Access control is critical for many applications of the Internet of Things (IoT) since the owner of an IoT device (and application) may only permit one user to access a subset of the resources of the device. To provide access control for an IoT network, recent work adopted the capability-based access control (CBAC) model, which allows an IoT device to decide on the authorization by itself based on a capability token. However, the existing approaches based on CBAC directly attach the capability token at the end of CoAP when sending a request message. For the receiver, it is not easy to retrieve the capability token from the request message if the CoAP payload is present, because CoAP does not have a length field to indicate the size of its payload. To counter this problem, we propose a CoAP option, Cap-Token, to encapsulate a capability token when sending request messages. Because a CoAP option is independent from other CoAP fields, a receiver can get the capability token from the Cap-Token option of the request message without ambiguity. We also provide a compression mechanism to reduce the size of the Cap- Token option. Our evaluation shows that the compression mechanism can save the size of the option by 60%. Adding a compressed Cap-Token option to a request message increases the IP datagram size by 45 bytes, which is only 41% of the increase when directly attaching the capability token at the end of CoAP.

As "working with a browser" continues to gain acceptance, an emerging strategy adopted by software companies is to provide a Web version of their applications previously developed in a desktop environment. This article introduces a desktop application service framework that enables a Web server to host desktop applications and supports accessing these applications through a browser. The authors present a case study to show how the framework helps a virtual desktop cloud reduce bandwidth consumption by supporting browser-based access.

This paper presents a secure capability-based access control model (S-CBAC) for a distributed IoT environment. S-CBAC supports group access which allows using a single token to access common services running on multiple devices. It also leverages IPsec to ensure end-to-end security and data privacy.

Firefox OS, a new Web-based OS developed by Mozilla mainly for mobile platforms, is designed to realize the " Boot to the Web" concept for the open Web. It supports users booting to the network directly, launching remote applications and accessing remote data with the standard Web technologies. Although Firefox OS has adopted several mechanisms to enhance its security, its current design is lack of a mechanism to detect 1) applications calling Web API with unusual frequency, and 2) applications consuming abnormal amount of resources. In this paper, we propose an anomaly detection module which takes the system resource usage and the amount of interprocess communication as the inputs to detect whether the system has an anomaly. We also conduct several experiments to examine the ability of the proposed module. The results show that detection accuracy of our module is 0% in false negative rate and 12.5% in false positive rate.

With the increasing popularity of cloud computing, hosting services on a remote virtual machine becomes a trend due to its ease of use and cost saving. When migrating services to a cloud, users need to submit a resource plan to ensure service's performance. However, it is difficult to estimate the resources required by a virtual machine for running arbitrary services. To address the problem, we propose an estimation model for a resource plan. The model takes the performance characteristics of a physical machine as input and estimates virtual machine configurations. Using the estimated configurations, a user can obtain a virtual machine having similar performance characteristics to that of the physical machine. In this paper, we derive a model to estimate the CPU capability for creating a virtual machine on Xen. Our experiments show that our model can provide a resource plan for a virtual machine, which has the minimum performance difference compared with a designated physical machine.

Modern virtualization technologies provides an optimal use of underused hardware resources by sharing them among virtual machines hosted on the same physical machine. These technologies hence have been broadly adopted in many areas, such as server consolidation, virtualized network test beds, etc. A large-scale network test bed is considered one of the useful tools for evaluating or verifying advanced networking technologies. To construct a network test bed that matches as much as a real setup, the test bed should meet requirements of isolation, fidelity, repeatability, scalability, containment and extensibility. Among these requirements, scalability can be realized by the modern virtualization technology, whereas vulnerability and security weakness brought along with virtualization can also be harmful to the other requirements of a network test bed, like isolation and fidelity. This paper reviews the modern virtualization technologies, their resource management mechanisms, and the known attacks of these virtualization technologies. Then, we discuss the requirements of existing network test beds and the security impacts when introducing such modern virtualization technologies into a network test bed.

Augmented Reality (AR) is a new human-computer interaction technology which combines virtual images with physical reality in real time. Most AR systems adopt planar markers providing the positions and the angles information to correctly merge the visual objects. However, planer markers are difficult to detect under uneven illumination conditions or while the markers are partially occluded. In this paper, we proposed a new AR toolkit, named START, to improve the accuracy on marker detection. Two image thresholding methods, dynamical global threshold and adaptive threshold, are provided to cope with the marker detection under different illumination condition. Such a design allows users to select proper thresholding method according to users' requirements. We also propose a newly designed quadrangle detection and boundary reconstruction method to rebuild the boundaries of occluded markers. A partial pattern matching algorithm is applied to enhance the detection capabilities when the inner pattern of markers are also partially occluded. The result shows that, START can tolerate higher illumination condition, where the measurement of illuminance is twice than the limitation of existing AR toolkits. START can also recognize markers with triple larger occluded area compared to the existing AR toolkits.