Proceeding 2000 IEEE Symposium on Security and Privacy. S&P 2000最新文献

Authentication tests 验证测试

Proceeding 2000 IEEE Symposium on Security and Privacy. S&P 2000 Pub Date : 2000-05-14 DOI: 10.1109/SECPRI.2000.848448

J. Guttman, F. Javier, Thayer Fábrega

{"title":"Authentication tests","authors":"J. Guttman, F. Javier, Thayer Fábrega","doi":"10.1109/SECPRI.2000.848448","DOIUrl":"https://doi.org/10.1109/SECPRI.2000.848448","url":null,"abstract":"Suppose a principal in a cryptographic protocol creates and transmits a message containing a new value v, which it later receives back in cryptographically altered form. It can conclude that some principal possessing the relevant key has transformed the message containing v. In some circumstances, this must be a regular participant of the protocol, not the penetrator. An inference of this kind is an authentication test. We introduce two main kinds of authentication test. An outgoing test is one in which the new value v is transmitted in encrypted form, and only a regular participant can extract it from that form. An incoming test is one in which v is received back in encrypted form, and only a regular participant can put it in that form. We combine these two tests with a supplementary idea, the unsolicited test, and a related method for checking that certain values remain secret. Together they determine what authentication properties are achieved by a wide range of cryptographic protocols. We introduce authentication tests and illustrate their power giving new and straightforward proofs of security goals for several protocols. We also illustrate how to use the authentication tests as a heuristic for finding attacks against incorrect protocols. Finally we suggest a protocol design process. We express these ideas in the strand space formalism and prove them correct elsewhere (Gullman and Thayer Fabrega, 2000).","PeriodicalId":373624,"journal":{"name":"Proceeding 2000 IEEE Symposium on Security and Privacy. S&P 2000","volume":"21 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2000-05-14","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115290398","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 82

Access control meets public key infrastructure, or: assigning roles to strangers 访问控制满足公钥基础设施，或者:为陌生人分配角色

Proceeding 2000 IEEE Symposium on Security and Privacy. S&P 2000 Pub Date : 2000-05-14 DOI: 10.1109/SECPRI.2000.848442

A. Herzberg, Y. Mass, Joris Mihaeli, D. Naor, Yiftach Ravid

{"title":"Access control meets public key infrastructure, or: assigning roles to strangers","authors":"A. Herzberg, Y. Mass, Joris Mihaeli, D. Naor, Yiftach Ravid","doi":"10.1109/SECPRI.2000.848442","DOIUrl":"https://doi.org/10.1109/SECPRI.2000.848442","url":null,"abstract":"The Internet enables connectivity between many strangers: entities that don't know each other. We present the Trust Policy Language (TPL), used to define the mapping of strangers to predefined business roles, based on certificates issued by third parties. TPL is expressive enough to allow complex policies, e.g. non-monotone (negative) certificates, while being simple enough to allow automated policy checking and processing. Issuers of certificates are either known in advance, or provide sufficient certificates to be considered a trusted authority according to the policy. This allows bottom-up, \"grass roots\" buildup of trust, as in the real world. We extend, rather than replace, existing role based access control mechanisms. This provides a simple, modular architecture and easy migration from existing systems. Our system automatically collects missing certificates from peer servers. In particular this allows use of standard browsers, which pass only one certificate to the server. We describe our implementation, which can be used as an extension of a Web server or as a separate server with interface to applications.","PeriodicalId":373624,"journal":{"name":"Proceeding 2000 IEEE Symposium on Security and Privacy. S&P 2000","volume":"54 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2000-05-14","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116725808","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 462

Verifying the EROS confinement mechanism 验证EROS约束机制

Proceeding 2000 IEEE Symposium on Security and Privacy. S&P 2000 Pub Date : 2000-05-14 DOI: 10.1109/SECPRI.2000.848454

J. Shapiro, S. Weber

引用次数: 96

Fang: a firewall analysis engine Fang:防火墙分析引擎

Proceeding 2000 IEEE Symposium on Security and Privacy. S&P 2000 Pub Date : 2000-05-14 DOI: 10.1109/SECPRI.2000.848455

Alain J. Mayer, A. Wool, Elisha Ziskind

{"title":"Fang: a firewall analysis engine","authors":"Alain J. Mayer, A. Wool, Elisha Ziskind","doi":"10.1109/SECPRI.2000.848455","DOIUrl":"https://doi.org/10.1109/SECPRI.2000.848455","url":null,"abstract":"Today, even a moderately sized corporate intranet contains multiple firewalls and routers, which are all used to enforce various aspects of the global corporate security policy. Configuring these devices to work in unison is difficult, especially if they are made by different vendors. Even testing or reverse engineering an existing configuration (say when a new security administrator takes over) is hard. Firewall configuration files are written in low level formalisms, whose readability is comparable to assembly code, and the global policy is spread over all the firewalls that are involved. To alleviate some of these difficulties, we designed and implemented a novel firewall analysis tool. Our software allows the administrator to easily discover and test the global firewall policy (either a deployed policy or a planned one). Our tool uses a minimal description of the network topology and directly parses the various vendor-specific low level configuration files. It interacts with the user through a query-and-answer session, which is conducted at a much higher level of abstruction. A typical question our tool can answer is \"from which machines can our DMZ be reached and with which services?\" Thus, the tool complements existing vulnerability analysis tools, as it can be used before a policy is actually deployed it operates on a more understandable level of abstraction, and it deals with all the firewalls at once.","PeriodicalId":373624,"journal":{"name":"Proceeding 2000 IEEE Symposium on Security and Privacy. S&P 2000","volume":"255-256 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2000-05-14","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115974949","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 324

Searching for a solution: engineering tradeoffs and the evolution of provably secure protocols 寻找解决方案:工程权衡和可证明安全协议的发展

Proceeding 2000 IEEE Symposium on Security and Privacy. S&P 2000 Pub Date : 2000-05-14 DOI: 10.1109/SECPRI.2000.848447

John A. Clark, J. Jacob

引用次数: 127

Using conservation of flow as a security mechanism in network protocols 在网络协议中使用流量守恒作为安全机制

Proceeding 2000 IEEE Symposium on Security and Privacy. S&P 2000 Pub Date : 2000-05-14 DOI: 10.1109/SECPRI.2000.848451

John R. Hughes, T. Aura, M. Bishop

引用次数: 65

Using model checking to analyze network vulnerabilities 利用模型检查分析网络漏洞

Proceeding 2000 IEEE Symposium on Security and Privacy. S&P 2000 Pub Date : 2000-05-14 DOI: 10.1109/SECPRI.2000.848453

Ronald W. Ritchey, P. Ammann

引用次数: 467

Will openish source really improve security? 开源真的会提高安全性吗?

Proceeding 2000 IEEE Symposium on Security and Privacy. S&P 2000 Pub Date : 2000-05-14 DOI: 10.1109/SECPRI.2000.848478

G. McGraw

引用次数: 3

Security and source code access: issues and realities 安全性和源代码访问:问题和现实

Proceeding 2000 IEEE Symposium on Security and Privacy. S&P 2000 Pub Date : 2000-05-14 DOI: 10.1109/SECPRI.2000.848476

S. Lipner

引用次数: 14

A more efficient use of delta-CRLs 更有效地使用增量crl

Proceeding 2000 IEEE Symposium on Security and Privacy. S&P 2000 Pub Date : 2000-05-14 DOI: 10.1109/SECPRI.2000.848456

D. Cooper

引用次数: 89