Technological innovations like social networks, personal devices and cloud computing, allow users to share and store online a huge amount of personal data. Sharing personal data online raises significant privacy conce...
详细信息
The successful operation of NATO missions requires effective and secure sharing of information among coalition partners and external organizations, while avoiding the disclosure of sensitive information to untrusted u...
详细信息
ISBN:
(纸本)9781450319508
The successful operation of NATO missions requires effective and secure sharing of information among coalition partners and external organizations, while avoiding the disclosure of sensitive information to untrusted users. To resolve the conflict between confidentiality and availability, NATO is developing a new information sharing infrastructure, called Content-based Protection and Release. We describe the architecture of accesscontrol in NATO operations, which is designed to be easily built on top of available (service-oriented) infrastructures for identity and accesscontrol management. We then present a use case scenario drawn from the NATO Passive Missile Defence system for simulating the consequences of intercepting missile attacks. In the system demonstration, we show how maps annotated with the findings of the system are filtered by the accesscontrol module to produce appropriate views for users with different clearances and terminals under given release and protection policies. Copyright 2013 acm.
The evolution of information systems sees an increasing need of flexible and sophisticated approaches for the automated detection of anomalies in security policies. One of these anomalies is redundancy, which may incr...
详细信息
ISBN:
(纸本)9781450319508
The evolution of information systems sees an increasing need of flexible and sophisticated approaches for the automated detection of anomalies in security policies. One of these anomalies is redundancy, which may increase the total cost of management of the policies and may reduce the performance of accesscontrol mechanisms and of other anomaly detection techniques. We consider three approaches that can remove redundancy from accesscontrol policies, progressively reducing the number of authorizations in the policy itself. We show that several problems associated with redundancy are NP-hard. We propose exact solutions to two of these problems, namely the Minimum Policy Problem, which consists in computing the minimum policy that represents the behaviour of the system, and the Minimum Irreducible Policy Problem, consisting in computing the redundancy-free version of a policy with the smallest number of authorizations. Furthermore we propose heuristic solutions to those problems. We also present a comparison between the exact and heuristics solutions based on experiments that use policies derived from bibliographical databases. Copyright 2013 acm.
Modern enterprise systems have to comply to regulations such as Basel III resulting in complex security requirements. These requirements need to be modeled at design-time and enforced at runtime. Moreover, modern ente...
详细信息
ISBN:
(纸本)9781450312950
Modern enterprise systems have to comply to regulations such as Basel III resulting in complex security requirements. These requirements need to be modeled at design-time and enforced at runtime. Moreover, modern enterprise systems are often business-process driven, i.e., the system behavior is described as high-level business processes that are executed by a business process execution engine. Consequently, there is a need for an integrated and tool-supported methodology that allows for specifying and enforcing compliance and security requirements for business process-driven enterprise systems. In this paper, we present a tool chain supporting both the design-time modeling as well as the run-time enforcement of security requirements for business process-driven systems. Copyright 2012 acm.
We address the problem of privacy-preserving accesscontrol in distributed systems. Users commonly reveal more personal data than strictly necessary to be granted access to online resources, even though existing techn...
详细信息
ISBN:
(纸本)9781450300490
We address the problem of privacy-preserving accesscontrol in distributed systems. Users commonly reveal more personal data than strictly necessary to be granted access to online resources, even though existing technologies, such as anonymous credential systems, offer functionalities that would allow for privacy-friendly authorization. An important reason for this lack of technology adoption is, as we believe, the absence of a suitable authorization language offering adequate expressiveness to address the privacy-friendly functionalities. To overcome this problem, we propose an authorization language that allows for expressing accesscontrol requirements in a privacy-preserving way. Our language is independent from concrete technology, thus it allows for specifying requirements regardless of implementation details while it is also applicable for technologies designed without privacy considerations. We see our proposal as an important step towards making accesscontrol systems privacy-preserving.
access to distributed databases containing tuples collected about mobile physical objects requires information about the objects' trajectories. Existing accesscontrolmodels cannot encode this information efficie...
详细信息
ISBN:
(纸本)9781450300490
access to distributed databases containing tuples collected about mobile physical objects requires information about the objects' trajectories. Existing accesscontrolmodels cannot encode this information efficiently. This poses a policy management problem to administrators in real-world supply chains where companies want to protect their goods tracking data. In this paper we propose a new accesscontrol model as an extension to attribute-based accesscontrol that allows trajectory-based visibility policies. We prove the security properties of our novel authentication protocol for distributed systems that can supply the decision algorithm with the necessary reliable information using only standard passive RFID tags. As a result companies will be able to improve confidentiality protection and governance of their object tracking data and more trustingly engage in data sharing agreements.
The proceedings contains 17 papers. Topics discussed include accesscontrol policies and specifications, role engineering, accesscontrol management and models, mobile and cooperative systems and making accesscontrol...
详细信息
The proceedings contains 17 papers. Topics discussed include accesscontrol policies and specifications, role engineering, accesscontrol management and models, mobile and cooperative systems and making accesscontrol more usable.
The proceedings contains 18 papers from Ninth acmsymposium on accesscontrolmodels and technologies, sacmat 2004. The topics discussed include: a logical specification for usage control;implementing accesscontrol t...
详细信息
The proceedings contains 18 papers from Ninth acmsymposium on accesscontrolmodels and technologies, sacmat 2004. The topics discussed include: a logical specification for usage control;implementing accesscontrol to people location information;role based accesscontrol in ambient and remote space;towards a credential-based implementation of compound accesscontrol policies;succinct specifications of portable document access policies;and a role-based approach to accesscontrol for XML databases.
In order to provide a general accesscontrol methodology for parts of XML documents, we propose combining role-based accesscontrol as found in the Role Graph Model, with a methodology originally designed for object-o...
详细信息
ISBN:
(纸本)9781581138726
In order to provide a general accesscontrol methodology for parts of XML documents, we propose combining role-based accesscontrol as found in the Role Graph Model, with a methodology originally designed for object-oriented databases. We give a description of the methodology, showing how different access modes, XPath expressions and roles can be combined, and how propagation of permissions is handled. Given this general approach, a system developer can design a complex authorization model for collections of XML documents.
In the era of Ubiquitous Computing and world-wide data transfer mobility, as an innovative aspect of professional activities, imposes new and complex problems of mobile and distributed access to information, services,...
详细信息
ISBN:
(纸本)9781581138726
In the era of Ubiquitous Computing and world-wide data transfer mobility, as an innovative aspect of professional activities, imposes new and complex problems of mobile and distributed access to information, services, and on-line negotiations for this purpose. This paper restricts itself to presenting a distributed and location-dependent RBAC approach which is multi-layered. Also an adapted form of Administration Nets [24] is presented which allows the scheduling of distributed on-line processes for automated location-dependent negotiating procedures, and for proving their correctness. Examples are discussed in some detail.
暂无评论