Mobile devices consume significant amounts of information, from different sources. thus they often deal also with sensitive or confidential data, in places or situations that could be not appropriate, or not compliant...
详细信息
ISBN:
(纸本)9781450319508
Mobile devices consume significant amounts of information, from different sources. thus they often deal also with sensitive or confidential data, in places or situations that could be not appropriate, or not compliant with a corporate policy: context-aware access/usage control solutions can counter such situations. We propose a prototype, called ProtectMe, that exploits "Sticky Policies"(SP) that are attached to resources and prescribe usage conditions. Since mobile devices cannot foresee usage conditions of collected data, ProtectMe integrates SPs within any information consumable by mobile devices, and dynamically enforces their usage constraints. It assists users in attaching access and usage control conditions stated by resource-specific SPs, and it enforces them by making use of contextual information collected by mobile devices. the aim of the prototype is to show the feasibility of the SP approach, merging security functionalities within a concept for expressing SPs in a user-friendly manner. Copyright 2013acm.
Although the declarative nature of SQL provides great utility to database users, its use in distributed database management systems can result in unintended consequences to user privacy over the course of query evalua...
详细信息
ISBN:
(纸本)9781450319508
Although the declarative nature of SQL provides great utility to database users, its use in distributed database management systems can result in unintended consequences to user privacy over the course of query evaluation. By allowing users to merely say what data they are interested in accessing without providing guidance regarding how to retrieve it, query optimizers can generate plans that leak sensitive query intension. To address these types of issues, we have created a framework that empowers users withthe ability to specify accesscontrols on the intension of their queries through extensions to the SQL SELECT statement. In this demonstration, we present a version of PostgreSQL's query optimizer that we have modified to produce plans that respect these constraints while optimizing user-specified SQL queries in terms of performance. Copyright 2013acm.
the successful operation of NATO missions requires effective and secure sharing of information among coalition partners and external organizations, while avoiding the disclosure of sensitive information to untrusted u...
详细信息
ISBN:
(纸本)9781450319508
the successful operation of NATO missions requires effective and secure sharing of information among coalition partners and external organizations, while avoiding the disclosure of sensitive information to untrusted users. To resolve the conflict between confidentiality and availability, NATO is developing a new information sharing infrastructure, called Content-based Protection and Release. We describe the architecture of accesscontrol in NATO operations, which is designed to be easily built on top of available (service-oriented) infrastructures for identity and accesscontrol management. We then present a use case scenario drawn from the NATO Passive Missile Defence system for simulating the consequences of intercepting missile attacks. In the system demonstration, we show how maps annotated withthe findings of the system are filtered by the accesscontrol module to produce appropriate views for users with different clearances and terminals under given release and protection policies. Copyright 2013acm.
Recently, the importance of including obligations as part of accesscontrol systems for privilege management, for example, in healthcare information systems, has been well recognized. In an accesscontrol system, an a...
详细信息
ISBN:
(纸本)9781450319508
Recently, the importance of including obligations as part of accesscontrol systems for privilege management, for example, in healthcare information systems, has been well recognized. In an accesscontrol system, an a posteriori obligation states which actions need to be performed by a user after he has accessed a resource. there is no guarantee that a user will fulfill a posteriori obligations. Not fulfilling these obligations may incur financial loss, or loss of goodwill and productivity to the organization. In this paper, we propose a trust-and-obligation based framework that reduces the risk exposure of an organization associated with a posteriori obligations. We propose a methodology to assign trust values to users to indicate how trustworthy they are with regards to fulfilling their obligations. When access requests that trigger a posteriori obligations are evaluated, the requesting users' trust values and the criticality of the associated obligations are used. Our framework detects and mitigates insider attacks and unintentional damages that may result from violating a posteriori obligations. Our framework also provides mechanisms to determine misconfigurations of obligation policies. We evaluate our framework through simulations and demonstrate its effectiveness. Copyright 2013acm.
the proceedings contain 27 papers. the topics discussed include: ensuring authorization privileges for cascading user obligations;generative models for accesscontrol policies: applications to role mining over logs wi...
ISBN:
(纸本)9781450312950
the proceedings contain 27 papers. the topics discussed include: ensuring authorization privileges for cascading user obligations;generative models for accesscontrol policies: applications to role mining over logs with attribution;SCUTA: a server-side accesscontrol system for web applications;optimal workflow-aware authorizations;accesscontrol for RDF graphs using abstract models;a cloud-based RDF policy engine for assured information sharing;SecureBPMN: modeling and enforcing accesscontrol requirements in business processes;encryption-enforced accesscontrol for an RFID discovery service;automating architectural security analysis;a trust-and-risk aware RBAC framework: tackling insider threat;analyzing temporal role based accesscontrolmodels;a framework integrating attribute-based policies into role-based accesscontrol;and a framework for verification and optimal reconfiguration of event-driven role based accesscontrol policies.
the evolution of information systems sees an increasing need of flexible and sophisticated approaches for the automated detection of anomalies in security policies. One of these anomalies is redundancy, which may incr...
详细信息
ISBN:
(纸本)9781450319508
the evolution of information systems sees an increasing need of flexible and sophisticated approaches for the automated detection of anomalies in security policies. One of these anomalies is redundancy, which may increase the total cost of management of the policies and may reduce the performance of accesscontrol mechanisms and of other anomaly detection techniques. We consider three approaches that can remove redundancy from accesscontrol policies, progressively reducing the number of authorizations in the policy itself. We show that several problems associated with redundancy are NP-hard. We propose exact solutions to two of these problems, namely the Minimum Policy Problem, which consists in computing the minimum policy that represents the behaviour of the system, and the Minimum Irreducible Policy Problem, consisting in computing the redundancy-free version of a policy withthe smallest number of authorizations. Furthermore we propose heuristic solutions to those problems. We also present a comparison between the exact and heuristics solutions based on experiments that use policies derived from bibliographical databases. Copyright 2013acm.
While XML has been widely adopted for information sharing over the Internet, the need for efficient XML accesscontrol naturally arise. Various XML accesscontrol enforcement mechanisms have been proposed in the resea...
详细信息
ISBN:
(纸本)9781450319508
While XML has been widely adopted for information sharing over the Internet, the need for efficient XML accesscontrol naturally arise. Various XML accesscontrol enforcement mechanisms have been proposed in the research community, such as view-based approaches and pre-processing approaches. Each category of solutions has its inherent advantages and disadvantages. For instance, view based approach provides high performance in query evaluation, but suffers from the view maintenance issues. To remedy the problems, we propose a hybrid approach, namely HyXAC: Hybrid XML accesscontrol. HyXAC provides efficient accesscontrol and query processing by maximizing the utilization of available (but constrained) resources. HyXAC first uses the pre-processing approach as a baseline to process queries and define sub-views. In HyXAC, views are not defined in a per-role basis, instead, a sub-view is defined for each accesscontrol rule, and roles with identical rules would share the sub-view. Moreover, HyXAC dynamically allocates the available resources (memory and secondary storage) to materialize and cache sub-views to improve query performance. With intensive experiments, we have shown that HyXAC optimizes the usage of system resource, and improves the performance of query processing. Copyright 2013acm.
the proceedings contain 20 papers. the topics discussed include: fast exact and heuristic methods for role minimization problems;migrating to optimal RBAC with minimal perturbation;mining roles with semantic meanings;...
ISBN:
(纸本)9781605581293
the proceedings contain 20 papers. the topics discussed include: fast exact and heuristic methods for role minimization problems;migrating to optimal RBAC with minimal perturbation;mining roles with semantic meanings;delegation and satisfiability in workflow systems;enforcing security properties in task-based systems;task-based entailment constraints for basic workflow patterns;role on role engineering;RBAC administration in distributed systems;policy decomposition for collaborative accesscontrol;context-aware role-based accesscontrol in pervasive computing systems;a general obligation model and continuity-enhanced policy enforcement engine for usage control;an obligation model bridging accesscontrol policies and privacy policies;measuring integrity on mobile phone systems;and detecting and resolving policy misconfigurations in access-control systems.
the current Idintity and access Management (IAM) landscape mainly consists of classic Identity Management (IdM) and business-oriented access Governance. IdM focuses more on providing a single point of administration a...
详细信息
ISBN:
(纸本)9781450319508
the current Idintity and access Management (IAM) landscape mainly consists of classic Identity Management (IdM) and business-oriented access Governance. IdM focuses more on providing a single point of administration and provisioning users withthe needed access rights. In contrast, access Governance concentrates on integrating business departments in the assignment and controlling of access rights in the organisation. It therefore provides functions like access request and approval workflows and access certification processes. In addition, the demand to analyse access right structures to cover compliance requirements increases. We therefore use a business intelligence (BI) based approach to complement the current IAM landscape with comprehensive and powerful analysis capabilities. We see the following additional values in providing a separate access Intelligence system: • Using a BI system allows us to convert the access data into a format which allows flexible and fast analytics. • We can fulfil the demand of many organisations to separate their operative accesscontrol systems and the analytics system. Using the well-known capabilities of a BI system, new analyses are provided. One example is the permission path analysis. It divides complex access structures into single paths and thereby lays the foundation for effective access right analyses. In this paper we present the permission path analysis and describe two evaluations based on it. Copyright 2013acm.
In the near future, clouds will provide situational monitoring services using streaming data. Examples of such services include health monitoring, stock market monitoring, shopping cart monitoring, and emergency contr...
详细信息
ISBN:
(纸本)9781450319508
In the near future, clouds will provide situational monitoring services using streaming data. Examples of such services include health monitoring, stock market monitoring, shopping cart monitoring, and emergency control and threat management. Offering such services require securely processing data streams generated by multiple, possibly competing and/or complementing, organizations. Processing of data streams also should not cause any overt or covert leakage of information across organizations. We propose an information flow control model adapted from the Chinese Wall policy that can be used to protect against sensitive data disclosure. We propose architectures that are suitable for securely and efficiently processing streaming information belonging to different organizations. We discuss how performance can be further improved by sharing the processing of multiple queries. We demonstrate the feasibility of our approach by implementing a prototype of our system and show the overhead incurred due to the information flow constraints. Copyright 2013acm.
暂无评论