检索结果-内蒙古大学图书馆

access control via Belnap Logic: Intuitive, Expressive, and Analyzable Policy Composition

acm TRANSACTIONS ON INFORMATION AND SYSTEM SECURITY 2011年第1期14卷 1–27页

作者： Bruns, Glenn Huth, Michael Alcatel Lucent Bell Labs Naperville IL 60563 USA Univ London Imperial Coll Sci Technol & Med Dept Comp London SW7 2AZ England

access control to IT systems increasingly relies on the ability to compose policies. Hence there is benefit in any framework for policy composition that is intuitive, formal (and so "analyzable" and "implementable"), expressive, independent of specific application domains, and yet able to be extended to create domain-specific instances. Here we develop such a framework based on Belnap logic. An access-control policy is interpreted as a four-valued predicate that maps access requests to either grant, deny, conflict, or unspecified - the four values of the Belnap bilattice. We define an expressive access-control policy language PBel, having composition operators based on the operators of Belnap logic. Natural orderings on policies are obtained by lifting the truth and information orderings of the Belnap bilattice. these orderings lead to a query language in which policy analyses, for example, conflict freedom, can be specified. Policy analysis is supported through a reduction of the validity of policy queries to the validity of propositional formulas on predicates over access requests. We evaluate our approach through firewall policy and RBAC policy examples, and discuss domain-specific and generic extensions of our policy language.

关键词： Languages theory Security access-control policy languages bilattices multivalued logic

来源：评论

学校读者我要写书评

暂无评论

Data-centric multi-layer usage control enforcement: A social network example 11

Data-centric multi-layer usage control enforcement: A social...

引用

Proceedings of the 16th acm symposium on access control models and technologies

作者： Lovat, Enrico Pretschner, Alexander Karlsruhe Institute of Technology Karlsruhe Germany

ISBN: (纸本)9781450307215

Usage control is concerned with how data is used after access to it has been granted. Data may exist in multiple representations which potentially reside at different layers of abstraction, including operating system, window manager, application level, DBMS, etc. Consequently, enforcement mechanisms need to be implemented at different layers, in order to monitor and control data at and across all of them. We present an architecture for usage control enforcement mechanisms that cater to the data dimension, grasping the distinction between data (e.g a picture or a song) and its representations within the system (e.g a file, a window, a network packet, etc.). We then show three exemplary instantiations at the level of operating system, application, and windowing system. Our mechanisms enforce data-related policies simultaneously at the respective levels, offering a concrete multi-layer enforcement and laying the grounds for a combined inter-layer usage control enforcement. In this demo, we consider a use case from a social network scenario. A user can, on the grounds of assigned trust values, protect his data from being misused after having been downloaded by other users. In particular, our mechanisms prevent sensitive data in the browser window from being printed, saved or copied to the system clipboard, avoid direct access to the cached copy of the file and forbid taking a screenshot of the window where data is shown. © 2011 acm.

关键词： Sensitive data

来源：评论

学校读者我要写书评

暂无评论

An integrated approach for identity and access management in a SOA context 11

An integrated approach for identity and access management in...

引用

Proceedings of the 16th acm symposium on access control models and technologies

作者： Hummer, Waldemar Gaubatz, Patrick Strembeck, Mark Zdun, Uwe Dustdar, Schahram Distributed Systems Group Information Systems Institute Vienna University of Technology Austria Software Architecture Group Faculty of Computer Science University of Vienna Austria Information Systems Institute Vienna University of Economics and Business Austria

ISBN: (纸本)9781450307215

In this paper, we present an approach for identity and access management (IAM) in the context of (cross-organizational) serviceoriented architectures (SOA). In particular, we defined a domainspecific language (DSL) for role-based access control (RBAC) that allows for the definition of IAM policies for SOAs. For the application in a SOA context, our DSL environment automatically produces WS-BPEL (Business Process Execution Language for Web services) specifications from the RBAC models defined in our DSL. We use the WS-BPEL extension mechanism to annotate parts of the process definition with directives concerning the IAM policies. At deployment time, the WS-BPEL process is instrumented with special activities which are executed at runtime to ensure its compliance to the IAM policies. the algorithm that produces extended WS-BPEL specifications from DSL models is described in detail. thereby, policies defined via our DSL are automatically mapped to the implementation level of a SOA-based business process. this way, the DSL decouples domain experts' concerns from the technical details of IAM policy specification and enforcement. Our approach thus enables (non-technical) domain experts, such as physicians or hospital clerks, to participate in defining and maintaining IAM policies in a SOA context. Based on a prototype implementation we also discuss several performance aspects of our approach. © 2011 acm.

关键词： Web services

来源：评论

学校读者我要写书评

暂无评论

Symbolic reachability analysis for parameterized administrative role-based access control

引用

COMPUTERS & SECURITY 2011年第2-3期30卷 148-164页

作者： Stoller, Scott D. Yang, Ping Gofman, Mikhail I. Ramakrishnan, C. R. SUNY Stony Brook Dept Comp Sci Stony Brook NY 11794 USA SUNY Binghamton Dept Comp Sci Binghamton NY 13902 USA

Role-based access control (RBAC) is a widely used access control paradigm. In large organizations, the RBAC policy is managed by multiple administrators. An administrative role-based access control (ARBAC) policy specifies how each administrator may change the RBAC policy. It is often difficult to fully understand the effect of an ARBAC policy by simple inspection, because sequences of changes by different administrators may interact in unexpected ways. ARBAC policy analysis algorithms can help by answering questions, such as user-role reachability, which asks whether a given user can be assigned to given roles by given administrators. Allowing roles and permissions to have parameters significantly enhances the scalability, flexibility, and expressiveness of ARBAC policies. this paper defines PARBAC, which extends the classic ARBAC97 model to support parameters, proves that user-role reachability analysis for PARBAC is undecidable when parameters may range over infinite types, and presents a semi-decision procedure for reachability analysis of PARBAC. To the best of our knowledge, this is the first analysis algorithm specifically for parameterized ARBAC policies. We evaluate its efficiency by analyzing its parameterized complexity and benchmarking it on case studies and synthetic policies. We also experimentally evaluate the effectiveness of several optimizations. (C) 2010 Elsevier Ltd. All rights reserved.

关键词： Policy analysis Policy administration Role-based access control RBAC

来源：评论

学校读者我要写书评

暂无评论

Practical and Efficient Cryptographic Enforcement of Interval-Based access control Policies

Practical and Efficient Cryptographic Enforcement of Interva...

引用

13th acm symposium on access control models and technologies

作者： Crampton, Jason Univ London Dept Math Informat Secur Grp Egham TW20 0EX Surrey England

the enforcement of access control policies using cryptography has received considerable attention in recent years and the security of such enforcement schemes is increasingly well understood. Recent work in the area has considered the efficient enforcement of temporal and geo-spatial access control policies, and asymptotic results for the time and space complexity of efficient enforcement schemes have been obtained. However, for practical purposes, it is useful to have explicit bounds for the complexity of enforcement schemes. In this article we consider interval-based access control policies, of which temporal and geo-spatial access control policies are special cases. We define enforcement schemes for interval-based access control policies for which it is possible, in almost all cases, to obtain exact values for the schemes' complexity, thereby subsuming a substantial body of work in the literature. Moreover, our enforcement schemes are more practical than existing schemes, in the sense that they operate in the same way as standard cryptographic enforcement schemes, unlike other efficient schemes in the literature. the main difference between our approach and earlier work is that we develop techniques that are specific to the cryptographic enforcement of interval-based access control policies, rather than applying generic techniques that give rise to complex constructions and asymptotic bounds.

关键词： Security Algorithms Interval-based access control cryptographic enforcement temporal access control geo-spatial access control

来源：评论

学校读者我要写书评

暂无评论

access control via Belnap Logic: Intuitive, Expressive, and Analyzable Policy Composition

Access Control via Belnap Logic: Intuitive, Expressive, and ...

引用

13th acm symposium on access control models and technologies

作者： Bruns, Glenn Huth, Michael Alcatel Lucent Bell Labs Naperville IL 60563 USA Univ London Imperial Coll Sci Technol & Med Dept Comp London SW7 2AZ England

关键词： Languages theory Security access-control policy languages bilattices multivalued logic

来源：评论

学校读者我要写书评

暂无评论

Authorization Recycling in Hierarchical RBAC Systems

Authorization Recycling in Hierarchical RBAC Systems

引用

13th acm symposium on access control models and technologies

作者： Wei, Qiang Crampton, Jason Beznosov, Konstantin Ripeanu, Matei CCB Int Holdings Ltd Hong Kong Hong Kong Peoples R China Univ London Dept Math Egham TW20 0EX Surrey England Univ British Columbia Dept Elect & Comp Engn Vancouver BC V6T 1Z4 Canada

As distributed applications increase in size and complexity, traditional authorization architectures based on a dedicated authorization server become increasingly fragile because this decision point represents a single point of failure and a performance bottleneck. Authorization caching, which enables the reuse of previous authorization decisions, is one technique that has been used to address these challenges. this article introduces and evaluates the mechanisms for authorization "recycling" in RBAC enterprise systems. the algorithms that support these mechanisms allow making precise and approximate authorization decisions, thereby masking possible failures of the authorization server and reducing its load. We evaluate these algorithms analytically as well as using simulation and a prototype implementation. Our evaluation results demonstrate that authorization recycling can improve the performance of distributed-access control mechanisms.

关键词： Security Design Performance Reliability SAAM RBAC access control authorization recycling

来源：评论

学校读者我要写书评

暂无评论

A Novel Multichannel Cognitive Radio Network with throughput Analysis at Saturation Load

A Novel Multichannel Cognitive Radio Network with Throughput...

引用

10th IEEE International symposium on Network Computing and Applications (NCA)

作者： Hasan, Rashidul Murshed, Manzur Monash Univ Gippsland Sch Informat Technol Churchill Vic 3842 Australia

ISBN: (纸本)9780769544892

Opportunistic access of licensed spectrum using a cognitive radio network (CRN) is getting research attraction due to its ability to improve utilisation of this scarce resource without affecting the primary users (PUs). To improve wide acceptability of CRN, it must be equipped with efficient protocols to deal with multiple primary networks to provision QoS guarantee for demand-driven applications by the secondary users (SUs). In this paper, a novel CSMA/CA-based multichannel cognitive radio medium access control (MCR-MAC) protocol is developed by modifying the 4-way handshaking based IEEE 802.11 DCF to dynamically assign contending SUs to free channels using an innovative random arbitration scheme. the paper also presents a detailed analytical model for cognitive interference to the PUs and SUs. the proposed protocol is designed to keep the interference level in check to remain transparent to the PUs. A throughput analysis at saturation load reveals that this fully ad-hoc MCR-MAC is capable of achieving throughput comparable to the ideal scenario (when SUs are equally divided to the channels) without using any centralised infrastructure or dedicated control channel. Extensive simulation results validate the accuracy of the theoretical analysis and establish MCR-MAC as a highly practical solution to construct a CRN in a region overlapped with multiple primary networks to offer data-rate sensitive applications by the SUs.

关键词： 4-way handshaking Analytical models CSMA/CA Channel estimation IEEE 802.11 DCF Interference Protocols Radiation detectors throughput access protocols carrier sense multiple access cognitive interference cognitive radio dedicated control channel interference level licensed spectrum multichannel cognitive radio medium access control protocol multichannel cognitive radio network opportunistic access quality of service quality of service random arbitration scheme saturation load throughput analysis wireless LAN

来源：评论

学校读者我要写书评

暂无评论

DC Proposal: Knowledge Based access control Policy Specification and Enforcement

DC Proposal: Knowledge Based Access Control Policy Specifica...

引用

Semantic Web Challenge at the 10th International Semantic Web Conference

作者： Kirrane, Sabrina Natl Univ Ireland Digital Enterprise Res Inst Galway Ireland

ISBN: (纸本)9783642250927

the explosion of digital content and the heterogeneity of enterprise content sources have resulted in a pressing need for advanced tools and technologies, to support enterprise content search and analysis. Semantic technology and linked data may be the long term solution to this growing problem. Our research explores the application of access control to a knowledge discovery platform. In order to ensure integrated information is only accessible to authorised individuals, existing access control policies need to be associated with the data. through in-depth analysis we aim to propose an access control model and enforcement framework which can be used to represent and enforce various access models both inside and outside the enterprise. Furthermore, through experimentation we plan to develop a methodology which can be used as a guideline for the lifting of distributed access control policies from the individual data sources to a linked data network.

关键词： Policy access control Reasoning information Analysis Knowledge Discovery Linked Data

来源：评论

学校读者我要写书评

暂无评论

IB-MAC: Improvement of the backoff algorithm for better MAC - TCP protocols interactions in MANET

IB-MAC: Improvement of the backoff algorithm for better MAC ...

引用

International symposium on Programming and Systems

作者： Hamrioui, Sofiane Lalam, Mustapha University of Technology Sciences Houari Boumediene Algiers Algeria University Mouloud Mammeri Tizi Ouzou Algeria

ISBN: (纸本)9781457709067

In this paper, we will study the interactions between medium access control (MAC) and Transfer control Protocol (TCP) protocols. these interactions will be done with some of the IETF standardised reactive (AODV, DSR) and proactive (DSDV) routing protocols under varying network conditions such as load and mobility. We will suggest an improvement to these interactions for a better MANET performance. We especially interest to the TCP performance parameters like the sending rate of the TCP packets. this improvement is the IB-MAC (backoff improvement of the MAC protocol) which proposes a new backoff algorithm based on a dynamic adaptation of its maximal limit according to the number of nodes and their mobility. Finally, we will complete our study by showing the incidences of IB-MAC on MANET performance. © 2011 IEEE.

关键词： Medium access control

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：