Today’s smartphone operating systems frequently fail to provide users with visibility into how third-party applications collect and share their private data. We address these shortcomings with TaintDroid, an efficient, system-wide dynamic taint tracking and analysis system capable of simultaneously tracking multiple sources of sensitive data. TaintDroid enables realtime analysis by leveraging Android’s virtualized execution environment. TaintDroid incurs only 32p performance overhead on a CPU-bound microbenchmark and imposes negligible overhead on interactive third-party applications. Using TaintDroid to monitor the behavior of 30 popular third-party Android applications, in our 2010 study we found 20 applications potentially misused users’ private information; so did a similar fraction of the tested applications in our 2012 study. Monitoring the flow of privacy-sensitive data with TaintDroid provides valuable input for smartphone users and security service firms seeking to identify misbehaving applications.

/pdf/taintdroid-an-information-flow-tracking-system-for-realtime-5d8smsr0iy.pdf

TaintDroid: An Information-Flow Tracking System for Realtime Privacy Monitoring on Smartphones

Today's smartphone operating systems frequently fail to provide users with adequate control over and visibility into how third-party applications use their private data. We address these shortcomings with TaintDroid, an efficient, system-wide dynamic taint tracking and analysis system capable of simultaneously tracking multiple sources of sensitive data. TaintDroid provides realtime analysis by leveraging Android's virtualized execution environment. TaintDroid incurs only 14% performance overhead on a CPU-bound micro-benchmark and imposes negligible overhead on interactive third-party applications. Using TaintDroid to monitor the behavior of 30 popular third-party Android applications, we found 68 instances of potential misuse of users' private information across 20 applications. Monitoring sensitive data with TaintDroid provides informed use of third-party applications for phone users and valuable input for smartphone security service firms seeking to identify misbehaving applications.

/pdf/taintdroid-an-information-flow-tracking-system-for-realtime-3fnz9lwdso.pdf

TaintDroid: an information-flow tracking system for realtime privacy monitoring on smartphones

Ordered Binary-Decision Diagrams (OBDDs) represent Boolean functions as directed acyclic graphs. They form a canonical representation, making testing of functional properties such as satisfiability and equivalence straightforward. A number of operations on Boolean functions can be implemented as graph algorithms on OBDD data structures. Using OBDDs, a wide variety of problems can be solved through symbolic analysis. First, the possible variations in system parameters and operating conditions are encoded with Boolean variables. Then the system is evaluated for all variations by a sequence of OBDD operations. Researchers have thus solved a number of problems in digital-system design, finite-state system analysis, artificial intelligence, and mathematical logic. This paper describes the OBDD data structure and surveys a number of applications that have been solved by OBDD-based symbolic analysis.

/pdf/symbolic-boolean-manipulation-with-ordered-binary-decision-cpwxp0mluy.pdf

Symbolic Boolean manipulation with ordered binary-decision diagrams

Physical Unclonable Functions (PUFs) are innovative circuit primitives that extract secrets from physical characteristics of integrated circuits (ICs). We present PUF designs that exploit inherent delay characteristics of wires and transistors that differ from chip to chip, and describe how PUFs can enable low-cost authentication of individual ICs and generate volatile secret keys for cryptographic operations.

/pdf/physical-unclonable-functions-for-device-authentication-and-4tsc0jtbn3.pdf

Physical unclonable functions for device authentication and secret key generation

Physical Unclonable Functions for Device Authentication and Secret Key Generation

The diversity and importance of the role played by RNAs in the regulation and development of the cell are now well-known and well-documented. This broad range of functions is achieved through specific structures that have been (presumably) optimized through evolution. State-of-the-art methods, such as McCaskill's algorithm, use a statistical mechanics framework based on the computation of the partition function over the canonical ensemble of all possible secondary structures on a given sequence. Although secondary structure predictions from thermodynamics-based algorithms are not as accurate as methods employing comparative genomics, the former methods are the only available tools to investigate novel RNAs, such as the many RNAs of unknown function recently reported by the ENCODE consortium. In this paper, we generalize the McCaskill partition function algorithm to sum over the grand canonical ensemble of all secondary structures of all mutants of the given sequence. Specifically, our new program, RNAmutants, simultaneously computes for each integer k the minimum free energy structure MFE(k) and the partition function Z(k) over all secondary structures of all k-point mutants, even allowing the user to specify certain positions required not to mutate and certain positions required to base-pair or remain unpaired. This technically important extension allows us to study the resilience of an RNA molecule to pointwise mutations. By computing the mutation profile of a sequence, a novel graphical representation of the mutational tendency of nucleotide positions, we analyze the deleterious nature of mutating specific nucleotide positions or groups of positions. We have successfully applied RNAmutants to investigate deleterious mutations (mutations that radically modify the secondary structure) in the Hepatitis C virus cis-acting replication element and to evaluate the evolutionary pressure applied on different regions of the HIV trans-activation response element. In particular, we show qualitative agreement between published Hepatitis C and HIV experimental mutagenesis studies and our analysis of deleterious mutations using RNAmutants. Our work also predicts other deleterious mutations, which could be verified experimentally. Finally, we provide evidence that the 3′ UTR of the GB RNA virus C has been optimized to preserve evolutionarily conserved stem regions from a deleterious effect of pointwise mutations. We hope that there will be long-term potential applications of RNAmutants in de novo RNA design and drug design against RNA viruses. This work also suggests potential applications for large-scale exploration of the RNA sequence-structure network. Binary distributions are available at http://RNAmutants.csail.mit.edu/.

Efficient Algorithms for Probing the RNA Mutation Landscape

We present new protocols for Byzantine agreement in the synchronous and authenticated setting, tolerating the optimal number of f faults among \(n=2f+1\) parties. Our protocols achieve an expected O(1) round complexity and an expected \(O(n^2)\) communication complexity. The exact round complexity in expectation is 10 for a static adversary and 16 for a strongly rushing adaptive adversary. For comparison, previous protocols in the same setting require expected 29 rounds.

Synchronous Byzantine Agreement with Expected O(1) Rounds, Expected \(O(n^2)\) Communication, and Optimal Resilience

It is shown how general binary decision diagrams (BDDs), i.e., BDDs where input variables are allowed to appear multiple times along any path in the BDD, can be used to check for Boolean satisfiability. This satisfiability checking strategy is based on an input smoothing operation on general BDDs. Various input smoothing strategies for general BDDs are developed. In order to verify the equivalence of two functions f/sub 1/ and f/sub 2/, f/sub 1/(+)f/sub 2/ is checked for satisfiability. Using general BDDs different implementations of a 16*16 multiplier, a modified Achilles' heel function and a complex add-shift function were verified. It was not possible to construct OBDDs for any of the three functions. >

Boolean satisfiability and equivalence checking using general binary decision diagrams

Oblivious routing can be implemented on simple router hardware, but network performance suffers when routes become congested. Adaptive routing attempts to avoid hot spots by re-routing flows, but requires more complex hardware to determine and configure new routing paths. We propose onchip bandwidth-adaptive networks to mitigate the performance problems of oblivious routing and the complexity issues of adaptive routing. In a bandwidth-adaptive network, the bisection bandwidth of network can adapt to changing network conditions. We describe one implementation of a bandwidth-adaptive network in the form of a two-dimensional mesh with adaptive bidirectional links, where the bandwidth of the link in one direction can be increased at the expense of the other direction. Efficient local intelligence is used to reconfigure each link, and this reconfiguration can be done very rapidly in response to changing traffic demands. We compare the hardware designs of a unidirectional and bidirectional link and evaluate the performance gains provided by a bandwidth-adaptive network in comparison to a conventional network under uniform and bursty traffic when oblivious routing is used.

/pdf/oblivious-routing-in-on-chip-bandwidth-adaptive-networks-591o5x0xi9.pdf

Oblivious Routing in On-Chip Bandwidth-Adaptive Networks

List of Figures.- List of Tables.- Preface.- Acknowledgements.- 1 Introduction.- 1.1 IC Design Systems.- 1.2 Implementation Verification.- 1.3 Testing.- 1.4 Synthesis For Testability.- 1.5 Outline.- 2 Sequential Test Generation.- 2.1 Preliminaries.- 2.2 Methods for Sequential Test Generation.- 2.2.1 Random Techniques.- 2.2.2 Deterministic Techniques.- 2.3 Test Generation Strategy.- 2.4 Cover Extraction and Combinational ATG.- 2.5 Justification.- 2.6 Initialization of Circuits.- 2.7 State Differentiation.- 2.8 Identification of Redundant Faults.- 2.9 Test Generation Results Using STEED.- 2.10 Conclusions.- 3 Test Generation Using RTL Descriptions.- 3.1 Preliminaries.- 3.2 Previous Work.- 3.3 Global Strategy for Test Generation.- 3.4 State Justification.- 3.5 Indexed Backtracking.- 3.6 Conflict Resolution.- 3.6.1 Assembling the equations.- 3.7 State Differentiation.- 3.8 Test Generation Results Using ELEKTRA.- 3.9 Conclusions.- 4 Sequential Synthesis for Testability.- 4.1 Preliminaries.- 4.1.1 Eliminating Sequential Redundancies.- 4.2 Previous Work.- 4.3 Theoretical Results.- 4.3.1 An Unconditional Testability Theorem.- 4.3.2 Logic Partitioning.- 4.4 The Synthesis and Test Strategy.- 4.5 Detection of Invalid States.- 4.6 Detection of Equivalent States.- 4.7 Experimental Results.- 4.8 Conclusions.- 5 Verification of Sequential Circuits.- 5.1 Preliminaries.- 5.2 Previous Work.- 5.3 Implicit STG Traversal.- 5.3.1 Incompletely-specified machines.- 5.4 Implicit STG Enumeration.- 5.4.1 Traversal versus enumeration.- 5.5 Experimental Results.- 5.6 Conclusions.- 6 Symbolic FSM Traversal Methods.- 6.1 Preliminaries.- 6.1.1 Binary Decision Diagrams.- 6.1.2 Sets and Characteristic Functions.- 6.2 Traversal by Recursive Range Computation.- 6.3 Traversal based on Transition Relations.- 6.3.1 Iterative Squaring.- 6.3.2 Detecting Equivalent States.- 6.4 Depth-First Geometric Chaining.- 6.4.1 An Autonomous Counter.- 6.4.2 A Loop Counter.- 6.5 A Mixed Traversal Algorithm.- 6.5.1 Introduction.- 6.5.2 k-Convergence and t-Periodicity.- 6.5.3 Traversing Cascaded Machines.- 6.5.4 Traversing Mutually Interacting Machines.- 6.5.5 Generalization to Multiple Submachines.- 6.5.6 Input-Selection-Based Traversal.- 6.6 Implementation of Algorithm.- 6.7 Experimental Results.- 6.8 Conclusions.- 7 Conclusions.- 7.1 Test Generation.- 7.2 Synthesis for Testability.- 7.3 Verification.- 7.4 Directions for Future Work.

Srinivas Devadas

Papers

Efficient Algorithms for Probing the RNA Mutation Landscape

Synchronous Byzantine Agreement with Expected O(1) Rounds, Expected \(O(n^2)\) Communication, and Optimal Resilience

Boolean satisfiability and equivalence checking using general binary decision diagrams

Oblivious Routing in On-Chip Bandwidth-Adaptive Networks

Sequential Logic Testing and Verification