Jian Xiao
email: xiaojian@net.pku.edu.cn

Yu Zhang
email: zhangyu@net.pku.edu.cn

Shuwei Chen

Huashan Yu

An Application-level Scheduling with Task Bundling Approach for Many-Task Computing in Heterogeneous Environments

Keywords: Keyword. application-level scheduling, many task computing, task bundling, traditional scheduling heuristics

Many-Task Computing (MTC) is a widely used computing paradigm for large-scale task-parallel processing. One of the key issues in MTC is to schedule a large number of independent tasks onto heterogeneous resources. Traditional task-level scheduling heuristics, like Min-Min, Sufferage and MaxStd, cannot readily be applied in this scenario. As most of MTC tasks are usually fine-grained, the resource management overhead would be prominent and the multi-core nodes might become hard to be fully utilized. In this paper we propose an application-level scheduling with task bundling approach that utilizes the knowledge of both applications and tasks to overcome these difficulties. Furthermore we adapt the traditional task-level heuristics to our model for MTC scheduling. Experimental results show that these application-level scheduling approaches, when equipped with task bundling, can deliver good performance for Many-Task Computing in terms of both Makespan and Flowtime.

Introduction

Many-task Computing (MTC) [START_REF] Raicu | Toward Loosely Coupled Programming on Petascale Systems[END_REF] [2] is a loosely coupled computing paradigm that is widely used for scientific applications such as parameter sweep, Monte Carlo simulations, data parallelism, bioinformatics (like BLAST) and image manipulation [START_REF] Raicu | Many-Task Computing for Grids and Supercomputers[END_REF], and the major goal of which is to complete a large number of independently-schedulable tasks within a short period of time. The application in this paradigm is usually developed upon abundant legacy executables accumulated in scientific domain. A scientific computing problem is represented as a MTC job, which could contain as many as thousands to millions fine-grained tasks, and thus the computation complexity could be extraordinarily demanding. The developments of large-scale processing techniques such as Supercomputer, Grid and Cloud in recent years have made it possible for MTC jobs to get results in a reasonable timeframe [START_REF] Raicu | Toward Loosely Coupled Programming on Petascale Systems[END_REF].

To efficiently execute MTC tasks in these large-scale heterogeneous environments, task scheduling is a key issue. However, scheduling MTC tasks is not a trivial problem. The difficulty of MTC scheduling comes from not only the heterogeneity and dynamicity of resources, but also the large number of relatively-small tasks, which the latter might result in huge scheduling cost and starving a lot of computing nodes, and result in severe resource waste for multi-processor computers.

In this paper, we propose an application-level scheduling with task bundling solution to this problem. The proposed approach divides the scheduling process into two stages. In the first stage, the algorithm works at application and job level, matching job and resource by application-resource pairing and job selection, so as to improve the job's computing performance and resource's utilization simultaneously; then in the second stage, the algorithm works at task level to select a package of tasks (task selection) from the previously selected job and then allocates the package to the selected resource in one dispatch, so as to amortize the resource management overhead among tasks in same package and meanwhile exploit the intra-node capacity.

The remaining of the paper is organized as follows. Section 2 describes the problem. Section 3 reviews related works. In Section 4 we present our scheduling approach. Section 5 presents the experimental results. Finally Section 6 concludes the paper.

Problem Statement

Terminologies in this paper are used as in [START_REF] Isard | Quincy: Fair Scheduling for distributed Computing Clusters[END_REF]. An application refers to a type of jobs, while a job is an instance of some application. Instances/jobs of the same application run the same program and use the same data resources, but read different inputs. And a job is a collection of independent tasks. We will use the terms "application" and "job type", "application instance" and "job" interchangeably.

A typical example of MTC application is Genome Alternative Splicing [START_REF] Kim | ECgene: Genome-based EST clustering and gene modeling foralternative splicing[END_REF] in bioinformatics that predicts a genome's all possible transcriptomes. An application instance/job in this context refers to an actual genome submitted by some user intending to find the genome's transcriptomes, and a task is a run of the program to search all possible transcriptomes of a single gene. Generally a genome consists of tens of thousands of genes, which means such a job may contain tens of thousands of independent tasks. In our practice, 70% or more of tasks in a typical job was completed within 1 second [START_REF] Yu | A Self-Optimizing Computation Partitioning Algorithm for Distributed Many-task Computing[END_REF].

We assume multiple applications A , … , A , each of which may contain several jobs. Applications are heterogeneous, which means every application has its own pattern of computing-resource requirement, preferring such as I/O or CPU speed, and this constitutes the application-resource knowledge to utilize.

In our work we consider a large-scale heterogeneous system R , … , R , consisting of network-connected single-or multi-processor computing nodes, for these applications processing. Processors of each computing node in are homogeneous, providing equal processing speed for the jobs of the same type, whereas processors from different nodes are heterogeneous.

2.1

Job model and task model

A job is a large collection of independent and relatively-small tasks sharing the same computing-resource requirement. The k-th instance of application A is denoted as J , τ , : h 1, … , n , , k=1,2,.., N , where N is the job number of application A , n , is the task number of job J , and τ , is a task contained in this job.

Conventionally, the estimated execution time of each task τ , is supposed to be available in advance.

Scheduling many tasks as a challenge

To schedule MTC tasks in a large-scale heterogeneous system would be a real challenge, as two traditionally negligible factors become prominent now:  Resource management overhead. For a computing node to execute task, it should be allocated and configured first, and be released after the computation. The time cost of this resource management would be significant, compared with a single MTC task's computing cost itself.  Intra-node resource utilization. MTC tasks are often the small-scale parallel or even sequential programs which require only few resources to complete, so a single MTC task is unable to fully exploit the power of the today's multi-core computing node, and thus cause intra-node resource waste.

Objectives

This work aims to make a trade-off between Makespan and Flowtime, so as to optimize these two competing objectives [START_REF] Xu | Chemical reaction optimization for task scheduling in grid computing[END_REF] simultaneously. We denote interval s , , e , ] as the k-th period when job i occupied node j, from time s , to e , . This means that node j is processing the tasks from job i during this period, and there may be several non-intersect time periods for this job on the same node. The Makespan and Flowtime of job i are given by ( ) , max{max{ }}

k i i j j k makespan e  (1) ( ) ( ) , , ( )
k k i j i j i j j k flowtime cn e s      ( 2
)
where cn is the core number of R . Based on these, three metrics are derived for performance comparisons:

 Overall Makespan: the maximum of all makespan , used for measuring overall computing performance.  Overall Flowtime: the sum of all flowtime , used for measuring the CPU cost to achieve the overall computing performance.

 Average Job Makespan: the average of all makespan , used for measuring the QoS of the scheduling.

Related Work

As a well-abstracted model, optimal scheduling of tasks for multiple processors is a NP-complete problem [START_REF] Garey | Strong' NP-CompletenessResults: Motivation, Examples, and Implications[END_REF], and thus many heuristics and meta-heuristics are proposed in literatures. Heuristics are directly designed for tasks scheduling, such as MinMin [START_REF] Braun | A comparison of eleven static heuristics for mapping a class of independent tasks onto heterogeneous distributed computing systems[END_REF], Sufferage [START_REF] Maheswaran | Dynamic matching and scheduling of a class of independent tasks onto heterogeneous computing systems[END_REF] and MaxStd [START_REF] Munir | MaxStd: A Task Scheduling Heuristic for Heterogeneous Computing Environment[END_REF], while meta-heuristics are combinatorial optimization techniques used indirectly for task scheduling, and the representative meta-heuristics include Genetic Algorithm (GA) [START_REF] Braun | A comparison of eleven static heuristics for mapping a class of independent tasks onto heterogeneous distributed computing systems[END_REF], Simulated Annealing (SA) [START_REF] Braun | A comparison of eleven static heuristics for mapping a class of independent tasks onto heterogeneous distributed computing systems[END_REF], Particle Swarm Optimization (PSO) [START_REF] Izakian | A Novel Particle Swarm Optimization Approach for Grid Job Scheduling[END_REF] and Chemical Reaction Optimization (CRO) [START_REF] Xu | Chemical reaction optimization for task scheduling in grid computing[END_REF]. These algorithms work at task level, and require the prediction of each task's execution time on each machine, forming an ETC (Expected Time to Compute) matrix [START_REF] Braun | A comparison of eleven static heuristics for mapping a class of independent tasks onto heterogeneous distributed computing systems[END_REF].Though both heuristics and meta-heuristics are classic solutions to traditional HTC (High Throughput Computing) [START_REF] Raicu | Toward Loosely Coupled Programming on Petascale Systems[END_REF], they are not suitable for MTC. The drawback is, when scheduling hundreds of thousand or even more tasks to large-scale resources, the overhead would be overwhelming. What's more, as these algorithms neglect the cost for resource management, the task-level scheduling for MTC may cause a great waste in repeatedly creating and releasing runtime environment. Several research works consider multiple applications scheduling in context of Bag-of-Tasks (BoT) [START_REF] Iosup | The performance of bags-of-tasks in large-scale distributed systems[END_REF] or cloud computing [START_REF] Isard | Quincy: Fair Scheduling for distributed Computing Clusters[END_REF], but mainly focus either on ETC based task-level scheduling or homogeneous cluster environment. And these works pay litter attention to the applications' differences in resource requirements, which is an important knowledge for scheduling optimization.

Few researches exist on task bundling strategy that dispatches a package of tasks rather than a single task to the resource at every scheduling event. In [START_REF] Raicu | Falkon: a Fast and Light-weight tasK execution framework[END_REF], fixed number of tasks bundling policy is used, but it is too simple for practical use. An improved strategy proposed in [START_REF] Li | A Scheduling Algorithm Based on Task Complexity Estimating for Many-Task Computing[END_REF] bundles the tasks according to the size of input file and tries to balance the task packages in terms of total input file size in the package. Some recent works concern not only the performance but also the resource cost for this performance. In [START_REF] Xu | Chemical reaction optimization for task scheduling in grid computing[END_REF] and [START_REF] Izakian | A Novel Particle Swarm Optimization Approach for Grid Job Scheduling[END_REF], meta-heuristics CRO and PSO are adopted to minimize Makespan and Flowtime simultaneously. These works verified the value of meta-heuristics for multi-objective optimization. However, the applicable conditions of these meta-heuristics are confined to small number of large tasks and negligible runtime environment preparation time (compared to task granularity).

Scheduling Algorithm

Our scheduling algorithm is performed in a centralized manner. The computing node sends a task request to the scheduler whenever it has no task to make a local allocation; the scheduler processes the request by assigning one or more tasks to the computing node.

Figure 1 shows the algorithm's framework. Firstly, a job-resource pair is determined, indicating the job which the computing node is allocated to; then a subset of tasks from the selected job is allocated to the computing node in one dispatch. The algorithm exploits the following knowledge about applications and tasks.  Application's parallel degree, , . Application-resource knowledge, reflecting the match between application's intrinsic nature in I/O or CPU preference and the resource's system architecture. Due to the I/O bottleneck, when the processor number of a node exceeds some limit, giving more processors will not help to improve parallel speed. We denote this limit as D , , the degree of parallelism of application A on node R . D , is an integer between 1 and the processor number cn of R , represents the logical processor number that R offers to A and can be obtained by historical execution log.  Application's processing rate, , . The other kind of application-resource knowledge. We denote r , as the processing rate of each R 's logical processor for application A . This concept comes from the fact that, for any two computing nodes and different tasks from the same application, the ratio of each task's execution times on the two nodes will be quite stable and close to each other. To get the r , matrix, we can choose a reference node, say R , and let r , =1; for j 1, the r , is the ratio of Benchmark task's execution time on node R and R .  Task's estimated execution time. This is the typical task-resource knowledge, usually denoted as the ETC matrix in literatures. We define the task's estimated complexity as the estimated execution time on the reference node. So given the task's estimated complexity, the task's estimated execution time on any other node can be derived by using the application's processing rate matrix. We use task's estimated complexity to measure the task's granularity and workload.

Job-resource matching

The job-resource matching stage will select a job and a node from the candidates, and allocate the chosen node to the job. We consider both the requesting node's (system utilization) and the application's (computing performance) perspectives, so as to optimize the Makespan and Flowtime simultaneously.

1) Application's perspective Given the requesting node R , all candidate applications are competing for this resource. We use the Node Importance (NI) to quantify how important R is for application A to achieve high computing performance, which is determined by Scheduling framework 1(J , , R ) Job-resource matching 2 Task-package BTask-bundling (J , , R ) 3 Dispatch task package B to R

m i j i k i j i k k i r r NI r       (3)
where ,.

i r is mean value of the i-th row of processing rate matrix and ω , is the weight that satisfies ω , ⋯ ω , 1 for any i. In this definition, r , r , is similar to the suffer value in Sufferage heuristic in traditional HTC, and it measures the importance gain in allocating A to R when comparing the processing rate offered by R with that offered by R , and , , ,.

i j i k i r r r 
is the normalization of this value. If r , r , , it is more beneficial to get R rather than R for application A , so the importance gain in this comparison is positive; otherwise the gain will be negative. And thus the NI value of R for A shall be the sum of importance gains in all those possible comparisons. When sum these values up, we follow the intuition of traditional HTC heuristic Sufferage, which gives larger weight to the sufferage incurred from the failure to choose better option(actually it is a 0-1 weight assignment, 1 for the difference between the best option and the second best one, and 0 for others), but adopt a smoothed weight assignment policy:

, , , 1 /
m i k i k i l l r r     (4)
For a requesting node R , each application A will measure it by NI value; If NI , NI , , R is more important to A than A , and we should allocate A to R . 2) Requesting node's perspective Similar to the above case, but the importance now is measured in terms of resource utilization (described by the parallel degree). Specially, when an application is going to choose a computing resource, we use Application Importance (AI) to quantify how important is A for R to achieve high resource utilization, which is given by , , , ,

,

p i j k j i j k j k j D D AI D       (5) , , , 1 / p k j k j l j l D D     (6)
where ., j D is the mean value of the j-th column of parallel degree matrix, and λ , is the weight similar to ω , . When AI , is larger than AI , for two competing resources R and R , A is more important to R , so we should allocate R to A .

3) The global importance value After determining the AI and NI, a global importance (GI) value is calculated for every possible pair A and R , so as to support the application-resource matching. This value is given by , , , , ,

i j i j i j i j i j GI NI AI      (1 )
where 0 μ 1, reflecting the trade-off between the optimization of computing performance (Makespan) and utilization (Flowtime). We provide each GI a private weight to accommodate more flexibility. To this end, we measure for application A that how spread out the processing rates it achieves on different resources is, and for node R that how spread out the utilization it achieves in processing different applications is. So the weight value is given by , cv / ( cv cv )

i j i i j r r c    ( 8
)
where rcv and ccv are the Coefficient-of-Variance (CV) values of the i-th row of processing rate matrix r , and j-th column parallel degree matrix D , respectively. This weight assignment policy ensures that more opportunities are given to the side whose achievable processing rates or utilization ratios are more dispersed, and it is reasonable to prioritize those decisions.

Given an application-resource pair, the rest of the job-resource matching work is just to select an instance of the targeted application (job selection). Figure 2 shows the whole job-resource matching algorithm. The time complexity is O mp m p N , but in practice we can pre-compute the GI values to reduce the complexity to just O N mp (from step 3 to 9). The job selection policy here tends to reuse the runtime environment between task packages and thus reduce resource management overhead.

Task Bundling

After node R is allocated to job J , , we need further to decide which tasks of J , will be dispatched to R . Unlike the traditional HTC scheduling, we select a package of tasks rather than a single task in one dispatch. This task bundling approach is exactly the way to amortize the resource management overhead among tasks in the same package and increase the intra-node system utilization.

Job-resource matching

1For every candidate application-resource pair (A , R ) 2 Compute global importance value GI , ; 3 (A * , R * )argmax GI , ; //the pair whose GI is maximal 4 J  previously processed job of R * 5 If (J ∅) 6 return pair (J , R * ); 7 Else 8 J , *  job with least total complexity over all jobs of A * 9 return pair (J , * , R * );

Fig. 2. Job-resource Matching Algorithm

Our task selection approach considers the parallel degree D , of the application A on the node R , and chooses a subset of tasks of job J , by a bin-packing approach. The upper bound workload that each of D , bins can hold is determined by

} i k i j c M c T trans T env      1 , 2 , max{ , ( _ _ )
where M , is granularity of the largest task in job J , , T_trans is the transmission startup overhead, T_env , is the cost of runtime environment preparation for application A on R , and c and c are multipliers. Figure 3 shows the detail of the proposed scheme. The complexity is O slogn , (implemented by balanced Binary Search Tree), where s is the number of tasks in package. This is efficient enough for MTC applications even when there are millions of tasks.

The merits of this scheme are two-fold: 1) the workload of each job can be better balanced among different nodes by picking the largest task first; 2) the intra-node workload can be better balanced among processors as we have already simulated the intra-node scheduling by bin-packing.

Experiment

To study the proposed algorithm, we compare it with traditional heuristics, including MaxStd, MinMin and Sufferage. For MTC task scheduling, these heuristics can be used in two ways. The bare way is to schedule MTC tasks based on ETC matrix as in HTC. The other way is to revise them to fit into our scheduling framework. The revised heuristics run based on processing rate matrix rather than ETC. They play the role just as the first 3 steps of job-resource matching algorithm showed in Figure 2. The rest part of job-resource matching algorithm and the whole task-bundling algorithm will remain unchanged for revised heuristics.

Simulation method and parameters

The major parameters include node number m, application number p, job number n and task number for each job. And the generating methods for other items are as follows:  Node. The core number of each node is uniformly sampled from {1, 2, 3, 4, 6, 8, 10, 12, 16, 32}.  Application. An IO-to-CPU ratio is attached to each application, representing the application's preference for I/O or CPU speed. The ratio value is uniformly sampled from range (0,1). Large values indicate IO-intensive applications and small ones the CPU-intensive applications.  Application's parallel degree matrix D , .The D , value is determined by D , 1 γ cn ,where γ is IO-to-CPU ratio of application A , and cn is the core number of node R .  Application's processing rate matrix r , .We use the CVB method proposed in [START_REF] Ali | Task execution time modeling for heterogeneous computing systems[END_REF] to generate the application-resource processing rate matrix. In CVB method, μ , V and V , which represent the mean of task execution time, CV of tasks and the CV of machines, are the three parameters to control the ETC matrix. In the context of application processing rate, V is actually V , indicating the heterogeneity level of application; V remains the same meaning; and μ becomes a scale parameter without any significance, and is assigned a fixed value 100. V and V will be varied with values {0.1, 0.6}, representing low and high heterogeneity respectively.  Job. Each job belongs to exactly one of the p applications, uniformly. The tasks' actual task complexity of each job is drawn from a Power Law distribution, with mean granularity 100 seconds and minimum granularity 1 second measured on the reference node.  Task. Based on the actual task complexity, the estimated task complexity is sampled from a truncated Gaussian distribution N actual_complexity, θ actual_complexity as in [START_REF] Maheswaran | Dynamic matching and scheduling of a class of independent tasks onto heterogeneous computing systems[END_REF], where θ is a coefficient controlling the inaccuracy of prediction. The inaccuracy level is application-specific, and is uniformly drawn from range 0.5,1.5 .  Resource management overhead. For application A , this value is Overhead = 10 σ γ ,where σ is logistic function with 0.5 as location parameter and 0.1 as shape parameter, and 10 is a parameter controlling the maximal overhead. Under the same parameters set, experiment will be repeated 10 times and the results will be averaged to eliminate casual effects.

Task-bundling ( , , ) 1

Evaluation of the proposed algorithm

This experiment is to evaluate the application-level scheduling with task bundling algorithm (ALSTB) against the traditional heuristics comprehensively. Values of the major parameters are listed in Table 1. Value of task number per job here is set to be much smaller than real MTC cases, as the traditional task-level scheduling is too slow for larger values.

Figure 4(a) shows that when number of tasks is small, traditional heuristics behave pretty well; but as the task number increase, the proposed algorithm becomes better. This proved that the traditional heuristics cost more time in resource management and thus deteriorate the performance. Figure 4(b) shows a gradually bigger advantage of ALSTB in terms of Average Job Makespan when increasing the number of tasks. The reason is, unlike ALSTB, the bare traditional heuristics treat tasks from different jobs indiscriminately, which in its extreme case may schedule tasks from different jobs alternately and result in bad Average Job Makespan. Figure 4(c) shows a clear margin between ALSTB and other three heuristics. We note that the bare heuristics schedule one task every time and cannot fully utilize a modern multi-core node, while the ALSTB considers the intra-node capacity exploitation and workload balancing by the bin-packing task-bundling strategy. This makes the significant difference of Overall Flowtime observed in graph.

Evaluation of the revised heuristics

This experiment is to evaluate the revised heuristics (denoted as R-MaxStd, R-MinMin and R-Sufferage) that have been adapted to fit into our scheduling model. The experiment is put in real MTC conditions, as listed in Table 2. Every job's task number is uniformly between 10,000 and 50,000, and the total number of processed tasks will range from 1,000,000 to 5,000,000. Figure 5(a) shows the results when both application and resoruce heterogeneity are low. R-Sufferage is the best in terms of Overall Makespan and Average Job Makespan, whereas ALSTB achieves the best Overall Flowtime.The reason shall be that ALSTB has taken both the application and resource's perspectives into consideration and tend to make a balanced scheduling decision. Figure 5(b) shows the results for high application heterogeneity and low resource heterogeneity, where ALSTB exhibits better than three other heuristics in all metrics. Figure 5(c) shows the results for low application heterogeneity and high resource heterogeneity, which is similar to Figure 5(a). Finally Figure 5(d) shows the results for high application heterogeneity and high resource heterogeneity. The algrithms' performance is more dispersed than other settings, especially that R-MaxStd is far worser than others.

We can read two things in these four results. First, compared to the bare heuristics, the performance of revised heuristics are greatly improved, which could even compete with ALSTB; this verifies the merit of the proposed scheduling strategies. Second, ALSTB still has its advantage in that it gives lower Flowtime in all four settings.

Fig. 1 .

 1 Fig. 1. Scheduling framework

Fig. 3 .

 3 Fig. 3. Task Bundling Algorithm

Fig. 4 .

 4 Fig. 4. Performance impact of task number on Overall Makespan, Average Job Makespan and Overall Flowtime

Fig. 5 .

 5 Fig. 5. Performance of the revised heuristic V.S. ALSTB in 4 settings

Table 1 .

 1 Major parameters (I)

	NodeNum	ApplicationNum	JobNum	TaskNumPerJob
	100	10	20	50-500

Table 2 .

 2 Major parameters (II)

	NodeNum	ApplicationNum	JobNum	TaskNumPerJob
	1,000	50	100	10,000-50,000

Conclusions

In this paper, we propose the ALSTB algorithm, which divides the whole scheduling into a job-resource matching algorithm and a bin-packing based task-bundling algorithm for multiple MTC applications scheduling in heterogeneous environments. The proposed algorithm is compared against both bare and revised traditional heuristics, where the latter are adapted from the former to fit into our scheduling framework. The simulation experiments show that our algorithm gets better results than the bare traditional heuristics, and outperforms the revised ones in Flowtime and meanwhile achieves performance in Makespan comparable to them. So the conclusions are two-fold: on one hand, ALSTB provides a way for multiple applications many-tasks scheduling, and on the other hand, ALSTB gives the balanced optimization of Makespan and Flowtime. In future, our research will concern the fairness issues involved in the multi-user Many-Task Computing.


Ding Wang
email: wangdingg@mail.nankai.edu.cn

Chun-Guang Ma

Sen-Dong Zhao

Chang-Li Zhou

Breaking a Robust Remote User Authentication Scheme using Smart Cards

Keywords: Cryptanalysis, Authentication protocol, Offline password guessing attack, Smart card, Forward secrecy

Understanding security failures of cryptographic protocols is the key to both patching existing protocols and designing future schemes. Recently, Yeh et al. showed that Hsiang and Shih's password-based remote user authentication scheme is vulnerable to various attacks if the smart card is nontamper resistant, and proposed an improved version which was claimed to be efficient and secure. In this study, however, we find that, although Yeh et al.'s scheme possesses many attractive features, it still cannot achieve the claimed security goals, and we report its following flaws: (1) It cannot withstand offline password guessing attack and key-compromise impersonation attack under their non-tamper resistance assumption of the smart card; (2) It fails to provide user anonymity and forward secrecy; (3) It has some other minor defects. The proposed cryptanalysis discourages any use of the scheme under investigation in practice. Remarkably, rationales for the security analysis of password-based authentication schemes using smart cards are discussed in detail.

Introduction

With the development of distributed computer networks, it is easy for user terminals to share information and computing power with hosts [START_REF] Vicente | Remote automation laboratory using a cluster of virtual machines[END_REF][START_REF] Barolli | JXTA-OVERLAY: A P2P platform for distributed, collaborative and ubiquitous computing[END_REF]. The distributed locations of service providers make it efficient and convenient for subscribers to access the resources, and it is of great concern to protect the systems and the users' privacy and security from malicious adversaries. Accordingly, user authentication becomes an essential security mechanism for remote systems to assure one communicating party of the legitimacy of the corresponding party by acquisition of corroborative evidence. Among numerous methods for user authentication, password based authentication with smart cards is one of the most promising techniques and has been widely adopted over insecure networks to validate the legitimacy of users.

In 1981, Lamport [START_REF] Lamport | Password authentication with insecure communication[END_REF] introduced the first password authentication scheme to authenticate a remote user over an insecure channel. This seminal scheme was later refined and used in a number of applications, notably Haller's famous S/KEY onetime password system [START_REF] Hailer | The S/Key One-time Password System[END_REF]. Later on, Chang and Wu [START_REF] Chang | Remote password authentication with smart cards[END_REF] introduced the smart cards into remote user authentication schemes, since then there have been many smart card based password authentication schemes proposed [START_REF] Yoon | Further improvement of an efficient password based remote user authentication scheme using smart cards[END_REF][START_REF] Yang | Two-factor mutual authentication based on smart cards and password[END_REF][START_REF] Hsiang | Weaknesses and improvements of the Yoon-Ryu-Yoo remote user authentication scheme using smart cards[END_REF][START_REF] Sood | An improvement of Hsiang-Shih's authentication scheme using smart cards[END_REF][START_REF] Ma | Cryptanalysis and improvement of sood et al.'s dynamic id-based authentication scheme[END_REF]. In such schemes, the user is equipped with a smart card and a password as identification verifiers. When the user wants to login to the server, she provides the card with her password, which is used to construct a login request that is sent to the server. Upon receiving the request, the server authenticates these messages and provides the desired service if the verifiers are found valid. If mutual authentication occurs, the client is also convinced that the corresponding server is authentic. More admired schemes also achieve session key agreement for securing the subsequent data communications.

The common adversary model to evaluate the security of authentication protocols using smart cards assumes an attacker with full control over the communication channel between the user and the remote server [START_REF] Yang | Two-factor mutual authentication based on smart cards and password[END_REF][START_REF] Ma | Cryptanalysis and improvement of sood et al.'s dynamic id-based authentication scheme[END_REF][START_REF] Dolev | On the security of public key protocols[END_REF]. Accordingly, all the messages exchanged can be blocked, intercepted, deleted, or modified by the attacker, and the attacker can also insert his/her own fabricated messages. Secondly, protocols must assume that the attacker can temporarily get access to the legitimate user's smart card, which is reasonable in practice. What's more, since recent research results have shown that the secret data stored in the common smart card could be extracted by some means, such as monitoring the power consumption [START_REF] Kocher | Differential Power Analysis[END_REF][START_REF] Messerges | Examining Smart-Card Security under the Threat of Power Analysis Attacks[END_REF] or analyzing the leaked information [START_REF] Mangard | One for all-all for one: unifying standard differential power analysis attacks[END_REF], the smart card should be assumed to be non-tamper resistant, i.e., the secret information stored in the smart card can be revealed.

As mentioned in [START_REF] Ma | Cryptanalysis and improvement of sood et al.'s dynamic id-based authentication scheme[END_REF][START_REF] Tsai | Password authentication schemes: current status and key issues[END_REF], a sound password authentication scheme should be able to withstand a number of sophisticated distinct types of attacks, such as replay attack, password guessing attack, parallel session attack, denial of service attack, stolen verifier attack, and user/server impersonation attack. As resistance to these passive and active attacks is a basic security requirement for authentication protocols, the following desirable attributes are also of great importance in the case of an authentication scheme with session key establishment [START_REF] Blake-Wilson | Key agreement protocols and their security analysis[END_REF][START_REF] Krawczyk | HMQV: A High-Performance Secure Diffie-Hellman Protocol[END_REF]: i. Resistance to known key attack. A protocol still achieves its security goal in the face of an adversary who has learned some previous session keys. ii. Provision of forward secrecy. Even if long-term private key of one or more entities are compromised, the secrecy of previous session keys is not affected. iii. Resistance to unknown key-share attack. The entity i cannot be coerced into sharing a key with entity j without i's knowledge, i.e., when i believes the key is shared with some other entity k, where k j. iv. Resistance to key-compromise impersonation attack. It is desirable that the leakage of entity i's long term private key does not enable an adversary to impersonate other entities to i.

In 2009, Hsiang and Shih [START_REF] Hsiang | Weaknesses and improvements of the Yoon-Ryu-Yoo remote user authentication scheme using smart cards[END_REF] showed that Yoon et al.'s scheme [START_REF] Yoon | Further improvement of an efficient password based remote user authentication scheme using smart cards[END_REF] is susceptible to user impersonation attack, offline password guessing attack and parallel session attack. To overcome these defects, Hsiang and Shih presented an enhanced version. Later on, Sood et al. [START_REF] Sood | An improvement of Hsiang-Shih's authentication scheme using smart cards[END_REF] showed that Hsiang and Shih's scheme still suffers from offline password guessing attack and user impersonation attack, and user anonymity is not preserved. More recently, Yeh et al. [START_REF] Yeh | Two robust remote user authentication protocols using smart cards[END_REF] identified that, besides the security flaws found by Sood et al., Hsiang and Shih's scheme is also prone to undetectable online password guessing attack. Consequently, Yeh et al. proposed a further improved version to eliminate the aforementioned security flaws. In this paper, however, we will demonstrate that Yeh et al.'s scheme is still vulnerable to the offline password guessing attack and key-compromise impersonation attack. Moreover, their scheme fails to provide the property of forward secrecy and user anonymity.

The remainder of this paper is organized as follows: in Section 2, we briefly review Yeh et al.'s authentication scheme. Section 3 describes the weaknesses of Yeh et al.'s scheme. Finally, we conclude this paper in the last section.

Review of Yeh et al.'s scheme

In this section, we briefly review the first scheme, i.e. the improvement on Hsiang and Shih's scheme, proposed by Yeh et al. in [START_REF] Yeh | Two robust remote user authentication protocols using smart cards[END_REF]. Their scheme, summarized in Fig. 1, consists of four phases, namely, the registration phase, the login phase, the verification phase and password update phase. For ease of presentation, we employ some intuitive abbreviations and notations listed in Table 1.

, ( ), ( )

i i i i ID h PW h b PW ID   || ( ) ( ) ( ( ) )          i i i i EID ID m P h EID x R P h b PW ID V h P h PW 1 2 1 ( ) ( )       i i u C R h b PW ID C h C T 2 ( ), , i u h ID C T 2 ( ( ) )     u C h h EID x T 3 ( ( ) ( )) ( ( ) )         s i S s C h h EID x h T SK h h EID x ID ID T 3 1 ( ( ) )    s C h C hT 3   C 2   C 1 ( )     i S s SK h C ID ID T 2 C 3 C * ( ) , ( )       i i i P R h b PW ID V h P PW *  V V ( ) , ( )       new new new new i i i R P hb P W I D V h P P W ||  i EID ID m
 : A B M message M is transferred through a secure channel from A to B  : A B M message M is transferred through a common channel from A to B

Registration phase

The registration phase involves the following operations:

Step R1. U i chooses his/her identity ID i , password PW i , and a random number b.

Step R2. U i  S:

{ID i , h(PW i ), h(b  PW i  ID i )}.
Step R3. On receiving the registration message from U i , the server S creates a new entry (h(ID ), ID i , m) with the value m 0 for U i in the backend database, or sets m m 1 in the existing entry. Then,

S computes EID ID || m, P h(EID  x), R P  h(b  PW i  ID i ) and V h(P  h(PW i )). Step R4. S  U i : A smart card containing security parameters {V, R,h( )}.
Step R5. U i enters b into his/her smart card.

Login phase

When U i wants to login to S, the following operations will be performed:

Step L1. U i inserts his/her smart card into the card reader, and inputs ID i and PW i .

Step L2. The smart card computes

C 1 R  h(b  PW i  ID i ) and C 2 h(C 1  T u )
, where T u is the current timestamp on user side.

Step L3. U i  S: {C 2 , h(ID i ), T u }.

Verification phase

After receiving the login request from user U i , S performs the following operations:

Step V1. S first checks the validity of h(ID i ) and T u , computes EID ID i || m and 2 C  h(h(EID  x)  T u ), and then compares the computed 2 C  with the received C 2 . If they are equal, S computes C 3 h(h(EID  x)  h(T s )) and session key SK h(h(EID  x)  ID i  ID S  T s ), where ID S denotes the identity of S. Otherwise, S rejects the request.

Step V2. S  U i : {C 3 , T s }.

Step V3. Upon receiving the reply message, U i checks the validity of T u . If the verification fails, U i terminates the session. Then,

U i computes 3 C  h(C 1  h(T s ))
, and then compares the computed 3 C  with the received C 3 . If the verification holds, U i computes SK h(h(EID  x)  ID i  ID S  T s ). Otherwise, U i terminates the session.

Step V4. After authenticating each other, U i and S use the same session key SK to secure ensuing data communications.

Password change phase

When U i wants to change the old password PW i to the new password PW i new , the operations will be involved:

Step P1. U i insert his/her own smart card into card reader, keys ID i and PW i .

Step P2. The smart card computes P R  h(b  PW i  ID i ) and V * h(P  h(PW i )), and checks whether V * equals V. If the verification fails, smart card rejects.

Step P3. U i keys his/her new password PW i new .

Step P4. The smart card computes

R new P  h(b  PW i new  ID i ) and V new h(P  h(PW i new
)), and updates R and V with the new R new and V new respectively.

Cryptanalysis of Yeh et al.'s scheme

There are two assumptions explicitly made in Yeh et al.'s scheme [START_REF] Yeh | Two robust remote user authentication protocols using smart cards[END_REF]:

(i) The adversary A has total control over the communication channel between the user U and the remote server S. In other words, the adversary can insert, delete, alter, or intercept any messages transmitted in the channel. (ii) The secret parameters stored in the smart card could be extracted out once a legitimate user's card is somehow (e.g. stolen or picked up) obtained by A .

Note that the above two assumptions, which are also made in the latest works [START_REF] Yang | Two-factor mutual authentication based on smart cards and password[END_REF][START_REF] Sood | An improvement of Hsiang-Shih's authentication scheme using smart cards[END_REF][START_REF] Ma | Cryptanalysis and improvement of sood et al.'s dynamic id-based authentication scheme[END_REF], are indeed reasonable: (1) Assumption i is accordant with the common adversary model introduced in Section 1; and (2) Assumption ii is also practical in consideration of the state-of-art side-channel attack techniques [START_REF] Kocher | Differential Power Analysis[END_REF][START_REF] Messerges | Examining Smart-Card Security under the Threat of Power Analysis Attacks[END_REF][START_REF] Mangard | One for all-all for one: unifying standard differential power analysis attacks[END_REF]. In the following discussions of the security flaws of Yeh et al.'s scheme, based on the above two assumptions, we assume that A can extract the secret values {V, R, b} stored in the legitimate user's smart card, and the attacker can also intercept or block the login request message {C 2 , h(ID i ), T u } from U i and the reply message {C 3 , T s } from S.

As described in Yeh et al.'s scheme, mainly two countermeasures are employed to remedy the identified flaws in Hsiang and Shih's scheme: (1) user's ID is concealed by use of a non-invertible hash function to double the difficulty of mounting an offline password guessing attack; (2) a session key is agreed to resist against server impersonation attack. However, as will be shown in the following, the first countermeasure is not effective enough, and the later one lacks key security considerations yet.

Offline password guessing attack

A remote user authentication scheme vulnerable to the offline password guessing attack must satisfy the two conditions: the user's password is weak, and there exists a piece of password-related information used as a comparison target for password guessing. In Yeh et al.'s scheme, a user is allowed to choose his/her own password PW at will during the registration and password change phases; the user usually tends to select a password, e.g., his phone number or birthday, which is easily remembered for his convenience. Hence, these easy-to-remember passwords, called weak passwords [START_REF] Klein | Foiling the Cracker: A Survey of, and Improvements to, Password Security[END_REF], have low entropy and thus are potentially vulnerable to offline password guessing attack. Inevitably, user's ID, chose by the user in the same way with PW as described in the scheme, is exposed to the same threat.

Let us consider the following scenarios. In case a legitimate user U i 's smart card is stolen by an adversary A , and the stored secret values such as R, V and b can be extracted. With a previously eavesdropped message {C 2 , h(ID i ), T u }, A can acquire U i 's password PW i by performing the following malicious attack procedure:

Step Since the size of password dictionary, i.e. D| | | , often is very limited, the above attack procedure can be completed in polynomial time. Halevi and Krawczyk [START_REF] Halevi | Public-key cryptography and password protocols[END_REF] have proved that, under the Dolev-Yao adversary model [START_REF] Dolev | On the security of public key protocols[END_REF], no password protocol can be free from offline password guessing attack if the public-key techniques are not employed. Therefore, the feasible solution is to reduce the success probability of this attack. Following this principle, Yeh et al.'s scheme thwarts this threat to nearly half success probability as compared to that of Hsiang and Shih's original scheme, which can be easily confirmed from the above attack procedure.

However, we have found that, some minor technical modifications to Yeh et al.'s scheme can quadratically but not linearly reduce the success possibility of this attack. Due to space constraints, we do not give the complete remedy here, and recommend readers to refer the literature [START_REF] Ma | Cryptanalysis and improvement of sood et al.'s dynamic id-based authentication scheme[END_REF] for details. The idea of the remedy is not particularly complicated: whenever PW i appears, it is concatenated with the identity ID i , while ID i is concealed in dynamic-ID(s). Therefore, the mechanism employed by Yeh et al. to resist against offline password guessing attack is not effective enough as minor revision may thwart this threat to a more desirable extent.

Key-compromise impersonation attack

In the case of key-compromise impersonation, the question is whether the knowledge of a communicating party A's private key allows a malicious attacker A not only to impersonate A to others but also to impersonate other uncorrupted parties to A. Schemes that prevent this kind of reverse impersonation are said to withstand key-compromise impersonation attack. Suppose the long-term secret key x of the server S is leaked out by accident or intentionally stolen by the adversary A . Once the value of x is obtained, with previously intercepted h(ID i ) transmitted in U i 's authentication process, A can impersonate the legitimate user U i through the following method:

Step 1. Guesses U i 's identity to be ID i * from a dictionary of all possible 'weak' identities, and verify the guess by checking whether * ( )

i h ID equals h(ID i ). Step 2. Assumes 0  m
, where m denotes the re-registration times of U i . Step 3. Computes EID ID i || m and P h(EID  x), where ID i is derived through Step 1 and x has also been learned.

Step 4. Let C 1 P and C 2 h(C 1  T m ), where T m is the current timestamp.

Step 5. Sends the fabricated login request {C 2 , h(ID i ), T m } to server S.

Step 6. Waits for the reply for a reasonable interval. If no response comes, set 1   m m and goes back to Step 3, else proceeds to the next step.

Step 7. Receives the reply {C 3 ,T s } from server S and computes the session key SK h(h(EID  x)  ID i  ID S  T s ).

Since the value of m, i.e. the re-registration times of U i , should be very limited in common practice, at most a few dozen, the iteration of the above procedure will come to an end very quickly. The rest of the question is whether Step 1 can be completed in polynomial time. In Yeh et al.'s scheme, a user is allowed to choose his/her own identity ID at will during the registration and password change phases; the user usually tends to select an identity that is human-memorable short strings but not highentropy keys. In other words, they are chosen from the dictionaries of small size. Therefore, the above attack is feasible.

Failure to achieve forward secrecy

As with resistance to key-compromise impersonation attack, the property of forward secrecy is also concerned with limiting the effects of eventual failures, in case the disclosure of server's long-term private keys. Let us consider the following scenarios. Suppose the server S's long-term private key x is leaked out by accident or intentionally stolen by an adversary A . Once x is obtained, with previously intercepted messages 3 { ( ), , } j j i s h ID T C transmitted during any one of U i 's authentication process (without loss of generality, assume it is U i 's jth authentication process), A can derive the session key j SK of S and U i 's jth encrypted communication through the following method:

Step 1. Guesses U i 's identity to be ID i * from a dictionary of all possible 'weak' identities, and verify the guess by checking whether The computation complexity of Step 1, Step 3 and Step 4 has been analyzed in Section 3.2, and it's evident that the whole procedure described above can be completed in polynomial time. Once the session key j SK is obtained, the entire jth session will become completely insecure. Consequently, the property of forward secrecy is not provided in Yeh et al.'s scheme, while the provision of forward secrecy is a basic requirement for a secure key agreement scheme.

3.4

No provision of user anonymity

In Yeh et al.'s scheme, the user U i 's identity ID i is wrapped up in hashing, i.e. h(ID i ), which is static and specific to user U i in all the transaction sessions, an adversary can easily obtain the hashed identity of this communicating client once the login messages were eavesdropped, and hence, different login request messages belonging to the same user can be traced out and may be interlinked to derive some secret information related to the user. Furthermore, U i 's identity ID i may be derived from h(ID i ) through the method introduced in Section 3.1. Hence, user anonymity is not preserved.

Some practical pitfalls

In the registration phase, U i 's password PW i is just submitted in a hashed form to S, and thus it can be easily derived by S. If U i uses this PW i to access several servers for his/her convenience, the insider of S can impersonate U i to access other servers. Hence, it's an insecure factor to commit just a hashed password to the server. Another pitfall in Yeh's scheme is the slow wrong password detection [START_REF] Tsai | Password authentication schemes: current status and key issues[END_REF]. If U i inputs a wrong password by mistake, this wrong password will be only detected by the remote system in the verification phase. Therefore, their scheme is slow to detect the user's wrongly input password.

Conclusion

Smart card-based password authentication technology has been widely deployed in various kinds of security-critical applications, and careful security considerations should be taken into account when designing such schemes. In this paper, we have shown that Yeh et al.'s scheme still suffers from the offline password guessing attack and key-compromise impersonation attack. In addition, their scheme fails to provide the property of forward secrecy and user anonymity. Some other minor defects have also been found. In conclusion, although Yeh et al.'s scheme has many attractive features, it, in fact, does not provide all of the security properties that they claimed and only radical revisions of the protocol can possibly eliminate the identified defects. Therefore, the scheme under study is not recommended for practical application.

Fig. 1 .

 1 Fig. 1. Yeh et al.'s remote user authentication scheme

Table 1 .

 1 Notations

	Symbol	Description
	U	i	i th user
	S			remote server
	i ID	identity of user U i
	i PW	password of user U i
	x			the secret key of remote server S
	h	 ( )	collision free one-way hash function
		the bitwise XOR operation
	||		the string concatenation operation

  [START_REF] Vicente | Remote automation laboratory using a cluster of virtual machines[END_REF]. Guesses all possible values ID i * of U i 's identity, and compares the value of and U i 's identity is found, and proceeds to Step 2.Step 2. Guesses the value of PW i to be PW i * from the password space D .Step 3. Computes C 1  h(b  PW i *  ID i ),where the value of b and R are revealed from the smart card and the value of ID i is obtained through Step 1. Step 4. Computes C 2 Step 5. Verifies the correctness of PW i * by checking if C 2 * equals the intercepted C 2 . Step 6. Repeats Steps 2, 3, 4 and 5 of this phase until the correct value of PW i is found.

* (

)

i h ID with h(ID i ). If the computed * ( ) i h ID equals the intercepted h(ID i ), it implies ID i * ID i * R * h(C 1 *  T u )

, as T u is previously intercepted.

Acknowledgements. This research was supported by the National Natural Science Foundation of China (NSFC) under Grants No. 61170241 and No. 61073042.


Hung-Chang Lin

Yao-Hua Wang
email: wang@ntnu.edu.tw

The Instructional Design of A Web-based Self-reflective Learning Portfolio for Skill Training

Keywords: Moodle, Web-based learning portfolio, Technical training, Selfreflective learning, Instructional design

Technical education mainly focuses on the development of students' motor skills. At vocational educational schools in Taiwan, technical teachers usually teach skills in a big class. Therefore, those teachers always face the problems of not realizing students' learning process and difficulties; the evaluation is also deficient in credibility and validity.

The learners' self-reflection can help teachers understand their learning process. In this study, the researchers analyze the objectives, strategies and introspection emphasis in the skill-training stages and provide recommendations for students to reflect in each phase. Then the researchers apply these recommendations as the basis of introspection to build a Web-based learning portfolio (WBLP) for skill training.

The results of this study reveal that the Moodle platform conforms to the requirements of building a Web-based self-reflective learning portfolio for technical training purpose. Besides, this paper has mapped out the Moodle Modules that provide the self-reflection features for a technical-training WBLP.

Introduction

Technical education mainly focuses on the development of technical skills of students. Students are trained to gain better technical operating ability and this has become one of the main objectives of technical education. Traditionally, technical training has been taught through the demonstration and guidance of teachers and students learn skills through imitation or repetitive practices. However, teachers often face some problems in the traditional technical training courses. For instance, it is difficult for teachers to be aware of students' initial skill level; also, due to the huge number of students in a class, teachers often have difficulties realizing students' learning process and problems. Therefore, teachers are unable to provide feedbacks at the appropriate time to assist students' learning. Moreover, it is difficult for teachers to evaluate individual performance from a team work project with credibility and validity. Self-reflection allows students to reflect on their learning process. With the reflection, teachers can further understand the students' learning process and adjust their teaching and evaluation. Therefore, the objective of this paper is to explore the possibility of utilizing Moodle (Modular Object-Oriented Dynamic Learning Environment) to build a Web-based self-reflective learning portfolio for technical training.

2

Web-based Self-Reflective Portfolio

Self-reflection vs. Learning

Dewey [START_REF] Dewey | How we think[END_REF] is the creator of the concepts to self-reflection in education. He believes that self-reflection is reflecting on knowledge through initiation, continuous thinking and careful thinking. However, Schon [START_REF] Schön | Educating the Reflective Practitioner, The Jossey-Bass Higher Education Series[END_REF] believes self-reflection is the reconcile process of individual's past experience, actions, beliefs and convictions gained through learning. The process finally builds a knowledge and meaning that belongs only to the individual. Montgomery [START_REF] Montgomery | Reflection, a meta-model for learning, and a proposal to improve the quality of university teaching[END_REF] stated that life experiences can be fully utilized through the process of self-reflection and further build on new life experiences. Repeated cycle of self-reflecting, usage of knowledge and forming new experiences can reach the effect of learning. Keeping a reflective journal is a form of record and it has to be easily inspected by the instructors so that instructors are able to effectively judge the level of students' reflective thinking [START_REF] Bell | A critical evaluation of the usefulness of a coding scheme to categorise levels of reflective thinking[END_REF][START_REF] Dyment | Assessing the quality of reflection in student journals: a review of the research[END_REF]. Several researches have attempted to identify students' reflective thoughts and measure the depth of their reflective thinking. Bain, Ballantyne, Packer & Mills [START_REF] Bain | Using journal writing to enhance student teachers' reflectivity during field experience placements[END_REF]suggest a framework for reflective thoughts. This framework divides reflective thoughts into 8 levels (see Table 1) and this can be a reference for evaluating the contents of students' reflective thinking.

Self-reflection Learning Portfolio

The use of learning portfolio (or called portfolio) is a new trend in education [START_REF] Chang | Enhancing self-perceived effects using Web-based portfolio assessment[END_REF]. The portfolio collects the learners' projects over a period of time. The contents of the learning portfolio describe students' learning process. Each portfolio is exclusive to each student. Viewers of the portfolio can understand information such as the learner's personal information, learning process and learning attitude through the narration kept in the portfolio [START_REF] Paulson | What makes a portfolio a portfolio?[END_REF][START_REF] Barrett | Electronic portfolios as digital stories of deep learning[END_REF][START_REF] Chang | Effects of reflection category and reflection quality on learning outcomes under a Web-based portfolio assessment environment: A case study of high school students in computer application course[END_REF].

The self-reflection learning portfolio is the portfolio with self-reflection as its main purpose. It provides students opportunities for systematic and continuous reflective thinking. They can help the learners improve their understanding of their work and often provide beneficial feedbacks [START_REF] Dyment | Assessing the quality of reflection in student journals: a review of the research[END_REF]. The self-reflection learning portfolio not only reflects on the learning transfer of the learners, but it also provides materials for students for self-reflection purposes [START_REF] Chang | Effects of reflection category and reflection quality on learning outcomes under a Web-based portfolio assessment environment: A case study of high school students in computer application course[END_REF].

Some information in the portfolio that is difficult to record in words (such as illustration portfolio, project process) can be recorded and saved using digital media methods. Discussion among students can also be recorded in terms of audio files, images or video recordings to provide a more realistic overview of the student's effort in the learning process [START_REF] Chang | Consideration factors and adoption of type, tabulation and framework for creating e-portfolios[END_REF]. E-portfolio is a combination of a learning portfolio and multimedia [START_REF] Barrett | Electronic Teaching Portfolios: Multimedia Skills + Portfolio Development = Powerful Professional Development[END_REF]. The contents not only include interpretation of the learning portfolio, it also incorporates with the features of multimedia. There is the addition of multimedia resources and files to enrich the contents of the portfolio.

Other than the produce portion, Barrett [START_REF] Barrett | Balancing the two faces of eportfolios[END_REF]suggests the e-portfolio should also include the process portion, which should contain how students gather multimedia materials, the production process of project works, students' reflective journals, and the interaction between students and teachers. Therefore, the learning portfolio should not only present the results of learning, but it also present evidence of the learner's growth and development in academic [START_REF] Stiggins | Student-centered classroom assessment[END_REF][START_REF] Chang | Construction and evaluation of a web-based learning portfolio: An electronic wdqauthentic assessment tool[END_REF].

Development of the Web-based Self-reflection Learning Portfolio for Skill Training

Course Management System (CMS) provides a platform for students and teachers to conveniently upload and download teaching materials files. The system also provides a platform for discussion and this provides additional benefits to traditional teaching method and creates a totally new teaching environment. Barret [START_REF] Barrett | Electronic portfolios as digital stories of deep learning[END_REF] argues that the addition of adequate reflection activities and feedback mechanism on a CMS, such as reflection, learning journals, self-evaluation, peer evaluation and feedbacks, can build up a self-reflection learning portfolio.

Reflective Thinking in

The Application of Moodle for Building the Self-reflection Learning Portfolio Mechanism

Moodle (Modular Object-Oriented Dynamic Learning Environment) is a learning management system (LMS). Moodle provides several teaching modules which allow instructors to design teaching activities for classes. The advantage of modular programming is the instructors are able to utilize different program modules based on the needs of the class when designing teaching activities. These program modules have clear, simple and high portability features, and the modular structure is beneficial to the development of Moodle e-portfolio [START_REF] Sweeney | Traditional face-to-face and webbased tutorials: A study of university students' perspectives on the roles of tutorial participants[END_REF][START_REF] Masterman | Capturing teachers' experience of learning design through case studies[END_REF][START_REF] Ellis | Students' experience of e-learning in higher education[END_REF]. Furthermore, the standardized nature of a learning portfolio set up by Moodle allows evaluation to be more objective.

Based on the analysis of technical training stages and the discussion of designing a self-reflection learning portfolio, Table 3 shows the functional description of a selfreflection learning portfolio which is built with Moodle's modular features.

Conclusions and Suggestions

The Instruction and evaluation of motor skills have encountered several difficulties. The main cause is the instructors having problems realizing the learners' learning process. In order to improve the learner's learning efficiency and assist instructors to understand the learner's learning process, the use of a self-reflection learning portfolio is a possible solution.

Moodle provides several convenient teaching modules for instructors to easily develop teaching activities. This paper investigates the technical training procedure and points out the required reflection based on the teaching objectives of each training stage for learners. Finally, student's reflective thoughts are retained through appropriate Moodle's teaching modules to build up a complete self-reflection learning portfolio.

The design of a self-reflection learning portfolio provides students with the opportunity to self-reflect in every stage of technical learning and improve their learning. Moreover, the instructors are able to understand more about students' learning process. Based on students' learning process and reflective activities, the instructors are able to provide a more complete evaluation and feedback for the students.

  Different Stages of Technical Training Due to the different teaching objectives in different stages of technical training, teachers should design the appropriate self-reflection activities for each stage based on the different teaching objectives.

Table 1 .

 1 Framework of Reflective Thoughts Suggested by Bain[START_REF] Bain | Using journal writing to enhance student teachers' reflectivity during field experience placements[END_REF]

	Category	Description of the Contents of Reflective Thinking
	Nonsense	Meaningless contents
	Simple	Yes/No answers
	Incomplete	Incomplete or lost contents
	Reporting	Contents are reported with no individual opinions or views
	Responding	1. Low amount of concept involved
		2. Describes observations with no causes
		3. Describes personal emotions
	Relating	1. Contents are related to personal experience
		2. Brief explanation of what happened
	Reasoning	1. Has a good reasoning to what have happened
		2. In-depth discussion of the relationship between the theory and the real situation
	Reconstructing	1. Students present a high level of inference
		2. Combines self-experience with reasoning and makes a systematic conclusion to
		the theory

  Table 2 lists the suggestions for resources for reflective thinking for technical training stages based on the categorization of reflection contents in an e-learning portfolio [10].

Table 2 .

 2 Teaching Points, Teaching Strategies, Points of Reflective Thinking, and Reflection Contents in Different Stages of Technical Training

	Stages of Technical Training	Teaching Points	Teaching Strate-gies	Points of Reflective Thinking	Reflection Contents
		 Introduce the	 Initiate learning	Enhance the	 Teaching objec-
		objectives of the	motivations	learner's reflective	tives
		skill, functions,	 Build up overall	thinking about	 Textbooks
		tools, process,	concepts about	cognitive skills.	 References
	Stage 1: Building up cognitive knowledge	principle and out-come  Explain the pos-sible experiences, errors and dan-	technical opera-tion		 Related websites  Related rules  Lecture notes  Related re-sources
		gers during opera-			 Peer feedback
		tion			 After-class
					reflective
					thoughts
		 Demonstrate	 Explanation and	Make learners think	 Operation proce-
		motor skills	interpretation:	about the procedure	dure
		(How)	1.Action demon-	and reasons in	 Different ver-
		 Explain When	stration (overall	order to strengthen	sions of opera-
		and Why to exe-	 details)	the impression of	tion demonstra-
		cute specific mo-	2.Master the	operation.	tions and results
	Stage 2:	tor skills	methods and		 Observation
	Demonstration	 Explain the key	skills		records
		points of tech-	 Preliminary		 In-class photos
		niques through	practice		 In-class videos
		continuous opera-			 Peer feedbacks
		tion			 Qualitative
					reflective jour-
					nals
		 Allow learners to	 Cooperative	Allow learners to	 Operation proce-
		practice skills	learning	discover problems	dure
		1.Fragment skill	 Combine de-	encountered during	 Semi-finished
		practice	tailed actions	operation in order	work
		2.Complete skill	into a large scale	to find the key	 Records from
		practice	action through	points of the prac-	design to forma-
		 Offer scenarios to	practices	tice.	tion stage
		practice skill op-	 Individual		 Records of
	Stage 3: Guidance and Practices	erations	guidance and team guidance		practice proce-dure  Project work of all stages
					 Observation
					records
					 In-class photos
					 In-class videos
					 Peer feedbacks
					 Qualitative
					reflective jour-
					nals

Table 3 .

 3 Moodle Modules that Provide Self-reflection Features for Different Stages of Technical Training

		Technical Training	Moodle Modules that Provide Self-reflection Features
	Stages	Reflection Contents	Moodle Modules	Description of Moodle Modules
	Stage 1: Building up cognitive knowledge	 Teaching objectives  Related websites  Related rules  Lecture notes  Related resources	 Class documents (Provide Reflec-tion Contents)	 Provide learning contents and related resources
		 Peer feedbacks	 Chat rooms	 Provide social network
			 Forums	features
				 Provide cooperative activi-
				ties and discussion records

Acknowledgements. The authors thank the National Science Council of the Republic of China, Taiwan, for financially supporting this research under Contract No. NSC 100-2511-S-003-011.


Taeseung Lee
email: tslee@kisa.or.kr

Giyoun Won

Seongje Cho
email: sjcho@dankook.ac.kr

Namje Park
email: namjepark@jejunu.ac.kr

Dongho Won
email: dhwon@security.re.kr

Detection and Mitigation of Web Application Vulnerabilities based on Security Testing *

Keywords: web application, security testing, vulnerability, security

The paper proposes a security testing technique to detect known vulnerabilities of web applications using both static and dynamic analysis. We also present a process to improve the security of web applications by mitigating many of the vulnerabilities revealed in the testing phase, and address a new method for detecting unknown vulnerabilities by applying dynamic black-box testing based on a fuzzing technique. The fuzzing technique includes a structured fuzzing strategy that considers the input data format as well as misuse case generation to enhance the detection rate compared to general fuzzing techniques.

Introduction

Software security testing analyzes the security of applications from the viewpoint of attackers and is not really concerned with the functionality of the software. Such testing consists of static testing and dynamic testing. The advantage of code-based static testing is its ability to efficiently analyze software in its entirety, but this testing often has a high false detection ratio, and can hardly be applied to commercial software whose source code is not given. Execution-based dynamic testing can be applied to commercial software and has a low false detection ratio, but analysis time is long and code coverage is limited [START_REF] Ernst | Static and dynamic analysis: synergy and duality[END_REF].

This paper proposes a vulnerability detection and mitigation technique to increase the security of web applications. The vulnerability detection technique used in this paper is a software security test that combines both static and dynamic analysis from the viewpoint of the attacker, not the developer; and the vulnerability mitigation technique used here is the secure coding method. To this end, automated static analysis tools and dynamic analysis tools are applied to the web application to detect known vulnerabilities. Then a "fuzzing" technique for detecting new vulnerabilities is proposed. "Fuzzing" is a technique that generates/mutates input data either randomly or structurally and injects it into the application then monitors the results of application execution to detect vulnerabilities [START_REF] Godefroid | Automated Whitebox Fuzz Testing[END_REF]. This paper proposes an abuse case generation and testing strategy for efficient fuzzing as well. Third, to mitigate or remove detected web application vulnerabilities, a process for applying the secure coding technique is shown.

2

Security testing integration and vulnerability mitigation

Integration of static and dynamic testing

Static analysis and dynamic analysis are complementary. The advantages of integrating them are as follows:

-Expansion of analysis scope and analysis targets: The code coverage of the code review of static analysis is high, while the code coverage of dynamic analysis is low. On the contrary, source codes are given in case of code review, but dynamic analysis can be applied to commercial software as well. -Increased accuracy: Static analysis has a high false detection ratio, while dynamic analysis is accurate. So if they are integrated, the accuracy of vulnerability detection can be increased. -Increased detection ratio: It is very difficult for fuzzing to detect vulnerabilities.

It can be supplemented by vulnerability scanning or code analysis that has a high detection ratio. -Expansion of detection areas: Code review and vulnerability scanning can detect known vulnerabilities. If fuzzing is applied, new unknown vulnerabilities can be detected as well.

Fuzzing

Vulnerabilities of web applications are caused mostly by wrongly implemented source codes, but sometimes by web application servers. This paper proposes the fuzzing process for finding vulnerabilities of web applications and servers.

Input format considerations

To create misuse cases used for fuzzing, the input format of web applications must be analyzed. The request message, which is the input of web applications, can be divided into the "URI of the Request Line," and the "message header and message body."

The first part, the URI, is a standard command system indicating the location of documents and resources on the Internet. Its format is "protocol name://domain name/path name (parameter)." It is used as the input for the browser address window or for the Request Line of the request message. If components like the protocol, domain name and path name are invalid, the input cannot reach the web applications.

As attacks are made by changing the input for the URI parameter in general, fuzzing can be done for the values of the parameters.

The second part of the request message is the message header and body. The header includes additional information of the HTTP message, and the body describes the data necessary for the request. Fuzzing can also be attempted by altering the parameter values of the header and body of the request message.

Fuzzing strategy

There are four fuzzing techniques for discovering vulnerabilities: simple random, simple mutation, structured random and structured mutation. For more information on these techniques, please see a previous study of the authors [START_REF] Kim | Fuzzing-based Vulnerability Analysis for Multimedia Players[END_REF].

-Simple random: This method randomly generates input data without taking the input format into consideration. As fuzzing is done with completely random data without a basic input format, and most web applications process errors unawares, no exception will occur. -Simple mutation: This method brings a valid URL or request message and changes it as much as desired in units of single bytes. If the field perceiving the path of the URL or request message in web applications is mutated, it will not be perceived as a correct input, thereby lowering efficiency. -Structured random: This method adds the path of the URL or the header of the request message to the randomly generated data. If a header with a certain level of format is applied to the simple random data, web applications will perceive it as a normal format. -Structured mutation: This method gets actual input data, grasps the data format structure, and mutates desired parts. For example, the data of the request message is mutated, or the header size may be mutated, etc.

Technique for generating abuse cases for fuzzing

It is important to generate abuse cases when using the fuzzing technique. This study collected and analyzed information on existing known vulnerabilities to generate abuse cases, and generates abuse cases in consideration of the fuzzing technique (See Figure 1) [START_REF] Kim | Fuzzing of Web Application Server Using Known Vulnerability Information and Its Verification[END_REF]. The information on disclosed vulnerabilities of JEUS Web Application Server (WAS) for generation of abuse cases was searched. If JEUS vulnerabilities are searched through CVE (Common Vulnerabilities and Exposure), vulnerabilities related to the Alternate Data Stream can be found as shown in Figure 2. The Alternate Data Stream is a function of the Windows NT File System that prevents users from seeing a file through Windows Explorer by loading this file onto another file. This method is also used by attackers to prevent the attack file from being detected by hiding it in another file. If this is used to make a request like "test.jsp::$DATA," JEUS will perceive it as a general file, not a jsp file, thereby exposing the source [START_REF]SecurityFocus Vulnerability Database: Vulnerability Summary for BID : 32804[END_REF].

To collect and analyze information on more vulnerabilities, vulnerabilities regarding the Alternate Data Stream of other products similar to the disclosed vulnerabilities of JEUS were investigated. <Table 1> shows that web servers are the main targets of attacks, and as for types of abuses, most of the input data is divided into filename and data stream. Other vulnerabilities similar to data stream vulnerabilities that were also analyzed are shown in Table 2. The analysis result showed that they were the buffer overflow of the HTTP request message due to the input value of Post: or Host:. Accordingly, the association between the input value of each field in the HTTP request message and the occurrence of vulnerabilities may be considered, and abuse cases can be generated in consideration of this. As for the method of generating abuse cases, the types of abuses in <Table 1> were analyzed, and the structured mutation method was applied to the filename of the URL and the data stream, which are normal input data, as shown in <Table 3>. At this time, the types of abuses in <Table 2> were analyzed, and test cases were generated for each field of the header and body of a normal HTTP request message.

Monitoring and vulnerability analysis

Fuzzing can discover abnormal terminations or unique bugs only, and it is impossible to accurately analyze vulnerabilities with this information alone. Accordingly, the next step is to monitor the input process of the fuzz data, and analyze exceptions to classify vulnerabilities.

As for web applications, the response message of the client can be used to check if there was any exception. As for web servers, process monitoring tools like Process Explorer can be used to look at the status of processes. It is possible to use register information, stack information and exception information at the time when vulnerabilities occurred through debugging using OllyDbg.

Vulnerability mitigation

For starters, if there are source codes, a code review tool can be used to detect source code implementation errors, and then vulnerability scanning and fuzzing conducted for the complete application. Vulnerability scanning detects known vulnerabilities based on the inspection rules made through analyzing information on existing vulnerabilities. To detect unknown vulnerabilities, fuzzing can be applied. Mitigation measures should be implemented for detected vulnerabilities. For example, as there is a limit in blocking Cross Site Scripting (XSS) and injection vulnerability of the OWASP TOP 10 (2010) with a web firewall, removing or mitigating it can be a more fundamental solution. To mitigate vulnerabilities detected through security testing, vulnerabilities will be searched in the list of vulnerabilities that can be mitigated through secure coding. Vulnerabilities detected by applying the mitigation technique to the vulnerabilities found in the list can be mitigated.

Conclusion

In this paper, static testing and dynamic testing were applied to web applications to detect security vulnerabilities which were then removed. In other words, code review, vulnerability scanning and fuzzing were conducted to detect vulnerabilities, and a process of using secure coding to mitigate vulnerabilities was proposed. Also, this paper proposed a fuzzing technique for discovering new vulnerabilities as well as an abuse case generation technique, which is the key to efficient fuzzing.

Fig. 1 .

 1 Fig. 1. abuse case generation.

Fig. 2 .

 2 Fig. 2. JEUS vulnerabilities.

Table 1 .

 1 Results of an Alternate Data Stream vulnerability search.

	CVE-ID	Types of abuses	Targets of attack
	CVE-2209-2445	test.jsp::$DATA	Sun ONE Web Server
	CVE-2008-6528	test.jsp::$DATA	JEUS
	CVE-2006-5715	HTTP GET request::$DATA EFS Easy Address Book Web Server
	CVE-2006-5714	HTTP GET request::$DATA	EFS Easy File Sharing Web Server
	CVE-2006-1475	filename:stream syntax	Windows XP Firewall

Table 2 .

 2 Results of searching vulnerabilities related to the HTTP request message.

	CVE-ID	Types of abuses	Targets of attack
	CVE-2008-4678	Long HTTP Host Header	WebSphere
	CVE-2008-3257	POST /.jsp	Oracle WebLogic Server

Table 3 .

 3 Abuse case generation method.

	Applied to	Abuse case
	URL filename	http://....../bugTrack/FuzzDATA.jsp
	URL data stream	http://...../bugTrack/Default.jspFuzzDATA
	HTTP request
	message field

* This research was supported by the KCC(Korea Communications Commission), Korea, under the R&D program supervised by the KCA(Korea Communications Agency) (KCA-2012-12-912-06-003). † Corresponding author.