{"title":"Secure automated document delivery","authors":"T. Casey, M. Roe, B. Tuck, S. Wilbur","doi":"10.1109/CSAC.1989.81076","DOIUrl":"https://doi.org/10.1109/CSAC.1989.81076","url":null,"abstract":"A model for secure delivery of documents is proposed, and a prototype system based on earlier work on secure electronic mail and automated document delivery systems is described. In the proposed architecture, security protection is provided for both document requests and the actual documents delivered. Electronic mail protocols are used for document requests and delivery, although file transfer protocols could be used in some circumstances. The document delivery system background is discussed, and the client-server model for the secure system is presented. The security philosophy, requirements, policy, and techniques are dealt with next. The criterion for validation is analyzed, the relationship to OSI (Open systems interconnection) is shown, implementation issues are discussed, and the direction of future efforts is pointed out.<<ETX>>","PeriodicalId":284420,"journal":{"name":"[1989 Proceedings] Fifth Annual Computer Security Applications Conference","volume":"59 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1989-12-04","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123835635","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Use of privacy-enhanced mail for software distribution","authors":"W. Barker","doi":"10.1109/CSAC.1989.81075","DOIUrl":"https://doi.org/10.1109/CSAC.1989.81075","url":null,"abstract":"There is currently only limited assurance that software electronically downloaded from a central source is a faithful copy of the original software. Current Internet standards for privacy enhancement of electronic mail can also be employed to protect electronic distribution of software. The standards offer disclosure protection, source (sender) authentication, and message integrity services. However, electronic mail is a relatively inefficient means for distributing software. Proposed modifications to the mail privacy-enhancement standards will permit files to be afforded integrity and source authentication protection in a manner compatible with current file transfer conventions.<<ETX>>","PeriodicalId":284420,"journal":{"name":"[1989 Proceedings] Fifth Annual Computer Security Applications Conference","volume":"36 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1989-12-04","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126734960","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Electronic information security in a digital environment","authors":"Ruth M. Davis","doi":"10.1109/CSAC.1989.81013","DOIUrl":"https://doi.org/10.1109/CSAC.1989.81013","url":null,"abstract":"The protection of sensitive, unclassified industrial information is considered. Context and background are described, and the objectives and objects of security processes are discussed. Common descriptors of data protection and information security applicable to the security of digital information, which the author entitles electronic information security (ELINFOSEC), are suggested. ELINFOSEC is the adequate protection of information processed in an automated system along with the processing system's assets. The automated system operates as a collection of electronic and optical hardware, software, and firmware configured to collect, create, communicate, compute, disseminate, process, store, or control data and information.<<ETX>>","PeriodicalId":284420,"journal":{"name":"[1989 Proceedings] Fifth Annual Computer Security Applications Conference","volume":"29 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1989-12-04","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114350499","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Challenges faced today by computer security practitioners","authors":"L. Reese","doi":"10.1109/CSAC.1989.81044","DOIUrl":"https://doi.org/10.1109/CSAC.1989.81044","url":null,"abstract":"Summary form only given. It is noted that computer security practitioners still experience difficulty in: educating management and users at all levels; securing cooperation from other security professionals and auditors; making proper use of available security technology; accurately assessing the threats, vulnerabilities, and adequacy of safeguards; and persuading management of the importance of this. It is concluded that getting management's approval is the most critical element in computer security, since it is management that must make budget decisions that finance better computer security. Once management has a greater appreciation for computer security, the other factors should fall into place.<<ETX>>","PeriodicalId":284420,"journal":{"name":"[1989 Proceedings] Fifth Annual Computer Security Applications Conference","volume":"23 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1989-12-04","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114724896","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Architectural support of fine-grained secure computing","authors":"J. Bondi, M. Branstad","doi":"10.1109/CSAC.1989.81041","DOIUrl":"https://doi.org/10.1109/CSAC.1989.81041","url":null,"abstract":"An architecture especially adept at security support is outlined. The architecture's fundamental information unit is a two-tuple, or ordered pair, consisting of a datum word and an associated security tag. As an atomic information unit, the two-tuple moves around through the architecture in unison as processing proceeds. a security subprocessor always operates on a security tag in synchrony with a fairly ordinary data subprocessor's operation on the associated datum word. The coupled subprocessors provide the overall architecture with efficient, multilevel-secure access control and flow control. The proposed architecture represents the advancement of security technology along a unique combination of three fronts: (1) direct hardware support, (2) fine-grained-to-the-word mediation, and (3) optimal (minimal) result classification.<<ETX>>","PeriodicalId":284420,"journal":{"name":"[1989 Proceedings] Fifth Annual Computer Security Applications Conference","volume":"86 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1989-12-04","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122678096","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Gemini developers: facts, myths, and war stories","authors":"D. Gambel","doi":"10.1109/CSAC.1989.81038","DOIUrl":"https://doi.org/10.1109/CSAC.1989.81038","url":null,"abstract":"The role of Gemini at the Grumman Corporation is described. Particular attention is given to the development environment, the project architecture from a book perspective, and the project status. Gemini experience with performance, features, and support is discussed, and an evaluation of the hardware/software defect/success rate is presented.<<ETX>>","PeriodicalId":284420,"journal":{"name":"[1989 Proceedings] Fifth Annual Computer Security Applications Conference","volume":"185 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1989-12-04","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"134492584","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Multi-party conflict: the problem and its solutions","authors":"T. Keefe, D. Thomsen, W. Tsai, M. R. Hansch","doi":"10.1109/CSAC.1989.81054","DOIUrl":"https://doi.org/10.1109/CSAC.1989.81054","url":null,"abstract":"Currently there is a great deal of interest concerning polyinstantiation in database management systems (DBMSs). However, polyinstantiation is a specific solution to a problem faced by all secure systems, and the problem itself is not well characterized. The problem stems from the interference between subjects of different security compartments. The authors focus on this problem, which they call multiparty update conflict (MUC). They discuss and evaluate some solutions to the MUC problem, such as polyinstantiation and rigid classification. A framework for a class of MUC solutions based on polyinstantiation is described, and several intermediate solutions between rigid classification and polyinstantiation are enumerated.<<ETX>>","PeriodicalId":284420,"journal":{"name":"[1989 Proceedings] Fifth Annual Computer Security Applications Conference","volume":"56 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1989-12-04","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"134544630","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"An extended cryptographic key generation scheme for multilevel data security","authors":"L. Harn, Yaw-Ruey Chien, T. Kiesler","doi":"10.1109/CSAC.1989.81059","DOIUrl":"https://doi.org/10.1109/CSAC.1989.81059","url":null,"abstract":"S. Akl and P. Taylor (Proc. Crypto-82, p.237-250, 1982) proposed an elegant solution to the multilevel key distribution problem, using a cryptographic approach. In the present work, two problems associated with the Akl-Taylor scheme are considered. First, a time-memory tradeoff technique to overcome the problem of the extremely large memory space required by the Akl-Taylor scheme is proposed. Second, an extended scheme that localizes within a small region as much as possible the inserting/deleting problem associated with the Akl-Taylor scheme is proposed.<<ETX>>","PeriodicalId":284420,"journal":{"name":"[1989 Proceedings] Fifth Annual Computer Security Applications Conference","volume":"23 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1989-12-04","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132533013","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"RADC database security workshop oracle corporation homework problem solution","authors":"B. Maimone","doi":"10.1109/CSAC.1989.81071","DOIUrl":"https://doi.org/10.1109/CSAC.1989.81071","url":null,"abstract":"Oracle Corporation's solution to the second RADC (Rome Air Development Center) Database Security Workshop homework problem (a 22-page specification for a multilevel secure database) was designed and implemented on a prototype delivered to the National Computer Security Center in May 1989, and was submitted for evaluation at the C2 level. The solution utilized discretionary access control (DAC) features available in the prototype and simulated mandatory access control (MAC) features consistent with Oracle's planned B-level secure database product.<<ETX>>","PeriodicalId":284420,"journal":{"name":"[1989 Proceedings] Fifth Annual Computer Security Applications Conference","volume":"93 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1989-12-04","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123761158","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Electronic messaging security: a comparison of three approaches","authors":"R. Housley","doi":"10.1109/CSAC.1989.81021","DOIUrl":"https://doi.org/10.1109/CSAC.1989.81021","url":null,"abstract":"Three approaches to securing electronic mail are described and compared: the 1988 CCITT X.411 Recommendation, RFC 1113, and the Message Security Protocol (MSP). Each approach offers the same basic security services. The MSP approach is found to be the least invasive. Thus, the MSP approach is unable to provide additional security features such as protected reports from MTAs (mail transfer agents) and selective body part protection.<<ETX>>","PeriodicalId":284420,"journal":{"name":"[1989 Proceedings] Fifth Annual Computer Security Applications Conference","volume":"27 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1989-12-04","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128321458","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}