPACING constraint that is useful in modeling events that are distributed over time, like learning units scheduled over a study program or repeated patterns in music compositions. First, we investigate theoretical properties of the constraint and identify tractable special cases. We propose efficient DC filtering algorithms for these cases. Then, we experimentally evalua...

Results on routing and multicasting for large-scale internets are summarized. The technical material discussed assumes familiarity with the content of our proposal and previous quarterly reports submitted in this project.

Noninterference is a popular semantic security condition because it offers strong end-to-end guarantees, it is inherently compositional, and it can be enforced using a simple security type system. Unfortunately, it is too restrictive for real systems. Mechanisms for downgrading information are needed to capture real-world security requirements, but downgrading eliminates the strong compositiona...

This paper deals with modeling heterogeneous volumetric objects as point sets with attributes using trivariate B-splines. In contrast to homogeneous volumes with uniform distribution of material and other properties, a heterogeneous volumetric object has a number of variable attributes assigned at each point. An attribute is a mathematical model of an object property of arbitrary nature (materi...

Network operators and service providers are interested in mobile networks due to the number of new services that can be deployed using the infrastructure of the embedded network. Probably, the most attractive service is the seamless Internet connectivity offered by NEMO, the NEtwork MObility protocol. Such service would allow passengers to benefit from a seamless Internet connectivity while the...

with input from many other team members 6/1/2007 "DISCLAIMER: The information contained in this paper does not represent the official policies, either expressed or implied, of the Defense Advanced Research Projects Agency (DARPA) or the Department of Defense. DARPA does not guarantee the accuracy or reliability of the information in this paper." Austin Robot Technology's (ART's) entry in the DA...