检索结果-内蒙古大学图书馆

12th acm symposium on access control models and technologies (SacmAT 2007)

作者： Warner, Janice Atluri, Vijayalakshmi Mukkamala, Ravi Vaidya, Jaideep Rutgers State Univ MSIS Dept Piscataway NJ 08855 USA

ISBN: (纸本)9781595937452

In a dynamic coalition environment, organizations should be able to exercise their own local fine-grained access control policies while sharing resources with external entities. In this paper, we propose an approach that exploits the semantics associated with subject and object attributes to facilitate automatic enforcement of organizational access control policies while resources sharing occurs among coalition members. Our approach relies on identifying the necessary attributes required by external users to gain access to a specific organizational object (or service). Specifically, it consists of extracting user attributes sets that semantically match with the attributes of the objects for which a role has permissions. this relies on a closer examination of why a user is assigned a specific role. these attribute sets are first pruned based on their significance in characterizing a role, which are then checked against those submitted by an external user to decide whether to allow or deny access to the specific object. While our goal in this paper is to support coalition based access control, the proposed approach can also aid in automating the process of role engineering.

关键词： access control Semantics Coalitions Collaboration

来源：评论

学校读者我要写书评

暂无评论

Towards Realizing a Formal RBAC Model in Real Systems 07

Towards Realizing a Formal RBAC Model in Real Systems

引用

12th acm symposium on access control models and technologies (SacmAT 2007)

作者： Ahn, Gail-Joon Hu, Hongxin Univ N Carolina Charlotte NC 28223 USA

ISBN: (纸本)9781595937452

there still exists an open question on how formal models can be fully realized in the system development phase. the Model Driven Development (MDD) approach has been recentlyintroduced to deal with such a critical issue for building high assurance software systems. the MDD approach focuses on the transformation of high-level design models to system implementation modules. However, this emerging development approach lacks an adequate procedure to address security issues derived from formal security models. In this paper, we propose an empirical framework to integrate security modle representiation, security policy specification, and systematic validation of security model and policy, which would be eventually used for accommodating security concerns during the sytem development. We also describe how our framework can minimize the gap between security models and the development of secure systems. In addition, we overview a proof-of-concept prototype of our tool that facilitates existing software engineering mechanisms to achieve the above-mentioned features of our framework.

关键词： access control Policy Specification Model Validation Code Generation

来源：评论

学校读者我要写书评

暂无评论

An Approach to Evaluate Policy Similarity 07

An Approach to Evaluate Policy Similarity

引用

12th acm symposium on access control models and technologies (SacmAT 2007)

作者： Lin, Dan Rao, Priathima Bertino, Elisa Lobo, Jorge Purdue Univ Dept Comp Sci W Lafayette IN 47907 USA

ISBN: (纸本)9781595937452

Recent collaborative applications and enterprises very often need to efficiently integrate their access control policies. An important step in policy integration is to analyze the similarity of policies. Existing approaches to policy similarity analysis are mainly based oil logical reasoning and boolean function comparison. Such approaches are computationally expensive and do not;scale well for large heterogeneous distributed environments (like Grid computing systems). In this paper, we propose a policy similarity measure, as a filter phase for policy similarity analysis. this measure provides a lightweight approach to pre-compile a larger amount, of policies and only return the most similar policies for further evaluation. In the paper we formally define the measure, by taking into account both the case of categorical attributes and numeric attributes. Detailed algorithms are presented for the similarly computation. Results of out case study demonstrates the efficiency and practical value of our approach.

关键词： Policy similarity measure XacmL policies access control policies

来源：评论

学校读者我要写书评

暂无评论

Chinese-Wall Process Confinement for Practical Distributed Coalitions 07

Chinese-Wall Process Confinement for Practical Distributed C...

引用

12th acm symposium on access control models and technologies (SacmAT 2007)

作者： Katsuno, Yasuharu Watanabe, Yuji Furuichi, Sanehiro Kudo, Michiharu IBM Res Corp Tokyo Res Lab Yamato Shi 2428502 Japan

ISBN: (纸本)9781595937452

A distributed coalition supports distributed mandatory access controls for resources whose security policies differ for each group of components over nodes, and provides secure information operations and exchanges with nodes that handle information over which conflicts of interest may occur. Many projects have proposed distributed coalitions using a virtual machine monitor, but this approach for strong confinement tends to hinder successful deployments in real world scenarios that involve complicated operations and management for applications because such access control is coarse-grained for the resources. In this paper, we propose a Chinese-Wall Process Confinement (CWPC) for practical application-level distributed coalitions that provide fine-grained access controls for resources and that emphasize minimizing the impact on the usability, using a program-transparent reference monitor. We implemented a prototype system named ALDC for standard office applications on Microsoft Windows that are used on a daily basis for business purposes and that may involve conflicts of interests, evaluated its performance and influence on usability, and show that our approach is practical.

关键词： Distributed System Distributed Coalition Process Confinement Mandatory access control

来源：评论

学校读者我要写书评

暂无评论

PEI models towards Scalable, Usable and High-Assurance Information Sharing 07

PEI Models towards Scalable, Usable and High-Assurance Infor...

引用

12th acm symposium on access control models and technologies (SacmAT 2007)

作者： Krishnan, Ram Sandhu, Ravi Ranganathan, Kumar George Mason Univ Lab Informat Secur Technol Fairfax VA 22030 USA

ISBN: (纸本)9781595937452

Secure Information Sharing (SIS) or "share but protect" is a challenging and elusive problem both because of its broad scope and complexity ranging right from conception (objective and policy) to culmination (implementation). In this paper., we consider how to solve SIS challenges with three main and conflicting objectives: scalability, usability and high-assurance. In the context of SIS, high-assurance requires strong controls oil the client. It is widely accepted that such controls cannot be entirely software-based. In this regard, we consider solutions based oil commercially emerging hardware-rooted Trusted Computing Technology. For SIS, we argue super-distribution ("protect once and access wherever authorized") and off-line access are necessary to achieve scalability and usability. We limit super-distribution to occur within a group of Trusted Platform Module [1] or TPM-enabled machine. For simplicity, we assume all content that are distributed to be read-only. Drilling down, we discuss Policy, Enforcement and Implementation (PEI) models for SIS within a group (group-based SIS or g-SIS).

关键词： Information Sharing Trusted Computing PEI Client-side access control High-Assurance

来源：评论

学校读者我要写书评

暂无评论

A Posteriori Compliance control 07

A Posteriori Compliance Control

引用

12th acm symposium on access control models and technologies (SacmAT 2007)

作者： Etalle, Sandro Winsborough, William H. Univ Twente Enschede Netherlands

ISBN: (纸本)9781595937452

While preventative policy enforcement mechanisms can provide theoretical guarantees that policy is correctly enforced, they have limitations in practice. they are inflexible when unanticipated circumstances arise, and most are either inflexible with respect to the policies they can enforce or incapable of continuing to enforce policies on data objects as they move from one system to another. In this paper we propose an approach to enforcing policies not by preventing unauthorized use, but rather by deterring it. We believe this approach is complementary to preventative policy enforcement. We call our approach APPLE for A-Posteriori PoLicy Enforcement. We introduce APPLE Core, a logical framework for using logs to verity that actions taken by the system were authorized. A trust management system is used to ensure that data objects are provided only to users operating on auditable systems who are subject to penalty should they be found in violation. this combination of audit and accountability behavior, thereby allowing a high level of assurance of end-to-end policy enforcement.

关键词： access control trust management policy enforcement

来源：评论

学校读者我要写书评

暂无评论

Distributed access control: A Privacy-conscious Approach 07

Distributed Access Control: A Privacy-conscious Approach

引用

12th acm symposium on access control models and technologies (SacmAT 2007)

作者： Cautis, Bogdan INRIA Futurs Futurs Italy

ISBN: (纸本)9781595937452

With more and more information being exchanged or published on the Web or in peer-to-peer, and with the significant growth in numbers of distributed, heterogeneous data sources, issues like access control and data privacy are becoming increasingly complex and difficult to manage. Very often, when dealing with sensitive information in such settings, the specification of access control policies and their enforcement are no longer handled by the actual data sources, and are (partially) delegated to third-parties. Besides practical reasons, this is the case when decisions regarding access depend oil factors which overpass the scope and knowledge of sonic of the entities involved. More specifically, policies may depend on private aspects concerning users (accessing data) or data owners. In this case, the only solution is to entrust some third-party authority with all the information needed to apply access policies. However, as the policies themselves depend on sensitive information, this outsourcing raises new privacy issues. that were not present in centralized environments. In particular, information leaks may occur during access control enforcement. In this paper, we consider theses issues and, starting from non-conventional digital signatures, we take a first step towards all implementation solution for such settings where both data and access policies are distributed. Our approach involves rewriting user queries into forms which are authorized. and we illustrate this for both structured (relational) and semi-structured (XML) data and queries.

关键词： access control privacy digital signatures relational data semi-structured data XML

来源：评论

学校读者我要写书评

暂无评论

Towards a VMM-based Usage control Framework for OS Kernel Integrity Protection 07

Towards a VMM-based Usage Control Framework for OS Kernel In...

引用

12th acm symposium on access control models and technologies (SacmAT 2007)

作者： Xu, Min Jiang, Xuxian Sandhu, Ravi Zhang, Xinwen George Mason Univ Fairfax VA 22030 USA

ISBN: (纸本)9781595937452

Protecting kernel integrity is one of the fundamental security objectives in building a trustworthy operating system (OS). For this end, a variety of approaches and systems have been proposed and developed. However, access control models used in most of these systems systems are not expressive enough important security requirements such as continuous policy enforcement and mutable process and object attributes. Even worse, most existing protection mechanisms in these systems reside in the same space as the running OS, which unfortunately can be disabled or subverted after an attacker successfully exploits kernel-level vulnerabilities (or features) to compromise the OS kernel. the increasing number of kernel-level rootkit attacks clearly demonstrates this threat. In this paper we present a simple but effective usage control model UCON kappa I with unique properties of decision continuity and attribute Mutability for OS kernel integrity protection. Further. to enforce UCON kappa I security policies, we propose a virtual machine monitor (VMM) based architecture that is isolated and protected front other untrusted processes inside a virtual machine (VM). We have implemented a proof-of-concept prototype in Linux to demonstrate the feasibility of our approach. Our experiments with 1.8 real-world kernel rootkits show that our approach is able to Successfully detect and prevent all kernel integrity violations from them. Beyond kernel integrity protection, we also explore additional opportunities for general OS security, such as the confinement of process activities as well as the protection of system utility programs at the VMM level.

关键词： authorization access control usage control UCON operating system protection kernel integrity VMM security architecture

来源：评论

学校读者我要写书评

暂无评论

GEO-RBAC: A spatially aware RBAC

引用

acm TRANSACTIONS ON INFORMATION AND SYSTEM SECURITY 2007年第1期10卷 2.1-2.42页

作者： Damiani, Maria Luisa Bertino, Elisa Catania, Barbara Perlasca, Paolo Univ Milan Dipartimento Informat & Comunicaz I-20135 Milan Italy Ecole Polytech Fed Lausanne IC LBD CH-1015 Lausanne Switzerland Univ Genoa Dipartimento Informat & Sci Informat I-16146 Genoa Italy Purdue Univ CERIAS CS Dept W Lafayette IN 47907 USA Purdue Univ ECE Sch W Lafayette IN 47907 USA

Securing access to data in location- based services and mobile applications requires the definition of spatially aware access- control systems. Even if some approaches have already been proposed either in the context of geographic database systems or context- aware applications, a comprehensive framework, general and flexible enough to deal with spatial aspects in real mobile applications, is still missing. In this paper, we make one step toward this direction and present GEO- RBAC, an extension of the RBAC model enhanced with spatial- and location- based information. In GEOR-BAC, spatial entities are used to model objects, user positions, and geographically bounded roles. Roles are activated based on the position of the user. Besides a physical position, obtained from a given mobile terminal or a cellular phone, users are also assigned a logical and device- independent position, representing the feature ( the road, the town, the region) in which they are located. To enhance flexibility and reusability, we also introduce the concept of role schema, specifying the name of the role, as well as the type of the role spatial boundary and the granularity of the logical position. We then extend GEO- RBAC to support hierarchies, modeling permission, user, and activation inheritance, and separation of duty constraints. the proposed classes of constraints extend the conventional ones to deal with different granularities ( schema/ instance level) and spatial information. We conclude the paper with an analysis of several properties concerning the resulting model.

关键词： GIS access-control model location-based services

来源：评论

学校读者我要写书评

暂无评论

Mesh: Secure, Lightweight Grid Middleware Using Existing SSH Infrastructure 07

Mesh: Secure, Lightweight Grid Middleware Using Existing SSH...

引用

12th acm symposium on access control models and technologies (SacmAT 2007)

作者： Kolano, Paul Z. NASA Ames Res Ctr Adv Supercomp Div Moffett Field CA 94035 USA

ISBN: (纸本)9781595937452

Grid computing promises gains in effective computational power. resource utilization, and resource accessibility, but in order to achieve these gains. organizations must deploy grid middleware that, in most cases. does not adhere to fundamental security principles. this paper introduces a new lightweight grid middleware called Mesh, which is based oil the addition of a single sign-on capability to the built-in public key authentication mechanism of SSH using system call interposition. the initial Mesh implementation is compatible;with approximately 90% of the world's SSH servers and any SSH client that supports public key authentication. Resources may be added to a Mesh-based grid in a matter of minutes using just five small files and two environment variable settings. Mesh adheres to fundamental security principles and was designed to be compatible with strong security mechanisms including two-factor authentication, SSH bastions, and restrictive firewalls. Mesh uses a remote command model, which is based on the syntax and commands already understood by users, thus requires no additional knowledge to utilize effectively. Several existing services have been integrated with Mesh to provide resource discovery and query, high performance file transfer, and job management.

关键词： SSH access control authentication authorization delegation distributed systems grids middleware security single sign-on

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：