G. Russello, E. Scalavino, Naranker Dulay, Emil C. Lupu
{"title":"Coordinating Data Usage Control in Loosely-Connected Networks","authors":"G. Russello, E. Scalavino, Naranker Dulay, Emil C. Lupu","doi":"10.1109/POLICY.2010.20","DOIUrl":"https://doi.org/10.1109/POLICY.2010.20","url":null,"abstract":"In a disaster-recovery mission, rescuers need to coordinate their operations and exchange information to make the right judgments and perform their statutory duties. The information exchanged may be privileged or sensitive and not generally in the public domain. For instance, the assessment of the risk level in the disaster area where a chemical plant is located requires data about the nature of the potential chemical hazards and the probability of an hazardous event to occur. Such data may contain information that could be of value to a rival company and may generate chaos if released to the public. Retaining control of data that is shared between organisations can be achieved by deploying Enterprise Rights Management (ERM) systems. However, ERM systems rely on centralised authorities that must be contacted by client applications to obtain access rights. Such centralised solutions are not practical in a disaster scenario where communication infrastructure may have been damaged by the event making very difficult to establish reliable wide-are communications. In this paper, we propose a solution for the enforcement of usage control policies that leverage on the data dissemination model of Opportunistic Networks (oppnets). Our solution, named xDUCON, relies on the data abstraction of the Shared Data Space (SDS). Data and usage control policies are represented as tuples that are disseminated across the available SDSs connected through the oppnets.","PeriodicalId":143330,"journal":{"name":"2010 IEEE International Symposium on Policies for Distributed Systems and Networks","volume":"4 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2010-07-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126499270","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"An Intelligent Network for Federated Testing of NetCentric Systems","authors":"E. Chow, M. James, H. Chang, F. Vatan, G. Sudhir","doi":"10.1109/POLICY.2010.29","DOIUrl":"https://doi.org/10.1109/POLICY.2010.29","url":null,"abstract":"We will describe a dynamic federated autonomic networking system1 for the testing of netcentric systems across organizations. Using a suite of policy-based management software tools, our system can provide netcentric missions with self-configuring, self-debugging, self-healing, and self-protecting capabilities across end-to-end coalition networks. The novelty of our system originates from: (1) A multi-party dynamic policy negotiation algorithm and protocol for autonomous cross-organization negotiations on network resources; (2) A RDF/XML based language to enable automated understanding of network and application configurations across organizations; (3) A teachable, natural language policy capture system; (4) An advanced user interface tool for capturing and representing domain expert knowledge; and (5) A reasoning system for distributing and applying domain knowledge. This system has been developed for large-scale netcentric systems testing applications where the rapid configuration and management of dynamically changing netcentric test exercises is critical. Using a scenario from a real test exercise involving test ranges around the country, we have demonstrated in our testbed that we could reduce the debugging time for a network configuration problem from 6 hours, involving dozens of operators, to less than 2 seconds with minimal human involvement.","PeriodicalId":143330,"journal":{"name":"2010 IEEE International Symposium on Policies for Distributed Systems and Networks","volume":"22 8 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2010-07-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130489788","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Automatic Policy Mapping to Management System Configurations","authors":"Abdelnasser Ouda, H. Lutfiyya, M. Bauer","doi":"10.1109/POLICY.2010.24","DOIUrl":"https://doi.org/10.1109/POLICY.2010.24","url":null,"abstract":"Policies enable management systems to adapt to changes in management strategies. At run time, management agents use information from the policies to monitor attributes of managed objects, to determine if specific events have occurred and to take management actions. In order to do this, information from the policies must first be extracted. The extracted information is then used to configure management agents, as well as other elements of an underlying management system, in order to enforce the given policies. We refer to this as policy mapping. The challenge in automating policy mapping is, given a set of policies, how to extract the relevant information and then identify, configure and instantiate the required management agents within the scope and constraints of an existing management system. This paper presents an approach for automatic policy mapping assuming an underlying commercial management system.","PeriodicalId":143330,"journal":{"name":"2010 IEEE International Symposium on Policies for Distributed Systems and Networks","volume":"18 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2010-07-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"125418796","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
JeeHyun Hwang, Tao Xie, Vincent C. Hu, Mine Altunay
{"title":"ACPT: A Tool for Modeling and Verifying Access Control Policies","authors":"JeeHyun Hwang, Tao Xie, Vincent C. Hu, Mine Altunay","doi":"10.1109/POLICY.2010.22","DOIUrl":"https://doi.org/10.1109/POLICY.2010.22","url":null,"abstract":"Access control mechanisms are a widely adopted technology for information security. Since access decisions (i.e., permit or deny) on requests are dependent on access control policies, ensuring the correct modeling and implementation of access control policies is crucial for adopting access control mechanisms. To address this issue, we develop a tool, called ACPT (Access Control Policy Testing), that helps to model and implement policies correctly during policy modeling, implementation, and verification.","PeriodicalId":143330,"journal":{"name":"2010 IEEE International Symposium on Policies for Distributed Systems and Networks","volume":"39 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2010-07-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133197237","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"JTAM - A Joint Threshold Administration Model","authors":"Ashish Kamra, E. Bertino","doi":"10.1109/POLICY.2010.34","DOIUrl":"https://doi.org/10.1109/POLICY.2010.34","url":null,"abstract":"We propose a Joint Threshold Administration Model (JTAM) for performing certain critical and sensitive database operations such as user/role permission assignment, user/role creation, and so forth. The key idea is that a JTAM enabled operation is incomplete unless it is authorized by at least k - 1 additional DBAs. We present the design details of JTAM based on a cryptographic threshold signature scheme. We implement JTAM in the PostgreSQL DBMS, and demonstrate the execution of the JTAM enabled SQL GRANT command. We also show how to prevent malicious modifications to the JTAM enabled operations.","PeriodicalId":143330,"journal":{"name":"2010 IEEE International Symposium on Policies for Distributed Systems and Networks","volume":"22 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2010-03-30","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114798047","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}