{"title":"A discretionary access control model with temporal authorizations","authors":"E. Bertino, C. Bettini, P. Samarati","doi":"10.1109/NSPW.1994.656246","DOIUrl":"https://doi.org/10.1109/NSPW.1994.656246","url":null,"abstract":"Conventional authorization models enforcing discretionary policies are based on authorizations which specify, for each user or group of users in the system, the accesses he is allowed to execute on objects. We propose a new authorization model which allows to associate with each authorization temporal constraints which restrict the validity of the authorization. Moreover, in our model we allow the specification of temporal dependencies among authorizations. Temporal dependencies allow the derivation of new authorizations on the basis of the presence or of the absence of other authorizations in given time intervals. In the paper we present the main characteristics of our model and illustrate some research issues we are currently investigating.","PeriodicalId":265057,"journal":{"name":"Proceedings New Security Paradigms Workshop","volume":"3 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1994-08-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122378106","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Designing Encryption Algorithms for Real People","authors":"B. Schneier","doi":"10.1109/NSPW.1994.656244","DOIUrl":"https://doi.org/10.1109/NSPW.1994.656244","url":null,"abstract":"There is a wide disparity between cryptographic algorithms as specified by researchers and cryptographic algorithms as implemented in software applications. Programmers are prone to implement poor key management, make mistakes coding the algorithm, and use the algorithm in ways and for periods of time not originally intended. I propose design heuristics for designing algorithms in the “hostile” implementation environment of real-world software development.\u0000In the real world, it is easy to choose a secure encryption algorithm. There are several, all designed by respected cryptographers, all described in the open literature, and all implemented in public-domain software. It is much harder to implement the algorithm properly in a software application.\u0000As a result, implementations of the algorithm are often far less secure in practice than its creators envisioned them. While it is not strictly the job of an algorithm designer to concern himself with implementation details, it is important to realize how algorithms are used in the real world. Armed with this knowledge, a cryptographer can make his algorithms resilient to the kinds of abuses that they will most likely face in the hands of naive programmers.\u0000This paper concerns itself with software implementations of cryptographic algorithms. Traditionally strong encryption was almost exclusively found in special-purpose and embedded hardware. Since these hardware devices were self-contained, it was easier to design them securely and force secure implementations. Today, the increased demand for cheap encryption combined with the increased power of personal computers has made software encryption more ubiquitous. Mistakes are far more common in software cryptographic systems, because programmers have far more control over the details of a software system.\u0000 They have more opportunities to make mistakes in programming, implement bad key management processes, ignore memory management issues, and cut corners to improve performance.","PeriodicalId":265057,"journal":{"name":"Proceedings New Security Paradigms Workshop","volume":"84 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1994-08-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123633047","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"\"HIS-Treck - The Next Generation\": An Introduction to Future Hospital Information Systems","authors":"T. Lincoln","doi":"10.1109/NSPW.1994.656222","DOIUrl":"https://doi.org/10.1109/NSPW.1994.656222","url":null,"abstract":"The ship by health care organizations to integrated care with an outpatient emphasis requires the development ofa new generation of multifaceted electronic medical record systems to coordinate these services. This paper introduces the context ofpresent day health care computing to set the stage for Dr. Essin's paper on our proposed paradigm shifr fiom record processing to document processing, using mark up language technologies. We believe that such document oriented systems can be designed to be both distributed and secure with respect to patient and institutional con9dentiality.","PeriodicalId":265057,"journal":{"name":"Proceedings New Security Paradigms Workshop","volume":"74 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1994-08-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"134084540","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"A new approach to security system development","authors":"S. Castano, G. Martella, P. Samarati","doi":"10.1109/NSPW.1994.656236","DOIUrl":"https://doi.org/10.1109/NSPW.1994.656236","url":null,"abstract":"The development of a security system is generally performed through a multiphase methodology, starting from the initial preliminary analisys of the application environment, up to the physical implementation of the security mechanisms. In this framework, we propose a new approach for the development of security systems based on the reuse of existing security specifications. In the paper we illustrate how reusable specifications can be built by analyzing existing security systems, and how they can be used to develop new security systems not from scratch.","PeriodicalId":265057,"journal":{"name":"Proceedings New Security Paradigms Workshop","volume":"60 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1994-08-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115775774","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Fuzzy Sets and Secure Computer Systems","authors":"S. Ovchinnikov","doi":"10.1109/NSPW.1994.656230","DOIUrl":"https://doi.org/10.1109/NSPW.1994.656230","url":null,"abstract":"Computer are finite discrete machines, the set of real numbers is an infinite continuum. So real numbers in computers are approximation. Rough set theory is the underlying mathematics. A “computer” version of Weistrass theorem states that every sequence, within the radius of error, repeats certain terms infinitely many times. In terms of applications, the theorem guarantees that the audit trail has repeating patterns. Examining further, based on fuzzy-rough set theory, hidden fuzzy relationships (rules) in audit data are uncovered. The information about the repeating data and fuzzy relationships reflect “unconscious patterns” of user's habits. They are some deeper “signatures” of computer users, which provide a foundation to detect abuses and misuses of computer systems. A “sliding window information system” is used to illustrate the detection of a “simple” virus attack. The complexity problem is believed to be controllable via rough set representation of data.","PeriodicalId":265057,"journal":{"name":"Proceedings New Security Paradigms Workshop","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1994-08-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128280840","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Providing Non-hierarchical Security through Interface Mechanisms","authors":"Deborah L. Hamilton","doi":"10.1109/NSPW.1994.656242","DOIUrl":"https://doi.org/10.1109/NSPW.1994.656242","url":null,"abstract":"Common security models provide protection in an hierarchical fashion (i.e. there is a trusted core with outer circles of less secure code and data). There is only one method of providing protection. This model makes it difficult to protect code and data with multiple types of non-hierarchical policies. It implies complete trust in the core requiring thorough evaluation each time modifications are made. This paper first describes a paradigm shift to non-hierarchical security. It then describes an interface mechanism with the potential for providing an efficient, configurable and non-hierarchical security mechanism more suitable for commercial requirements.","PeriodicalId":265057,"journal":{"name":"Proceedings New Security Paradigms Workshop","volume":"313 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1994-08-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122733810","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Messages, Communication, Information Security and Value","authors":"J. Dobson","doi":"10.1109/NSPW.1994.656215","DOIUrl":"https://doi.org/10.1109/NSPW.1994.656215","url":null,"abstract":"This paper addresses the problem of analysing an information system for security flaws or vulnerabilities in a way that is analogous to the analysis of a safety-critical system. In particular, instead of adopting the approach that security is a property that must be proved to hold (fault avoidance), it shows how to analyse a system for possible security failures so that fault prevention, tolerance, recovery or even fault acceptance techniques can be chosen where appropriate.","PeriodicalId":265057,"journal":{"name":"Proceedings New Security Paradigms Workshop","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1994-08-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122679903","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Modeling the \"Multipolicy Machine\"","authors":"David Bell","doi":"10.1109/NSPW.1994.656208","DOIUrl":"https://doi.org/10.1109/NSPW.1994.656208","url":null,"abstract":"A method of treating several unspecified policies is presented. Precise notions of policy combination, policy conflict, conflict resolution, and policy precedence are introduced. Necessary and sufficient conditions for policies to be combined without conflict are established.","PeriodicalId":265057,"journal":{"name":"Proceedings New Security Paradigms Workshop","volume":"41 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1994-08-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122494467","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Anomaly detection","authors":"T., Y., Lin Mathemat","doi":"10.1109/nspw.1994.656226","DOIUrl":"https://doi.org/10.1109/nspw.1994.656226","url":null,"abstract":"Computer are finite discrete machines, the set of real numbers is an infinite continuum. So real numbers in computers are approximation. Rough set theory is the underlying mathematics. A 'computer' version of Weistrass theorem states that every sequence, within the radius of error, repeats certain terms infinitely many times. In terms of applications, the theorem guarantees that the audit trail has repeating patterns. Examining further, based on fuzzy-rough set theory, hidden fuzzy relationships (rules) in audit data are uncovered. The information about the repeating data and fuzzy relationships reflect \"unconscious patterns\" of users' habits. They are some deeper \"signatures\" of computer users, which provide a foundation to detect abuses and misuses of computer systems, A \"sliding window information system\" is used to illustrate the detection of a 'simple' virus attack. The complexity problem is believed to be controllable via rough set representation of data.","PeriodicalId":265057,"journal":{"name":"Proceedings New Security Paradigms Workshop","volume":"18 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1994-08-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133600943","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Healthcare Information Architecture: Elements of a New Paradigm","authors":"D. Essin, T. Lincoln","doi":"10.1109/NSPW.1994.656224","DOIUrl":"https://doi.org/10.1109/NSPW.1994.656224","url":null,"abstract":"An Electronic Medical Record (EMR) must provide a secure, permanent archive for an individual's medical records and also function as a multi-purpose database that supports the complex, varied activities of patient care. Meeting these objectives requires unusual flexibility in how data are retrieved and processed. Semantic and referential integrity must preserved both over time and as chunks of information are exchanged with other systems. Relationships between data entries must determined dynamically based on actual events, rather than statically through application design. Distributed data requires that new forms of system security be incorporated into an EMR at a structural level, with an emphasis on the labeling of elements to be secured behind a security barrier, with audit trails to document necessary overrides and monitor for suspicious use. A modular information architecture is proposed that integrates requirements for structure, content, processing and security.","PeriodicalId":265057,"journal":{"name":"Proceedings New Security Paradigms Workshop","volume":"108 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1994-08-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114978415","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
求助内容：
应助结果提醒方式：
京公网安备 11010802042870号
