{"title":"Twenty years of evaluation criteria and commercial technology","authors":"S. Lipner","doi":"10.1109/SECPRI.1999.766905","DOIUrl":"https://doi.org/10.1109/SECPRI.1999.766905","url":null,"abstract":"The major source of progress in computer security products during the last twenty years (1980-99) has been the Internet revolution of the mid-nineties. Evaluation criteria and processes have provided users with some characterization of the security attributes of operating system products. The newly developed Common Criteria show promise of offering more timely and relevant evaluation results. However there is little sign of progress in products that can deal with hostile code or in meeting needs for high assurance.","PeriodicalId":204019,"journal":{"name":"Proceedings of the 1999 IEEE Symposium on Security and Privacy (Cat. No.99CB36344)","volume":"76 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1999-05-09","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128614247","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Software smart cards via cryptographic camouflage","authors":"D. N. Hoover, B. N. Kausik","doi":"10.1109/SECPRI.1999.766915","DOIUrl":"https://doi.org/10.1109/SECPRI.1999.766915","url":null,"abstract":"A sensitive point in public key cryptography is how to protect the private key. We outline a method of protecting private keys using cryptographic camouflage. Specifically, we do not encrypt the private key with a password that is too long for exhaustive attack. Instead, we encrypt it so that only one password will decrypt it correctly, but many passwords will decrypt it to produce a key that looks valid enough to fool an attacker. For certain applications, this method protects a private key against dictionary attack, as a smart card does, but entirely in software.","PeriodicalId":204019,"journal":{"name":"Proceedings of the 1999 IEEE Symposium on Security and Privacy (Cat. No.99CB36344)","volume":"2 1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1999-05-09","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128782950","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Twenty years of cryptography in the open literature","authors":"G. Blakley","doi":"10.1109/SECPRI.1999.766903","DOIUrl":"https://doi.org/10.1109/SECPRI.1999.766903","url":null,"abstract":"The paper concentrates on the real world problems created in the last two decades (1973-99) by cryptographers who publish in the open literature, and also mentions what gave rise to these problems-the solutions we gave to various theoretical problems, often of our own posing. For the last twenty years (1980-99), the annual IEEE Symposia on Security and Privacy have provided us with a stimulating and encouraging environment within which to expand cryptography's structure and visibility, while exposing us to criticism from workers in other security-related areas. Cryptography has been an important component of S&P, but seldom a major one. Much work presented is from conferences other than S&P. But S&P's influence has been ubiquitous and formative for the worldwide community of open literature cryptographers. To set the problems stage, the author presents six propositions for consideration, not necessarily for acceptance.","PeriodicalId":204019,"journal":{"name":"Proceedings of the 1999 IEEE Symposium on Security and Privacy (Cat. No.99CB36344)","volume":"64 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1999-05-09","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127089037","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Twenty years of formal methods","authors":"J. McLean","doi":"10.1109/SECPRI.1999.766907","DOIUrl":"https://doi.org/10.1109/SECPRI.1999.766907","url":null,"abstract":"Following Godel, consider a formal mathematical system to be a system of symbols together with rules for employing them (K. Godel, 1965). The rules may be formation rules (stipulating the strings of symbols that constitute well formed formulae), proof rules (stipulating the strings of formulae that constitute proofs), or semantic rules (mapping formulae into an algebraic domain). The rules must be recursive. The requirement that the rules be recursive is an important one since it makes it possible to construct a computer program that can determine whether a rule set has been correctly applied. This, in theory, should give us the ability to use computers to determine whether properties we attribute to specifications or computer programs hold for certain. However, the assurance that can be obtained from formal methods comes at a price. For many applications, formal methods are prohibitively expensive. The formal methods community has traditionally looked to computer security as an application area where the expense of faulty software would make the application of formal methods cost-effective. For its part, the computer security community has traditionally looked to formal methods as a source of assurance that goes beyond what is attainable by testing. Although the marriage of formal methods and computer security has not been completely smooth sailing, it has led to a substantial growth in each partner. The article documents that growth.","PeriodicalId":204019,"journal":{"name":"Proceedings of the 1999 IEEE Symposium on Security and Privacy (Cat. No.99CB36344)","volume":"3 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1999-05-09","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116325941","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Twenty year time capsule panel the future of networking","authors":"H. Orman","doi":"10.1109/SECPRI.1999.766920","DOIUrl":"https://doi.org/10.1109/SECPRI.1999.766920","url":null,"abstract":"The paper considers how one score hence will be an era of communication networks that will affect the lives of most of the people on the planet and will affect those in the developed countries profoundly. Communications technology is tightly bound with the development of society and culture, and the coming changes in network speed and availability will drive changes in the way we perceive the world.","PeriodicalId":204019,"journal":{"name":"Proceedings of the 1999 IEEE Symposium on Security and Privacy (Cat. No.99CB36344)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1999-05-09","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124782731","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Detecting computer and network misuse through the production-based expert system toolset (P-BEST)","authors":"U. Lindqvist, Phillip A. Porras","doi":"10.1109/SECPRI.1999.766911","DOIUrl":"https://doi.org/10.1109/SECPRI.1999.766911","url":null,"abstract":"The paper describes an expert system development toolset called the Production-Based Expert System Toolset (P-BEST) and how it is employed in the development of a modern generic signature analysis engine for computer and network misuse detection. For more than a decade, earlier versions of P-BEST have been used in intrusion detection research and in the development of some of the most well known intrusion detection systems, but this is the first time the principles and language of P-BEST are described to a wide audience. We present rule sets for detecting subversion methods against which there are few defenses-specifically, SYN flooding and buffer overruns-and provide performance measurements. Together, these examples and performance measurements indicate that P-BEST based expert systems are well suited for real time misuse detection in contemporary computing environments. In addition, the simplicity of the P-BEST language and its close integration with the C programming language makes it easy to use while still being very powerful and flexible.","PeriodicalId":204019,"journal":{"name":"Proceedings of the 1999 IEEE Symposium on Security and Privacy (Cat. No.99CB36344)","volume":"7 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1999-05-09","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121247897","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Secure communications processing for distributed languages","authors":"M. Abadi, C. Fournet, Georges Gonthier","doi":"10.1109/SECPRI.1999.766719","DOIUrl":"https://doi.org/10.1109/SECPRI.1999.766719","url":null,"abstract":"Communications processing is an important part of distributed language systems with facilities such as RPC (remote procedure call) and RMI (remote method invocation). For security, messages may require cryptographic operations in addition to ordinary marshaling. We investigate a method for wrapping communications processing around an entity with secure local communication, such as a single machine or a protected network. The wrapping extends security properties of local communication to distributed communication. We formulate and analyze the method within a process calculus.","PeriodicalId":204019,"journal":{"name":"Proceedings of the 1999 IEEE Symposium on Security and Privacy (Cat. No.99CB36344)","volume":"20 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1999-05-09","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126444661","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Software technology of the future","authors":"H. Shrobe","doi":"10.1109/SECPRI.1999.766919","DOIUrl":"https://doi.org/10.1109/SECPRI.1999.766919","url":null,"abstract":"The challenge for the future is to create software systems which interact with their environment. The key feature of such systems will be their ability to adapt their own behaviors to the variety of conditions presented by the harsh environment in which they function. The runtime environment of a self-adaptive system will include descriptions of the purposes and goals of its components, alternative components to achieve similar goals, as well as monitors which check that computations proceed as expected. The paper discusses the dynamic domain architecture framework.","PeriodicalId":204019,"journal":{"name":"Proceedings of the 1999 IEEE Symposium on Security and Privacy (Cat. No.99CB36344)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1999-05-09","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130658541","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"How computers will be used differently in the next twenty years","authors":"M. Weiser","doi":"10.1109/SECPRI.1999.766917","DOIUrl":"https://doi.org/10.1109/SECPRI.1999.766917","url":null,"abstract":"How computers will be used will be determined in part by technology trends, and in part by trends in the needs of people for computation, and by changes in living and activities. These changes are parts of feedback loops: for example, changes in needs cause changes in investments which cause changes in technology which enable changes in lifestyle. Beyond a few years the scene is no more predictable in shape than any other chaotic system. I nonetheless propose some strong attractors based on what seem to be stable regions extrapolated from the present.","PeriodicalId":204019,"journal":{"name":"Proceedings of the 1999 IEEE Symposium on Security and Privacy (Cat. No.99CB36344)","volume":"3 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1999-05-09","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133937757","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"The hardware environment","authors":"R. Needham","doi":"10.1109/SECPRI.1999.766918","DOIUrl":"https://doi.org/10.1109/SECPRI.1999.766918","url":null,"abstract":"The paper considers how security protocols are as they are in part because of the hardware environment in which they are expected to function. Expectations were set nearly twenty years ago, when communications were very unreliable and slow, when reliable sources of time were most unusual, when encryption was extremely slow, when memories and disks were small and slow. In consequence protocol designers went to great lengths to minimise the number of messages sent and their size, particularly the size of the encrypted part. It was considered very undesirable to rely on time other than very locally for ordinal purposes, and systems were expected as far as possible to be stateless.","PeriodicalId":204019,"journal":{"name":"Proceedings of the 1999 IEEE Symposium on Security and Privacy (Cat. No.99CB36344)","volume":"61 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1999-05-09","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131024586","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}