The right to privacy is not absolute and is often established by context and the need to know.  The nature of the university environment sometimes distorts the sanctity of privacy because the “need to know” is so profuse.  Although students are guaranteed the right to keep essential but confidential information private under the Family Educational Rights and Privacy Act of 1974, student data are vulnerable because of the need for academic departments to share and manage these data.  Recent articles in the popular press suggest consumers as a whole are questioning organizational practices that are designed to protect their personal information.  Similar practices occur in the university setting, but fewer concerns are being publicized.  Because of the vast amount of data sharing that occurs in an academic setting, it is imperative that we ensure the employees adhere to privacy policies that are structured to impose conscientious behaviors.  University privacy policies are in practice, but there is no method of determining their effectiveness.  This research seeks to ascertain the attitudes of employees regarding student privacy.  Using a 15-item instrument, this study explores employees’ privacy perceptions of a large university located in the Southeastern U.S.  Our study examines the level of concerns employees have concerning errors, unauthorized secondary use, improper access and collection.

While the Internet is dramatically changing the way business is conducted, security and privacy issues are of deeper concern than ever before.  A primary fault in evolutionary electronic commerce systems is the failure to adequately address security and privacy issues; therefore security and privacy policies are either developed as an afterthought to the system or not at all.  One reason or this failure is the difficulty in applying traditional software requirements engineering techniques to systems in which policy is continually changing due to the need to respond to the rapid introduction of new technologies which compromise those policies.  Security and privacy should be major concerns from the onset, but practitioners need new systematic mechanisms for determining and assessing security and privacy.  To provide this support, we employ scenario management and goal-driven analysis strategies to facilitate the design and evolution of electronic commerce systems.  Risk and impact assessment is critical for ensuring that system requirements are aligned with an enterprise’s security policy and privacy policy.  Consequently, we tailor our goal-based approach by including a compliance activity to ensure that all policies are reflected in the actual system requirements.  Out integrated strategy thus focuses on the initial specification of security policy and privacy policy and their operationalization into system requirements.  The ultimate goal of our work is to demonstrate viable solutions for supporting the early stages of the software lifecycle, specifically addressing the need for novel approaches to ensure security and privacy requirements coverage.

This paper presents the design of NetPIPE, a new Network Protocol Independent Performance Evaluator.  NetPIPE maps the performance of a network across a wide range and presents the data in a new manner…

This paper is a review of an ongoing project to simplify security auditing of the world-wide TCP/IP network of some thirty thousand hosts, internal to Sun Microsystems.  This paper also examines the issues, which this project raises; it details the conception, design, development of, and one year\‘s results gathered from, AutoHack, a tool specially created to probe, audit, and produce security reports for, a TCP/IP network of this size…

This report is an initial foray into the relatively unexplored terrain of using mobile agents for intrusions detection systems.  It is a research guide that helps identify the most promising areas of mobile agent IDS research.  After providing some background information, we enumerate the problems found in current IDSs and propose potential solutions offered by MAs….

This paper addresses the problem of automatically detecting specific patterns or shapes in time-series data.  A novel and flexible approach is proposed based on segmental semi-Markov models.  Unlike dynamic time-warping or template-matching, the proposed framework provides a principled and coherent framework for leveraging both prior knowledge and training data….

With the rapid growth of high-speed networking and microprocessing power, metasystems have become increasingly popular. The need for protection and security in such environments has never been greater. However, the conventional approach to security, that of enforcing a single system-wide policy, will not work for the large-scale distributed systems we envision. Our new model shifts the emphasis from \“system as enforcer: to user-deifinable policies, making users responsible for the security of their objects. This security model has been implented as part of the Legion project. Legion is an object-oriented metacomputing system, with strong support for autonomy. This includes support for per-object, user-defined policies in many areas, including resource management and security. This paper briefly describes the Legion system, presents our security model, and discusses the realization of that model in Legion.

We present the design of a framework for secure communication.  This framework incorporates authentication and secret message passing without the restructuring of applications: through the use of inheritance, communication classes preserve interfaces while adding security.  Each service determines the security measures it will use and the system ensures clients communicate using the correct protocol.  We demonstrate extensibility by implementing delegation of authority without modifying the underlying framework.  Our delegation protocol permits a disconnected delegator and efficiently supports very frequent delegation and revocation. We describe our implementation of this framework for Choices, an object oriented operating system.

Most of the current audio media intellectual property rights protection schemes suffer from one essential drawback: the high quality of any lineout-linein connection, i.e. the ability to record directly from the “speaker” so to speak, with a surprisingly minimal distorsion.

[...]

We propose a solution in which content is distributed on regular media (e.g. CD), but is ``play-able\” only on DMAT-enabled devices. Once this link is satisfied the next step invloves modifying the devices to include device-identifying fingerprinting technology in the analog stream domain (see figure).

Datagram services provide a simple, flexible, robust, and scalable communication abstraction; their usefulness has been well demonstrated by the success of IP, UDP, and RPC.  Yet, the overwhelming majority of network security protocols that have been proposed are geared towards connection-oriented communications.  The few that do cater to datagram communications tend to either rely on long term host-pair keying or impose a session-oriented (i.e., relying connection setup) semantics. Separately, the concept of flows has received a great deal of attention recently, especially in the context of routing and QoS.  A flow characterizes a sequence of datagrams sharing some pre-defined attributes.  In this paper, we advocate the use of flows as a basis for structuring secure datagram communications.  We support this by proposing a novel protocol for datagram security based on flows.  Our protocol achieves zero-message keying, thus preserving the connectionless nature of datagram, and makes use of soft state, thus providing the per-packet processing efficiency of session-oriented schemes.  We have implemented an instantiation for IP in the 4.4BSD kernel, and we provide a description for our implementation along with performance results.

The general secure multi-party computation problem is when multiple parties (say, Alice and Bob) each have private data (respectively, a and b) and seek to compute some function f(a,b) without revealing to each other anything unintended (i.e., anything other than what can be inferred from knowing f(a,b)).  It is well known that, in theory, the general secure multi-party computation problem is solvable using circuit evaluation protocols.  While this approach is appealing in its generality, the communication complexity of the resulting protocols depend on the size of the circuit that expresses the functionality to be computed.  As Goldreich has recently pointed out [6], using the solutions derived from these general results to solve specific problems can be impractical; problem-specific solutions should be developed, for efficiency reasons.  This paper is a first step in this direction for the area of computational geometry.  We give simple solutions to some specific geometric problems, and in doing so we develop some building blocks that we believe will be useful in the solution of other geometric and combinatorial problems as well.

In this paper, we present a general-purpose mobile agent framework, called Discovery developed at the Maryland Center for Telecommunications Research (MCTR) using the Java language.  Mobile agents are small objects containing intelligent code, capable of moving around the network, reasoning, learning, and communcating with their peers and the environment.  The popularity of mobile agents is a result of several application domains where the use of mobile based solutions promise to generate a robust, and flexible solution.  Discovery defines an Agent Transfer Protocol (ATP) that implements agent serialization, transmission, authentication, error detection, and recovery.  The agent runtime system provides a platform-independent execution environment for mobile agents, and defines an interface to create, clone, transport, suspend, resume, and termintae agents.  This paper describes the key components of the Discovery framework, which includes an agent registry module, agent ocation tracking services, and the server\‘s knowledge base.  The Discovery architecture has been used to implement mobile agent based applications for network monitoring, intrusion detection, and ATM network management.