检索结果-内蒙古大学图书馆

Practical delegation for secure distributed object environments

Distributed Systems Engineering 1998年第4期5卷 168-178页

作者： Nagaratnam, Nataraj Lea, Doug Department of Computer Engineering Syracuse University NY 13244 United States Department of Computer Science SUNY Oswego Oswego NY 13126 United States

SDM is a secure delegation model for java-based distributed object environments. SDM extends current java security features to support secure remote method invocations that may involve chains of delegated calls across distributed objects. The framework supports a control API for application developers to specify mechanisms and security policies surrounding simple or cascaded delegation. Delegation may also be disabled and optionally revoked. These policies may be controlled explicitly in application code, or implicitly via administrative tools. © 1998 The British Computer Society,.

关键词： .require policies supports established specify java-based already Cascaded authentication administrator Practical delegation secure distributed object secure delegation java security invocations

来源：评论

学校读者我要写书评

暂无评论

Trusted Execution Path for Protecting java Applications Against Deserialization of Untrusted Data 21st

Trusted Execution Path for Protecting Java Applications Agai...

引用

21st International Symposium on Research in Attacks, Intrusions and Defenses (RAID)

作者： Cristalli, Stefano Vignati, Edoardo Bruschi, Danilo Lanzi, Andrea Univ Milan Milan Italy

ISBN: (纸本)9783030004705;9783030004699

Deserialization of untrusted data is an issue in many programming languages. In particular, deserialization of untrusted data in java can lead to Remote Code Execution attacks. Conditions for this type of attack exist, but vulnerabilities are hard to detect. In this paper, we propose a novel sandboxing approach for protecting java applications based on trusted execution path used for defining the deserialization behavior. We test our defensive mechanism on two main java Framework JBoss and Jenkins and we show the effectiveness and efficiency of our system. We also discuss the limitations of our current system on newer attacks strategies.

关键词： Sandbox Anomaly detection java security Software protection

来源：评论

学校读者我要写书评

暂无评论

An In-Depth Study of More Than Ten Years of java Exploitation 16

An In-Depth Study of More Than Ten Years of Java Exploitatio...

引用

23rd ACM Conference on Computer and Communications security (CCS)

作者： Holzinger, Philipp Triller, Stefan Bartel, Alexandre Bodden, Eric Fraunhofer SIT Darmstadt Germany Tech Univ Darmstadt Darmstadt Germany Univ Paderborn Paderborn Germany Fraunhofer IEM Paderborn Germany

ISBN: (纸本)9781450341394

When created, the java platform was among the first runtimes designed with security in mind. Yet, numerous java versions were shown to contain far-reaching vulnerabilities, permitting denial-of-service attacks or even worse allowing intruders to bypass the runtime's sandbox mechanisms, opening the host system up to many kinds of further attacks. This paper presents a systematic in-depth study of 87 publicly available java exploits found in the wild. By collecting, minimizing and categorizing those exploits, we identify their commonalities and root causes, with the goal of determining the weak spots in the java security architecture and possible countermeasures. Our findings reveal that the exploits heavily rely on a set of nine weaknesses, including unauthorized use of restricted classes and confused deputies in combination with caller-sensitive methods. We further show that all attack vectors implemented by the exploits belong to one of three categories: single-step attacks, restricted-class attacks, and information hiding attacks. The analysis allows us to propose ideas for improving the security architecture to spawn further research in this area.

关键词： access control exploits java security security analysis

来源：评论

学校读者我要写书评

暂无评论

Code protection for resource-constrained embedded devices 04

Code protection for resource-constrained embedded devices

引用

Conference on Languages, Compilers and Tools for Embedded Systems

作者： Saputra, H Chen, G Brooks, R Vijaykrishnan, N Kandemir, M Irwin, MJ Penn State Univ Appl Res Lab University Pk PA 16802 USA

ISBN: (纸本)9781581138061

While the machine neutral java bytecodes are attractive for code distribution in the highly heterogeneous embedded domain, the well-documented and standardized features also make it difficult to protect these codes. In fact, there are-several tools to reverse engineer java bytecodes. The focus of this work is the design of a substitution-based bytecode obfuscation approach that prevents code from being executed on unauthorized devices. Furthermore, we also improve the resilience of this substitution-based approach to frequency-based attacks. Using various java class files, we show that our approach is 2.5 to 3 times less computationally intensive as compared to a traditional encryption based approach. Our experiments reveal that the protected class files could not execute on unauthorized clients.

关键词： java security cryptography substitution poly-alphabetic monoalphabetic java byte code

来源：评论

学校读者我要写书评

暂无评论

AOLOA: a composable framework for third-party applications for smart home gateways 11

AOLOA: a composable framework for third-party applications f...

引用

11th IEEE International Conference on Services Computing (SCC)

作者： Simon, Eric Manjon, Albert Royo Jean, Sebastien Univ Grenoble Alpes LCIS CTSYS Res Grp F-26900 Valence France

ISBN: (纸本)9781479950669

In the last few years, the amount of smart devices in domestic environments has incredibly increased. Nowadays, a smart home is usually managed via a gateway offering value-added applications by connecting devices to the cloud. Every new device comes with its own features and protocols or cloud services. There is, consequently, a strong need for constantly modifying the gateway's behavior by deploying, removing or updating applications. However, there is no software architecture ensuring enough flexibility and trust to sustain this need. We consequently propose in this article a framework that allows to easily compose modular and context-aware software architectures intending to host third-party applications. This framework - called AOLOA (Another OSGi-Like On Another) - is based on OSGi and java permissions. It ensures applications isolation, separates business-logic (higher level) and platform (lower level) layers and allows their trusted management.

关键词： Service-Oriented Computing Ubiquitous Computing security Software Isolation OSGi java security

来源：评论

学校读者我要写书评

暂无评论

Access rights analysis for java 02

Access rights analysis for Java

引用

17th Meeting on Object-Oriented Programming, Systems, Languages and Applications (OOPSLA 2002)

作者： Koved, L Pistoia, M Kershenbaum, A IBM Corp Thomas J Watson Res Ctr Yorktown Hts NY 10598 USA

ISBN: (纸本)9781581134711

java(TM) 2 has a security architecture that protects systems from unauthorized access by mobile or statically configured code. The problem is in manually determining the set of security access rights required to execute a library or application. The commonly used strategy is to execute the code, note authorization failures, allocate additional access rights, and test again. This process iterates until the code successfully runs for the test cases in hand. Test cases usually do not cover all paths through the code, so failures can occur in deployed systems. Conversely, a broad set of access rights is allocated to the code to prevent authorization failures from occurring. However, this often leads to a violation of the "Principle of Least Privilege." This paper presents a technique for computing the access rights requirements by using a context sensitive, flow sensitive, interprocedural data flow analysis. By using this analysis, we compute at each program point the set of access rights required by the code. We model features such as multi-threading, implicitly defined security policies, the semantics of the *** method and generation of a security policy description. We implemented the algorithms and present the results of our analysis on a set of programs. While the analysis techniques described in this paper are in the context of java code, the basic techniques are applicable to access rights analysis issues in non-java-based systems.

关键词： security languages security call graph invocation graph data flow analysis java security access rights

来源：评论

学校读者我要写书评

暂无评论

Codebase-Adaptive Detection of security-Relevant Methods 2019

Codebase-Adaptive Detection of Security-Relevant Methods

引用

28th ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA)

作者： Piskachev, Goran Lisa Nguyen Quang Do Bodden, Eric Fraunhofer IEM Hannover Germany Paderborn Univ Paderborn Germany

ISBN: (纸本)9781450362245

More and more companies use static analysis to perform regular code reviews to detect security vulnerabilities in their code, configuring them to detect various types of bugs and vulnerabilities such as the SANS top 25 or the OWASP top 10. For such analyses to be as precise as possible, they must be adapted to the code base they scan. The particular challenge we address in this paper is to provide analyses with the correct security-relevant methods (SRM): sources, sinks, etc. We present SWAN, a fully-automated machine-learning approach to detect sources, sinks, validators, and authentication methods for java programs. SWAN further classifies the SRM into specific vulnerability classes of the SANS top 25. To further adapt the lists detected by SWAN to the code base and to improve its precision, we also introduce SWAN(ASSIST), an extension to SWAN that allows analysis users to refine the classifications. On twelve popular java frameworks, SWAN achieves an average precision of 0.826, which is better or comparable to existing approaches. Our experiments show that SWAN(ASSIST) requires a relatively low effort from the developer to significantly improve its precision.

关键词： Program Analysis Machine-learning java security

来源：评论

学校读者我要写书评

暂无评论

Inference of security-Sensitive Entities in Libraries 12

Inference of Security-Sensitive Entities in Libraries

引用

38th IEEE Symposium on security and Privacy (SP)

作者： Lu, Yi Bae, Sora Krishnan, Padmanabhan Raghavendra, K. R. Oracle Labs Brisbane Qld 4000 Australia Korea Adv Inst Sci & Technol Seoul South Korea

ISBN: (纸本)9781538619681

Programming languages such as java and C# execute code with different levels of trust in the same process, and rely on an access control model with fine-grained permissions to protect program code. Permissions are checked programmatically, and rely on programmer discipline. This can lead to subtle errors. To enable automatic security analysis about unauthorised access or information flow, it is necessary to reason about security-sensitive entities in libraries that must be protected by appropriate sanitisation/declassification via permission checks. Unfortunately, security-sensitive entities are not clearly identified. In this paper, we investigate security-sensitive entities used in java-like languages, and develop a static program analysis technique to identify them in large codebases by analysing the patterns of permission checks. Although the technique is generic, our focus is on java where checkPermission calls are used to guard potential security-sensitive entities. Our inference analysis uses two parameters called proximity and coverage to reduce false-positive and false-negative reports. The usefulness of the analysis is illustrated by the results obtained while checking the OpenJDK7-b147 for conformance to java Secure Coding Guidelines that relate to the confidentiality and integrity requirements.

关键词： static analysis java security permissions

来源：评论

学校读者我要写书评

暂无评论

Modeling the java Bytecode Verifier

Modeling the Java Bytecode Verifier

引用

2nd International Conference on Abstract State Machines (ASM), Alloy, B and Z

作者： Reynolds, Mark C. Boston Univ Dept Comp Sci Boston MA 02215 USA

The java programming language has been widely described as secure by design. Nevertheless, a number of serious security vulnerabilities have been discovered in java, particularly in the Bytecode Verifier, a critical component used to verify class semantics before loading is complete. This paper describes a method for representing java security constraints using the Alloy modeling language. It further describes a system for performing a security analysis on any block of java bytecodes by converting these bytecodes into relation initializers in Alloy. Any counterexamples found by the Alloy analyzer correspond directly to potentially insecure code. Analysis of the approach is provided in the context of known security exploits, including type confusion attacks, invalid memory accesses and control flow misdirection. This type of analysis represents a significant departure from standard malware analysis methods based on signatures or anomaly detection. (c) 2011 Elsevier B.V. All rights reserved.

关键词： java security JVM bytecode Alloy Lightweight modeling

来源：评论

学校读者我要写书评

暂无评论

Access rights analysis for java

引用

ACM SIGPLAN NOTICES 2002年第11期37卷 359-372页

作者： Koved, L Pistoia, M Kershenbaum, A IBM Corp Thomas J Watson Res Ctr Yorktown Hts NY 10598 USA

关键词： security languages security call graph invocation graph data flow analysis java security access rights

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：