Recently, there is a growing trend of organizations migrating to RBAC because of the economic benefits that RBAC provides, and the ease of administration. In order to deploy an RBAC system, one requires to first ident...
详细信息
ISBN:
(纸本)9781450300490
Recently, there is a growing trend of organizations migrating to RBAC because of the economic benefits that RBAC provides, and the ease of administration. In order to deploy an RBAC system, one requires to first identify a complete set of roles. this process, known as role engineering, has been identified as one of the costliest tasks in migrating to RBAC. Several approaches have been proposed that mostly use data mining techniques to discover roles. However, most of them do not consider the existing roles and try to define everything from scratch, which is not acceptable for organizations that already have an RBAC system in place. In this paper, we formally define the problem of mining role hierarchy with minimal perturbation and present State Miner, a heuristic solution to find an RBAC state as similar as possible to boththe existing state and the optimal state. We present experiments to demonstrate the effectiveness of our approach.
the web is now being used as a general platform for hosting distributed applications like wikis, bulletin board messaging systems and collaborative editing environments. Data from multiple applications originating at ...
详细信息
ISBN:
(纸本)9781450300490
the web is now being used as a general platform for hosting distributed applications like wikis, bulletin board messaging systems and collaborative editing environments. Data from multiple applications originating at multiple sources all intermix in a single web browser, snaking sensitive data stored in the browser subject to a broad milieu of attacks (cross-site scripting, cross-site request forgery and others). the fundamental problem is that existing web infrastructure provides no means for enforcing end-to-end security on data. To solve this we design an architecture using mandatory accesscontrol (MAC) enforcement. We overcome the limitations of traditional MAC systems, implemented solely at the operating system layer, by unifying MAC enforcement across virtual machine, operating system, networking and application layers. We implement our architecture using Xen virtual machine management, SELinux at the operating system layer, labeled IPsec for networking and our own label-enforcing web browser, called FlowwolF. We tested our implementation and find that it performs well, supporting data intermixing while still providing end-to-end security guarantees.
Recent studies show that more than 65% of the network vulnerabilities are due to misconfigured network accesscontrol. Arbor Networks in their ISP survey shows that managing accesscontrol is the top challenge in ISP ...
ISBN:
(纸本)9781450300490
Recent studies show that more than 65% of the network vulnerabilities are due to misconfigured network accesscontrol. Arbor Networks in their ISP survey shows that managing accesscontrol is the top challenge in ISP networks today, which creates major reachability and security violations such as unauthorized access/traffic, backdoors and increasing attack surface [1]. accesscontrol exists in network devices such as routers, firewall and IPSec gateways and application-level such RBAC systems and authorization servers. the wide distribution of large number of accesscontrol configurations that usually exhibit different syntactic and semantic behavior in highly dynamic network environments creates real challenges for verifying, evaluating and enforcing accesscontrol policies. thus, there is a pressing need for models and tools that allow for global end-to-end analysis of accesscontrol by integrating network and application-level accesscontrol in a single framework from design, verification and optimization to evaluation and deployment. these frameworks should also provide quantitative means to design and evaluate accesscontrol automatically and objectively [2, 3]. In addition, as security risk is dynamically changing in networks due to new threats or users' behavior, enabling proactive accesscontrol will play an important role in future network defense. In this talk, I will present the state-of-the-art and discuss future challenges of designing, verification and evaluation of accesscontrol policies.
Auto-versioning file systems offer a simple and reliable interface to document change control. the implicit versioning of documents at each write access catches the whole evolution of a document, thus supporting regul...
详细信息
ISBN:
(纸本)9781450302319
Auto-versioning file systems offer a simple and reliable interface to document change control. the implicit versioning of documents at each write access catches the whole evolution of a document, thus supporting regulatory compliance rules. Most existing file systems work on low abstraction levels and track the document evolution on their binary representation. Higher-level differencing tools allow for a far more meaningful change-tracking, though. In this paper, we present an auto-versioning file system that is able to handle files depending on their file type. this way, a suitable differencing tool can be assigned to each file type. Our approach supports regulatory compliant storage as well as the archiving of documents.
Security is one of the most important issues in the grid. Several processes generated by a user need to communicate securely. the existing architectures do not provide support for secure group communication in grid. G...
详细信息
A novel mechanism for providing and enforcing differential accesscontrol for publicly-posted composite documents is proposed. the concept of a document is rapidly changing: individual file-based, traditional formats ...
详细信息
ISBN:
(纸本)9781450302319
A novel mechanism for providing and enforcing differential accesscontrol for publicly-posted composite documents is proposed. the concept of a document is rapidly changing: individual file-based, traditional formats can no longer accommodate the required mixture of differently formatted parts: individual images, video/audio clips, Power Point presentations, html-pages, Word documents, Excel spreadsheets, pdf files, etc. Multi-part composite documents are created and managed in complex workflows, with participants including external consultants, partners and customers distributed across the globe, with many no longer contained within one monolithic secure environment. Distributed over non-secure channels, these documents carry different types of sensitive information: examples include (a) an enterprise pricing strategy for new products, (b) employees' personal records, (c) government intelligence, and (d) individual medical records. A central server solution is often hard or impossible to create and maintain for ad-hoc workflows. thus, the documents are often circulated between workflow participants over traditional, low security e-mails, placed on shared drives, or exchanged using CD/DVD or USB. the situation is more complicated when multiple workflow participants need to contribute to various parts of such a document with different access levels: for example, full editing rights, read-only, reading of some parts only, etc., for different users. We propose a full scale differential accesscontrol approach, enabling public posting of composite documents, to address these concerns.
the enormous amount of data generated in daily operations and the increasing demands for data accessibility across organizations are pushing individuals and organizations to outsource their data storage to cloud stora...
详细信息
According to the nature of IEEE 802.11 wireless LAN, the bandwidth is shared among wireless devices. However, the bandwidth could not be fairly shared among stations, because some users may use greedy applications whi...
详细信息
the proceedings contain 24 papers. the topics discussed include: safety in discretionary accesscontrol for logic-based publish-subscribe systems;ensuring spatio-temporal accesscontrol for real-world applications;an ...
ISBN:
(纸本)9781605585376
the proceedings contain 24 papers. the topics discussed include: safety in discretionary accesscontrol for logic-based publish-subscribe systems;ensuring spatio-temporal accesscontrol for real-world applications;an efficient framework for user authorization queries in RBAC systems;towards formal security analysis of GTRBAC using timed automata;xDomain: cross-border proofs of access;dynamic mandatory accesscontrol for multiple stakeholders;an algebra for fine-grained integration of XacmL policies;usability meets accesscontrol: challenges and research opportunities;automating role-based provisioning by learning from examples;a formal framework to elicit roles with business meaning in RBAC systems;evaluating role mining algorithms;a decision support system for secure information sharing;foundations for group-centric secure information sharing models;patient-centric authorization framework for sharing electronic health records;and accesscontrol policy combining: theory meets practice.
this contribution presents GEMSjax - a web-based metamodeling tool for the collaborative development of domain specific languages. By making use of modern Web 2.0 technologies like Ajax and REST services, the tool all...
详细信息
ISBN:
(纸本)9783642139109
this contribution presents GEMSjax - a web-based metamodeling tool for the collaborative development of domain specific languages. By making use of modern Web 2.0 technologies like Ajax and REST services, the tool allows for simultaneous web browser-based creation/editing of metamodels and model instances, as well as secure remote model access via REST, which enables remote model modification over a simple HTTP-based interface. this paper describes the complex technical challenges we faced and solutions we produced to provide browser-based synchronous model editing. It further explains on the XacmL-based accesscontrol mechanisms to provide secure remote access to models and model elements. Additionally, we highlight the usefulness of our approach by describing its application in a realistic usage scenario.
暂无评论