ACM Transactions on Information and System Security最新文献_第8页

Authorization recycling in hierarchical RBAC systems 分级RBAC系统中的授权回收

ACM Transactions on Information and System Security Pub Date : 2011-05-01 DOI: 10.1145/1952982.1952985

Qiang Wei, J. Crampton, K. Beznosov, M. Ripeanu

引用次数: 21

Nexus authorization logic (NAL): Design rationale and applications Nexus授权逻辑(NAL):设计原理和应用程序

ACM Transactions on Information and System Security Pub Date : 2011-05-01 DOI: 10.1145/1952982.1952990

F. Schneider, Kevin Walsh, E. G. Sirer

引用次数: 80

Practical defenses against pollution attacks in wireless network coding 无线网络编码中对污染攻击的实用防御

ACM Transactions on Information and System Security Pub Date : 2011-05-01 DOI: 10.1145/1952982.1952989

Jing Dong, Reza Curtmola, C. Nita-Rotaru

{"title":"Practical defenses against pollution attacks in wireless network coding","authors":"Jing Dong, Reza Curtmola, C. Nita-Rotaru","doi":"10.1145/1952982.1952989","DOIUrl":"https://doi.org/10.1145/1952982.1952989","url":null,"abstract":"Recent studies have shown that network coding can provide significant benefits to network protocols, such as increased throughput, reduced network congestion, higher reliability, and lower power consumption. The core principle of network coding is that intermediate nodes actively mix input packets to produce output packets. This mixing subjects network coding systems to a severe security threat, known as a pollution attack, where attacker nodes inject corrupted packets into the network. Corrupted packets propagate in an epidemic manner, depleting network resources and significantly decreasing throughput. Pollution attacks are particularly dangerous in wireless networks, where attackers can easily inject packets or compromise devices due to the increased network vulnerability.\u0000 In this article, we address pollution attacks against network coding systems in wireless mesh networks. We demonstrate that previous solutions are impractical in wireless networks, incurring an unacceptable high degradation of throughput. We propose a lightweight scheme, DART, that uses time-based authentication in combination with random linear transformations to defend against pollution attacks. We further improve system performance and propose EDART, which enhances DART with an optimistic forwarding scheme. We also propose efficient attacker identification schemes for both DART and EDART that enable quick attacker isolation and the selection of attacker-free paths, achieving additional performance improvement. A detailed security analysis shows that the probability of a polluted packet passing our verification procedure is very low (less than 0.002% in typical settings). Performance results using the well-known MORE protocol and realistic link quality measurements from the Roofnet experimental testbed show that our schemes improve system performance over 20 times compared with previous solutions.","PeriodicalId":50912,"journal":{"name":"ACM Transactions on Information and System Security","volume":"233 1","pages":"7:1-7:31"},"PeriodicalIF":0.0,"publicationDate":"2011-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"74688949","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 42

Access control via belnap logic: Intuitive, expressive, and analyzable policy composition 通过belnap逻辑进行访问控制:直观、富有表现力和可分析的策略组合

ACM Transactions on Information and System Security Pub Date : 2011-05-01 DOI: 10.1145/1952982.1952991

G. Bruns, M. Huth

{"title":"Access control via belnap logic: Intuitive, expressive, and analyzable policy composition","authors":"G. Bruns, M. Huth","doi":"10.1145/1952982.1952991","DOIUrl":"https://doi.org/10.1145/1952982.1952991","url":null,"abstract":"Access control to IT systems increasingly relies on the ability to compose policies. Hence there is benefit in any framework for policy composition that is intuitive, formal (and so “analyzable” and “implementable”), expressive, independent of specific application domains, and yet able to be extended to create domain-specific instances. Here we develop such a framework based on Belnap logic. An access-control policy is interpreted as a four-valued predicate that maps access requests to either grant, deny, conflict, or unspecified -- the four values of the Belnap bilattice. We define an expressive access-control policy language PBel, having composition operators based on the operators of Belnap logic. Natural orderings on policies are obtained by lifting the truth and information orderings of the Belnap bilattice. These orderings lead to a query language in which policy analyses, for example, conflict freedom, can be specified. Policy analysis is supported through a reduction of the validity of policy queries to the validity of propositional formulas on predicates over access requests. We evaluate our approach through firewall policy and RBAC policy examples, and discuss domain-specific and generic extensions of our policy language.","PeriodicalId":50912,"journal":{"name":"ACM Transactions on Information and System Security","volume":"31 1","pages":"9:1-9:27"},"PeriodicalIF":0.0,"publicationDate":"2011-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"87030394","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 53

Attribute-Based Messaging: Access Control and Confidentiality 基于属性的消息传递:访问控制和机密性

ACM Transactions on Information and System Security Pub Date : 2010-12-01 DOI: 10.1145/1880022.1880025

R. Bobba, Omid Fatemieh, Fariba Khan, A. Khan, Carl A. Gunter, H. Khurana, M. Prabhakaran

引用次数: 36

Uncovering Spoken Phrases in Encrypted Voice over IP Conversations 在IP加密语音对话中发现口语短语

ACM Transactions on Information and System Security Pub Date : 2010-12-01 DOI: 10.1145/1880022.1880029

C. V. Wright, L. Ballard, Scott E. Coull, F. Monrose, G. Masson

{"title":"Uncovering Spoken Phrases in Encrypted Voice over IP Conversations","authors":"C. V. Wright, L. Ballard, Scott E. Coull, F. Monrose, G. Masson","doi":"10.1145/1880022.1880029","DOIUrl":"https://doi.org/10.1145/1880022.1880029","url":null,"abstract":"Although Voice over IP (VoIP) is rapidly being adopted, its security implications are not yet fully understood. Since VoIP calls may traverse untrusted networks, packets should be encrypted to ensure confidentiality. However, we show that it is possible to identify the phrases spoken within encrypted VoIP calls when the audio is encoded using variable bit rate codecs. To do so, we train a hidden Markov model using only knowledge of the phonetic pronunciations of words, such as those provided by a dictionary, and search packet sequences for instances of specified phrases. Our approach does not require examples of the speaker’s voice, or even example recordings of the words that make up the target phrase. We evaluate our techniques on a standard speech recognition corpus containing over 2,000 phonetically rich phrases spoken by 630 distinct speakers from across the continental United States. Our results indicate that we can identify phrases within encrypted calls with an average accuracy of 50%, and with accuracy greater than 90% for some phrases. Clearly, such an attack calls into question the efficacy of current VoIP encryption standards. In addition, we examine the impact of various features of the underlying audio on our performance and discuss methods for mitigation.","PeriodicalId":50912,"journal":{"name":"ACM Transactions on Information and System Security","volume":"34 1","pages":"35:1-35:30"},"PeriodicalIF":0.0,"publicationDate":"2010-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"84758990","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 53

Mining Roles with Multiple Objectives 挖掘具有多个目标的角色

ACM Transactions on Information and System Security Pub Date : 2010-12-01 DOI: 10.1145/1880022.1880030

Ian Molloy, Hong Chen, Tiancheng Li, Qihua Wang, Ninghui Li, E. Bertino, S. Calo, Jorge Lobo

{"title":"Mining Roles with Multiple Objectives","authors":"Ian Molloy, Hong Chen, Tiancheng Li, Qihua Wang, Ninghui Li, E. Bertino, S. Calo, Jorge Lobo","doi":"10.1145/1880022.1880030","DOIUrl":"https://doi.org/10.1145/1880022.1880030","url":null,"abstract":"With the growing adoption of Role-Based Access Control (RBAC) in commercial security and identity management products, how to facilitate the process of migrating a non-RBAC system to an RBAC system has become a problem with significant business impact. Researchers have proposed to use data mining techniques to discover roles to complement the costly top-down approaches for RBAC system construction. An important problem is how to construct RBAC systems with low complexity. In this article, we define the notion of weighted structural complexity measure and propose a role mining algorithm that mines RBAC systems with low structural complexity. Another key problem that has not been adequately addressed by existing role mining approaches is how to discover roles with semantic meanings. In this article, we study the problem in two primary settings with different information availability. When the only information is user-permission relation, we propose to discover roles whose semantic meaning is based on formal concept lattices. We argue that the theory of formal concept analysis provides a solid theoretical foundation for mining roles from a user-permission relation. When user-attribute information is also available, we propose to create roles that can be explained by expressions of user-attributes. Since an expression of attributes describes a real-world concept, the corresponding role represents a real-world concept as well. Furthermore, the algorithms we propose balance the semantic guarantee of roles with system complexity. Finally, we indicate how to create a hybrid approach combining top-down candidate roles. Our experimental results demonstrate the effectiveness of our approaches.","PeriodicalId":50912,"journal":{"name":"ACM Transactions on Information and System Security","volume":"182 1","pages":"36:1-36:35"},"PeriodicalIF":0.0,"publicationDate":"2010-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"80354639","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 98

Storage-Based Intrusion Detection 基于存储的入侵检测

ACM Transactions on Information and System Security Pub Date : 2010-12-01 DOI: 10.1145/1880022.1880024

Adam G. Pennington, J. Griffin, John S. Bucy, J. Strunk, G. Ganger

引用次数: 23

Satisfiability and Resiliency in Workflow Authorization Systems 工作流授权系统中的可满足性和弹性

ACM Transactions on Information and System Security Pub Date : 2010-12-01 DOI: 10.1145/1880022.1880034

Qihua Wang, Ninghui Li

{"title":"Satisfiability and Resiliency in Workflow Authorization Systems","authors":"Qihua Wang, Ninghui Li","doi":"10.1145/1880022.1880034","DOIUrl":"https://doi.org/10.1145/1880022.1880034","url":null,"abstract":"We propose the role-and-relation-based access control (R2BAC) model for workflow authorization systems. In R2BAC, in addition to a user’s role memberships, the user’s relationships with other users help determine whether the user is allowed to perform a certain step in a workflow. For example, a constraint may require that two steps must not be performed by users who have conflicts of interests. We study computational complexity of the workflow satisfiability problem, which asks whether a set of users can complete a workflow. In particular, we apply tools from parameterized complexity theory to better understand the complexities of this problem. Furthermore, we reduce the workflow satisfiability problem to SAT and apply SAT solvers to address the problem. Experiments show that our algorithm can solve instances of reasonable size efficiently. Finally, it is sometimes not enough to ensure that a workflow can be completed in normal situations. We study the resiliency problem in workflow authorization systems, which asks whether a workflow can be completed even if a number of users may be absent. We formally define three levels of resiliency in workflow systems and study computational problems related to these notions of resiliency.","PeriodicalId":50912,"journal":{"name":"ACM Transactions on Information and System Security","volume":"138 1","pages":"40:1-40:35"},"PeriodicalIF":0.0,"publicationDate":"2010-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"86497285","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 114

Robust Decentralized Virtual Coordinate Systems in Adversarial Environments 对抗环境下鲁棒分散虚拟坐标系统

ACM Transactions on Information and System Security Pub Date : 2010-12-01 DOI: 10.1145/1880022.1880032

David Zage, C. Nita-Rotaru

{"title":"Robust Decentralized Virtual Coordinate Systems in Adversarial Environments","authors":"David Zage, C. Nita-Rotaru","doi":"10.1145/1880022.1880032","DOIUrl":"https://doi.org/10.1145/1880022.1880032","url":null,"abstract":"Virtual coordinate systems provide an accurate and efficient service that allows hosts on the Internet to determine the latency to arbitrary hosts without actively monitoring all of the nodes in the network. Many of the proposed systems were designed with the assumption that all of the nodes are altruistic. However, this assumption may be violated by compromised nodes acting maliciously to degrade the accuracy of the coordinate system. As numerous peer-to-peer applications come to rely on virtual coordinate systems to achieve good performance, it is critical to address the security of such systems.\u0000 In this work, we demonstrate the vulnerability of decentralized virtual coordinate systems to insider (or Byzantine) attacks. We propose techniques to make the coordinate assignment robust to malicious attackers without increasing the communication cost. We use both spatial and temporal correlations to perform context-sensitive outlier analysis to reject malicious updates and prevent unnecessary and erroneous adaptations. We demonstrate the attacks and mitigation techniques in the context of a well-known virtual coordinate system using simulations based on three representative, real-life Internet topologies of hosts and corresponding Round Trip Times (RTT). We show the effects of the attacks and the utility of the mitigation techniques on the virtual coordinate system as seen by higher-level applications, elucidating the utility of deploying robust virtual coordinate systems as network services.","PeriodicalId":50912,"journal":{"name":"ACM Transactions on Information and System Security","volume":"2103 1","pages":"38:1-38:34"},"PeriodicalIF":0.0,"publicationDate":"2010-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"91350305","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 5