Proceedings of the 24th ACM Symposium on Access Control Models and Technologies最新文献_第2页

History and Future of Automated Vulnerability Analysis 自动化漏洞分析的历史和未来

Proceedings of the 24th ACM Symposium on Access Control Models and Technologies Pub Date : 2019-05-28 DOI: 10.1145/3322431.3326331

Adam Doupé

{"title":"History and Future of Automated Vulnerability Analysis","authors":"Adam Doupé","doi":"10.1145/3322431.3326331","DOIUrl":"https://doi.org/10.1145/3322431.3326331","url":null,"abstract":"The software upon which our modern society operates is riddled with security vulnerabilities. These vulnerabilities allow hackers access to our sensitive data and make our system insecure. To identify vulnerabilities in software, human experts, or vulnerability researchers, are employed. These human experts are quite expensive. And, more fundamentally, human experts cannot analyze every change made to every piece of software (any of which could introduce a security vulnerability). Therefore, automated vulnerability analysis techniques were developed to automatically perform the process of identifying security vulnerabilities in software systems. These tools attempt to democratize the vulnerability analysis process: allowing any developer to identify vulnerabilities in their software automatically, thus finding such vulnerabilities before a malicious hacker. In this keynote, I will discuss the history of automated vulnerability analysis, from both the binary and the web perspective. Binary fuzzing and black-box web application vulnerability analysis have many aspects in common, yet are often thought of separately. From this, I will discuss the future of automated vulnerability analysis, and how we can achieve the effectiveness of a human vulnerability researcher.","PeriodicalId":435953,"journal":{"name":"Proceedings of the 24th ACM Symposium on Access Control Models and Technologies","volume":"88 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-05-28","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122511545","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Session details: Junior Keynote 会议细节:初级主题演讲

Proceedings of the 24th ACM Symposium on Access Control Models and Technologies Pub Date : 2019-05-28 DOI: 10.1145/3338674

Adam J. Lee

引用次数: 0

Using Provenance for Secure Data Fusion in Cooperative Systems 基于溯源的协同系统安全数据融合

Proceedings of the 24th ACM Symposium on Access Control Models and Technologies Pub Date : 2019-05-28 DOI: 10.1145/3322431.3325100

Clara Bertolissi, J. D. Hartog, Nicola Zannone

引用次数: 6

Poster 海报

Proceedings of the 24th ACM Symposium on Access Control Models and Technologies Pub Date : 2019-05-28 DOI: 10.1145/3322431.3326448

Feras M. Awaysheh, J. C. Cabaleiro, T. F. Pena, M. Alazab

引用次数: 7

A Rule-based Approach to the Decidability of Safety of ABACα 基于规则的ABACα安全可判决性研究

Proceedings of the 24th ACM Symposium on Access Control Models and Technologies Pub Date : 2019-05-28 DOI: 10.1145/3322431.3325416

M. Marin, Temur Kutsia, B. Dundua

{"title":"A Rule-based Approach to the Decidability of Safety of ABACα","authors":"M. Marin, Temur Kutsia, B. Dundua","doi":"10.1145/3322431.3325416","DOIUrl":"https://doi.org/10.1145/3322431.3325416","url":null,"abstract":"ABACα is a foundational model for attribute-based access control with a minimal set of capabilities to configure many access control models of interest, including the dominant traditional ones: discretionary (DAC), mandatory (MAC), and role-based (RBAC). A fundamental security problem in the design of ABAC is to ensure safety, that is, to guarantee that a certain subject can never gain certain permissions to access certain object(s). We propose a rule-based specification of ABACα and of its configurations, and the semantic framework of ρLog to turn this specification into executable code for the operational model of ABACα. Next, we identify some important properties of the operational model which allow us to define a rule-based algorithm for the safety problem, and to execute it with ρLog. The outcome is a practical tool to check safety of ABACα configurations. ρLog is a system for rule-based programming with strategies and built-in support for constraint logic programming (CLP). We argue that ρLog is an adequate framework for the specification and verification of safety of ABACα configurations. In particular, the authorization policies of ABACα can be interpreted properly by the CLP component of ρLog, and the operations of its functional specification can be described by five strategies defined by conditional rewrite rules.","PeriodicalId":435953,"journal":{"name":"Proceedings of the 24th ACM Symposium on Access Control Models and Technologies","volume":"114 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-05-28","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124774768","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 11

Effectively Enforcing Authorization Constraints for Emerging Space-Sensitive Technologies 有效实施新兴空间敏感技术的授权约束

Proceedings of the 24th ACM Symposium on Access Control Models and Technologies Pub Date : 2019-05-28 DOI: 10.1145/3322431.3325109

Carlos E. Rubio-Medrano, Shaishavkumar Jogani, Maria Leitner, Ziming Zhao, Gail-Joon Ahn

{"title":"Effectively Enforcing Authorization Constraints for Emerging Space-Sensitive Technologies","authors":"Carlos E. Rubio-Medrano, Shaishavkumar Jogani, Maria Leitner, Ziming Zhao, Gail-Joon Ahn","doi":"10.1145/3322431.3325109","DOIUrl":"https://doi.org/10.1145/3322431.3325109","url":null,"abstract":"Recently, applications that deliver customized content to end-users, e.g., digital objects on top of a video stream, depending on information such as their current physical location, usage patterns, personal data, etc., have become extremely popular. Despite their promising future, some concerns still exist with respect to the proper use of such space-sensitive applications (S-Apps) inside independently-run physical spaces, e.g., schools, museums, hospitals, memorials, etc. Based on the idea that innovative technologies should be paired with novel (and effective) security measures, this paper proposes space-sensitive access control (SSAC), an approach for restricting space-sensitive functionality in such independently-run physical spaces, allowing for the specification, evaluation and enforcement of rich and flexible authorization policies, which, besides meeting the specific needs for S-Apps, are also intended to avoid the need for interruptions in their normal use as well as repetitive policy updates, thus providing a convenient solution for both policy makers and end-users. We present a theoretical model, a proof-of-concept S-App, and a supporting API framework, which facilitate the policy crafting, storage, retrieval and evaluation processes, as well as the enforcement of authorization decisions. In addition, we present a performance case study depicting our proof-of-concept S-App in a set of realistic scenarios, as well as a user study which resulted in 90% of participants being able to understand and write authorization policies using our approach, and 93% of them also recognizing the need for restricting functionality in the context of emerging space-sensitive technologies, thus providing evidence that encourages the adoption of SSAC in practice.","PeriodicalId":435953,"journal":{"name":"Proceedings of the 24th ACM Symposium on Access Control Models and Technologies","volume":"298 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-05-28","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123274869","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 6

Verifying OAuth Implementations Through Encrypted Network Analysis 通过加密网络分析验证OAuth实现

Proceedings of the 24th ACM Symposium on Access Control Models and Technologies Pub Date : 2019-05-28 DOI: 10.1145/3322431.3326449

Josh Talkington, R. Dantu, Kirill Morozov

引用次数: 2

Access Control for Binary Integrity Protection using Ethereum 基于以太坊的二进制完整性保护访问控制

Proceedings of the 24th ACM Symposium on Access Control Models and Technologies Pub Date : 2019-05-28 DOI: 10.1145/3322431.3325108

O. Stengele, Andrea Baumeister, Pascal Birnstill, H. Hartenstein

{"title":"Access Control for Binary Integrity Protection using Ethereum","authors":"O. Stengele, Andrea Baumeister, Pascal Birnstill, H. Hartenstein","doi":"10.1145/3322431.3325108","DOIUrl":"https://doi.org/10.1145/3322431.3325108","url":null,"abstract":"The integrity of executable binaries is essential to the security of any device that runs them. At best, a manipulated binary can leave the system in question open to attack, and at worst, it can compromise the entire system by itself. In recent years, supply-chain attacks have demonstrated that binaries can even be compromised unbeknownst to their creators. This, in turn, leads to the dissemination of supposedly valid binaries that need to be revoked later. In this paper, we present and evaluate a concept for publishing and revoking integrity protecting information for binaries, based on the Ethereum Blockchain and its underlying peer-to-peer network. Smart Contracts are used to enforce access control over the publication and revocation of integrity preserving information, whereas the peer-to-peer network serves as a fast, global communication service to keep user clients informed. The Ethereum Blockchain serves as a tamper-evident, publicly-verifiable log of published and revoked binaries. Our implementation incurs costs comparable to registration fees for centralised software distribution platforms but allows publication and revocation of individual binaries within minutes. The proposed concept can be integrated incrementally into existing software distribution platforms, such as package repositories or various app stores.","PeriodicalId":435953,"journal":{"name":"Proceedings of the 24th ACM Symposium on Access Control Models and Technologies","volume":"29 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-05-28","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123681691","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 10

CMCAP CMCAP

Proceedings of the 24th ACM Symposium on Access Control Models and Technologies Pub Date : 2019-05-28 DOI: 10.1145/3322431.3325414

Theogene Hakiza Bucuti, R. Dantu, Kirill Morozov

引用次数: 0

Toward Detection of Access Control Models from Source Code via Word Embedding 基于词嵌入的源代码访问控制模型检测

Proceedings of the 24th ACM Symposium on Access Control Models and Technologies Pub Date : 2019-05-28 DOI: 10.1145/3322431.3326329

John Heaps, Xiaoyin Wang, T. Breaux, Jianwei Niu

引用次数: 2