Current IT systems consist usually of several components and services that communicate and exchange data over the Internet. they have security requirements that aim at avoiding information disclosure and at showing co...
详细信息
ISBN:
(纸本)9789897581311
Current IT systems consist usually of several components and services that communicate and exchange data over the Internet. they have security requirements that aim at avoiding information disclosure and at showing compliance with government regulations. In order to effectively handle the security management of complex IT systems, techniques are needed to help the security administrator in the design and configuration of the security architecture. We propose a model-driven security approach for the design and generation of concrete security configurations for software architectures. In our approach the system architect modelsthe architecture of the system by means of UML class diagrams, and then the security administrator adds security requirements to the model by means of Security4UML, a UML profile. From the model enriched with security requirements, the concrete security configuration is derived in a semi-automated way. We present a tool that supports this model-driven approach, and a case study that involves a distributed multi-user meeting scheduler application.
We discuss how Delft-FEWS is applied to incorporate real-time sensor data and dynamic modeling to allow Real Time control (RTC) of three sewer systems in the area of the Hoeksche Waard, the Netherlands. the purpose of...
详细信息
ISBN:
(纸本)9783642411502
We discuss how Delft-FEWS is applied to incorporate real-time sensor data and dynamic modeling to allow Real Time control (RTC) of three sewer systems in the area of the Hoeksche Waard, the Netherlands. the purpose of this project was to reduce sewerage spilling to the surface water by optimizing the available storage in the sewer systems. In this paper we will present how Delft-FEWS makes use of Simple Object access Protocol (SOAP) webservices to exchange real-time data with multiple sewer systems and their different Supervisory control and data acquisition (SCADA) systems. We will also explain how we combine this with dynamic models, allowing for central automatic control of multiple sewer systems.
Distributed usage control is concerned with how data may or may not be used after initial access to it has been granted and is therefore particularly important in distributed system environments. We present an applica...
详细信息
ISBN:
(纸本)9781450312950
Distributed usage control is concerned with how data may or may not be used after initial access to it has been granted and is therefore particularly important in distributed system environments. We present an application- and application-protocol-independent infrastructure that allows for the enforcement of usage control policies in a distributed environment. We instantiate the infrastructure for transferring files using FTP and for a scenario where smart meters are connected to a Facebook application. Copyright 2012 acm.
In this demonstration we present a novel encryption scheme for enforcing accesscontrol in a Discovery Service. A Discovery Service is a piece of software that allows one to "discover" item-level data which ...
详细信息
ISBN:
(纸本)9781450312950
In this demonstration we present a novel encryption scheme for enforcing accesscontrol in a Discovery Service. A Discovery Service is a piece of software that allows one to "discover" item-level data which is stored in data repositories of different companies. Such data can be gathered withthe help of Radio Frequency Identification or 2D bar codes. Our software allows the data owner to enforce accesscontrol on an item-level by managing the corresponding keys. Data remains confidential even against the provider of the Discovery Service. We present three ways of querying data and evaluate them with databases containing up to 50 million tuples. Copyright 2012 acm.
accesscontrol policies in software systems can be implemented incorrectly for various reasons. this paper presents a model-based approach for automated testing of accesscontrol implementation. To feed the model-base...
详细信息
ISBN:
(纸本)9781450312950
accesscontrol policies in software systems can be implemented incorrectly for various reasons. this paper presents a model-based approach for automated testing of accesscontrol implementation. To feed the model-based testing process, test models are constructed by integrating declarative accesscontrol rules and contracts (preconditions and post-conditions) of the associated activities. the accesscontrol tests are generated from the test models to exercise the interactions of accesscontrol activities. Test executability is obtained through a mapping of the modeling elements to implementation constructs. the approach has been implemented in an industry-adopted test automation framework that supports the generation of test code in a variety of languages, such as Java, C, C++, C#, and HTML/Selenium IDE. the full model-based testing process has been applied to two systems implemented in Java. the effectiveness is evaluated in terms of access-control fault detection rate using mutation analysis of accesscontrol implementation. the experiments show that the model-based tests killed 99.7% of the mutants and the remaining mutants caused no policy violations. Copyright 2012 acm.
the Web is playing a very important role in our lives, and is becoming an essential element of the computing infrastructure. Unfortunately, its importance makes it the preferred target of attacks. Web-based vulnerabil...
详细信息
ISBN:
(纸本)9781450312950
the Web is playing a very important role in our lives, and is becoming an essential element of the computing infrastructure. Unfortunately, its importance makes it the preferred target of attacks. Web-based vulnerabilities now outnumber traditional computer security concerns. A recent study shows that over 80 percent of web sites have had at least one serious vulnerability. We believe that the Web's problems, to a large degree, are caused by the inadequacy of its underlying accesscontrol systems. To reduce the number of vulnerabilities, it is essential to provide web applications with better accesscontrolmodelsthat can adequately address the protection needs of the current Web. As a part of the efforts to develop a better accesscontrol system for the Web, we focus on the server-side accesscontrol in this paper. We introduce a new concept called subsession, based on which, we have developed a ring-based accesscontrol system (called Scuta) for web servers. Scuta provides a fine-grained and backward-compatible accesscontrol mechanism for web applications. We have implemented Scuta in PHP, and have conducted comprehensive case studies to evaluate its benefits. Copyright 2012 acm.
this paper describes our system, built as part of a commercially available product, for inferring the risk in an RBAC policy model, i.e., the assignment of permissions to roles and roles to users. Our system implement...
详细信息
ISBN:
(纸本)9781450312950
this paper describes our system, built as part of a commercially available product, for inferring the risk in an RBAC policy model, i.e., the assignment of permissions to roles and roles to users. Our system implements a general model of risk based on any arbitrary set of properties of permissions and users. Our experience shows that fuzzy inferencing systems are best suited to capture how humans assign risk to such assignments. To implement fuzzy inferencing practically we need the axiom of monotonicity, i.e., risk can not decrease when more permissions are assigned to a role or when the role is assigned to fewer users. We describe the visualization component which administrators can use to infer aggregate risk in role assignments as well as drill down into which assignments are actually risky. Administrators can then use this knowledge to refactor roles and assignments. Copyright 2012 acm.
Withthe widespread use of online social networks and mobile devices, it is not uncommon for people to continuously broadcast contextual information such as their current location or activity. these technologies prese...
详细信息
ISBN:
(纸本)9781450312950
Withthe widespread use of online social networks and mobile devices, it is not uncommon for people to continuously broadcast contextual information such as their current location or activity. these technologies present both new opportunities for social engagement and new risks to privacy, and traditional static 'write once' disclosure policies are not well suited for controlling aggregate exposure risks in the current technological landscape. therefore, we present PlexC, a new policy language designed for exposure control. We take advantage of several recent user studies to identify a set of language requirements and features, providing the expressive power to accommodate information sharing in dynamic environments. In our evaluation we show that PlexC can concisely express common policy idioms drawn from survey responses, in addition to more complex information sharing scenarios. Copyright 2012 acm.
Today, Role Based accesscontrol (RBAC) is the de facto model used for advanced accesscontrol, and is widely deployed in diverse enterprises of all sizes. Several extensions to the authorization as well as the admini...
详细信息
ISBN:
(纸本)9781450312950
Today, Role Based accesscontrol (RBAC) is the de facto model used for advanced accesscontrol, and is widely deployed in diverse enterprises of all sizes. Several extensions to the authorization as well as the administrative models for RBAC have been adopted in recent years. In this paper, we consider the temporal extension of RBAC (TRBAC), and develop safety analysis techniques for it. Safety analysis is essential for understanding the implications of security policies both at the stage of specification and modification. Towards this end, in this paper, we first define an administrative model for TRBAC. Our strategy for performing safety analysis is to appropriately decompose the TRBAC analysis problem into multiple subproblems similar to RBAC. Along with making the analysis simpler, this enables us to leverage and adapt existing analysis techniques developed for traditional RBAC. We have adapted and experimented with employing two state of the art analysis approaches developed for RBAC as well as tools developed for software testing. Our results show that our approach is both feasible and flexible. Copyright 2012 acm.
Modern enterprise systems have to comply to regulations such as Basel III resulting in complex security requirements. these requirements need to be modeled at design-time and enforced at runtime. Moreover, modern ente...
详细信息
ISBN:
(纸本)9781450312950
Modern enterprise systems have to comply to regulations such as Basel III resulting in complex security requirements. these requirements need to be modeled at design-time and enforced at runtime. Moreover, modern enterprise systems are often business-process driven, i.e., the system behavior is described as high-level business processes that are executed by a business process execution engine. Consequently, there is a need for an integrated and tool-supported methodology that allows for specifying and enforcing compliance and security requirements for business process-driven enterprise systems. In this paper, we present a tool chain supporting boththe design-time modeling as well as the run-time enforcement of security requirements for business process-driven systems. Copyright 2012 acm.
暂无评论