检索结果-内蒙古大学图书馆

DIFCS: A Secure Cloud Data Sharing Approach Based on decentralized information flow control

COMPUTERS & SECURITY 2022年 117卷 102678-102678页

作者： Lu, Jintian Sun, Jiakun Xiao, Ruizhi Jin, Shuyuan Sun Yat Sen Univ Sch Comp Sci & Engn Guangzhou Peoples R China

A Summary In the field of cloud computing, collaboration and data sharing among clouds have dramatically increased. How to protect the security of shared cloud data is being an urgent problem. Based on decentralized information flow control (DIFC) model, this paper presents an approach, DIFC-based data sharing approach (DIFCS), to protect both confidentiality and integrity of shared cloud data. Additionally, this paper designs a privilege protection policy for DIFCS, resulting in its capability of preventing malicious users from modifying privilege. The correctness and security properties of DIFCS are proved by formal analysis and verification, where firstly, DIFCS is formally interpreted into high-level petri net (HLPN) representation and analyzed using Z language, then is automatically verified with SMT-Lib and Z3 solver. The formal analysis and verification results reveal that DIFCS holds the security properties of confidentiality, integrity, authenticity, and privilege tamper-proof. The experimental results further demonstrate the high efficiency of DIFCS. (C) 2022 Elsevier Ltd. All rights reserved.

关键词： decentralized information flow control Cloud data sharing Privilege protection Model checking Formal verification

来源：评论

学校读者我要写书评

暂无评论

AT-DIFC⁺: Toward Adaptive and Trust-Aware decentralized information flow control

引用

ACM TRANSACTIONS ON AUTONOMOUS AND ADAPTIVE SYSTEMS 2021年第4期15卷 13-13页

作者： Skandylas, Charilaos Khakpour, Narges Andersson, Jesper Linnaeus Univ Vaxjo Sweden

Modern software systems and their corresponding architectures are increasingly decentralized, distributed, and dynamic. As a consequence, decentralized mechanisms are required to ensure security in such architectures. decentralized information flow control (DIFC) is a mechanism to control information flow in distributed systems. This article presents and discusses several improvements to an adaptive decentralized information flow approach that incorporates trust for decentralized systems to provide security. Adaptive Trust-Aware decentralized information flow (AT-DIFC+) combines decentralized information flow control mechanisms, trust-based methods, and decentrali ed control architectures to control and enforce information flow in an open, decentralized system. We strengthen our approach against newly discovered attacks and provide additional information about its reconfiguration, decentralized control architectures, and reference implementation. We evaluate the effectiveness and performance of AT-DIFC+ on two case studies and perform additional experiments arid to gauge the mitigations' effectiveness against the identified attacks.

关键词： Adaptive security decentralized information flow control adaptive trust decentralized feedback loop

来源：评论

学校读者我要写书评

暂无评论

Adaptive Trust-Aware decentralized information flow control 1

Adaptive Trust-Aware Decentralized Information Flow Control

引用

1st IEEE International Conference on Autonomic Computing and Self-Organizing Systems (ACSOS)

作者： Skandylas, Charilaos Khakpour, Narges Andersson, Jesper Linnaeus Univ Comp Sci & Media Technol Vaxjo Sweden

ISBN: (纸本)9781728172774

Modern software systems are decentralized, distributed, and dynamic, and consequently, require decentralized mechanisms to enforce security. In this paper, we propose an adaptive approach using a combination of decentralized information flow control (DIFC) mechanisms, trust-based methods and decentralized control architectures to enforce security in open distributed systems. In our approach, adaptivity mitigates two aspects of the system dynamics that cause uncertainty: the ever-changing nature of trust and system openness. We formalize our trust-aware DIFC model and instantiate two decentralized control architectures to implement and evaluate it. We evaluate the effectiveness and performance of our method and decentralized control architectures on two case studies.

关键词： Adaptive Security decentralized information flow control Adaptive Trust decentralized Feedback Loop

来源：评论

学校读者我要写书评

暂无评论

Effect:An Operational View Mechanism for decentralized information flow control

引用

Wuhan University Journal of Natural Sciences 2012年第5期17卷 435-440页

作者： YAN Fei TANG Jingya XIONG Shengchao WANG Juan Key Laboratory of Aerospace Information Security and Trusted Computing Ministry of Education Wuhan 430072 Hubei China School of Computer Wuhan University Wuhan 430072 Hubei China

Flume, which implements decentralized information flow control （DIFC）, allows a high security level process to ＂pre-create＂ secret files in a low security level directory. However, the pre-create mechanism makes some normal system calls unavailable, and moreover, it needs priori knowledge to create a large quantity of objects, which is difficult to estimate in practical operating systems. In this paper, we present an extended Flume file access control mechanism, named Effect, to substitute the mechanism of pre-create, which permits write operations （create, delete, and rename a file） on directories and creates a file access virtual layer that allocates operational views for each process with noninterference properties. In the end, we further present an analysis on the security of Effect. Our work makes it easier for multi-user to share confidential information in decentralized information flow control systems.

关键词： decentralized information flow control precreate operational view file access virtual layer

来源：评论

学校读者我要写书评

暂无评论

SCIFFS: Enabling Secure Third-Party Security Analytics using Serverless Computing 21

SCIFFS: Enabling Secure Third-Party Security Analytics using...

引用

26th ACM Symposium on Access control Models and Technologies (SACMAT)

作者： Polinsky, Isaac Datta, Pubali Bates, Adam Enck, William N Carolina State Univ Raleigh NC 27695 USA Univ Illinois Champaign IL USA

ISBN: (纸本)9781450383653

Third-party security analytics allow companies to outsource threat monitoring tasks to teams of experts and avoid the costs of in-house security operations centers. By analyzing telemetry data from many clients these services are able to offer enhanced insights, identifying global trends and spotting threats before they reach most customers. Unfortunately, the aggregation that drives these insights simultaneously risks exposing sensitive client data if it is not properly sanitized and tracked. In this work, we present SCIFFS, an automated information flow monitoring framework for preventing sensitive data exposure in third-party security analytics platforms. SCIFFS performs decentralized information flow control over customer data in a serverless setting, leveraging the innate polyinstantiated nature of serverless functions to assure precise and lightweight tracking of data flows. Evaluating SCIFFS against a proof-of-concept security analytics framework on the widely-used OpenFaaS platform, we demonstrate that our solution supports common analyst workflows (data ingestion, custom dashboards, threat hunting) while imposing just 3.87% runtime overhead on event ingestion and the overhead on aggregation queries grows linearly with the number of records in the database (e.g., 18.75% for 50,000 records and 104.27% for 500,000 records) as compared to an insecure baseline. Thus, SCIFFS not only establishes a privacy-respecting model for third-party security analytics, but also highlights the opportunities for security-sensitive applications in the serverless computing model.

关键词： Serverless Computing Security Analytics decentralized information flow control

来源：评论

学校读者我要写书评

暂无评论

Building Secure Systems with LIO (Demo)

引用

ACM SIGPLAN NOTICES 2014年第12期49卷 93-94页

作者： Stefan, Deian Levy, Amit Russo, Alejandro Mazieres, David Stanford Univ Stanford CA 94305 USA Chalmers Gothenburg Sweden

LIO is a decentralized information flow control (DIFC) system, implemented in Haskell. In this demo, we give an overview of the LIO library and show how LIO can be used to build secure systems. In particular, we show how to specify high-level security policies in the context of web applications, and describe how LIO automatically enforces these policies even in the presence of untrusted code.

关键词： Security LIO DCLabels Hails decentralized information flow control Web application

来源：评论

学校读者我要写书评

暂无评论

Disjunction Category Labels

引用

16th Nordic Conference on Secure IT-Systems (NordSec)

作者： Stefan, Deian Russo, Alejandro Mazieres, David Mitchell, John C. Stanford Univ Stanford CA 94305 USA Chalmers Univ Technol Gothenburg Sweden

ISBN: (纸本)9783642296147;9783642296154

We present disjunction category (DC) labels, a new label format for enforcing information flow in the presence of mutually distrusting parties. DC labels can be ordered to form a lattice, based on propositional logic implication and conjunctive normal form. We introduce and prove soundness of decentralized privileges that are used in declassifying data, in addition to providing a notion of privilege-hierarchy. Our model is simpler than previous decentralized information flow control (DIFC) systems and does not rely on a centralized principal hierarchy. Additionally, DC labels can be used to enforce information flow both statically and dynamically. To demonstrate their use, we describe two Haskell implementations, a library used to perform dynamic label checks, compatible with existing DIFC systems, and a prototype library that enforces information flow statically, by leveraging the Haskell type checker.

关键词： Security labels decentralized information flow control logic

来源：评论

学校读者我要写书评

暂无评论

Manageable Fine-Grained information flow 08

Manageable Fine-Grained Information Flow

引用

3rd ACM European Conference on Computer Systems (EuroSys 08)

作者： Efstathopoulos, Petros Kohler, Eddie Univ Calif Los Angeles Dept Comp Sci Los Angeles CA 90024 USA

ISBN: (纸本)9781605580135

The continuing frequency and seriousness of security incidents underlines the importance of application security. decentralized information flow control (DIFC), a promising tool for improving application security, gives application developers fine-grained control over security policy and privilege management. DIFC developers can partition much application functionality into untrusted components bound by a kernel- or language-enforced security policy. Unless a (usually smaller and less exposed) trusted component is exploited, the effects of an application compromise are contained by the policy. Although system-based DIFC can simultaneously achieve high performance and effective isolation, it offers a challenging programming model. Fine-grained policy specifications are spread over several application pieces. Common programming errors may be indistinguishable from policy exploit attempts;the system cannot expose developers to information about these errors, complicating debugging. Static checking (as in language-based DIFC) and new system primitives can reduce these problems, but for dynamic applications like web servers, they do not eliminate them. In this paper we propose subsystems that make decentralized information flow more manageable. First, a policy description language specifies an application-wide security policy in one localized place;communication restrictions are compiled into lower-level labels. Second, information flow-safe debugging mechanisms let developers debug DIFC applications without violating security policies. Although these mechanisms are preliminary, we demonstrate their effectiveness using applications similar to those developed for Asbestos and other DIFC systems.

关键词： decentralized information flow control labels policy language debugging

来源：评论

学校读者我要写书评

暂无评论

information flow control for standard OS abstractions 07

Information flow control for standard OS abstractions

引用

Proceedings of twenty-first ACM SIGOPS symposium on Operating systems principles

作者： Maxwell Krohn Alexander Yip Micah Brodsky Natan Cliffer M. Frans Kaashoek Eddie Kohler Robert Morris MIT Cambridge MA UCLA Los Angeles CA

ISBN: (纸本)9781595935915

decentralized information flow control (DIFC) is an approach to security that allows application writers to control how data flows between the pieces of an application and the outside world. As applied to privacy, DIFC allows untrusted software to compute with private data while trusted security code controls the release of that data. As applied to integrity, DIFC allows trusted code to protect untrusted software from unexpected malicious inputs. In either case, only bugs in the trusted code, which tends to be small and isolated, can lead to security *** present Flume, a new DIFC model that applies at the granularity of operating system processes and standard OS abstractions (e.g., pipes and file descriptors). Flume was designed for simplicity of mechanism, to ease DIFC's use in existing applications, and to allow safe interaction between conventional and DIFC-aware processes. Flume runs as a user-level reference monitor onLinux. A process confined by Flume cannot perform most system calls directly; instead, an interposition layer replaces system calls with IPCto the reference monitor, which enforces data flowpolicies and performs safe operations on the process's behalf. We ported a complex web application (MoinMoin Wiki) to Flume, changingonly 2% of the original code. Performance measurements show a 43% slowdown on read workloadsand a 34% slowdown on write workloads, which aremostly due to Flume's user-level implementation.

关键词： system call interposition endpoints web services reference monitor decentralized information flow control DIFC

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：