2016 IEEE 29th Computer Security Foundations Symposium (CSF)最新文献_第3页

Localizing Firewall Security Policies 本地化防火墙安全策略

2016 IEEE 29th Computer Security Foundations Symposium (CSF) Pub Date : 2016-06-01 DOI: 10.1109/CSF.2016.21

P. Adão, R. Focardi, J. Guttman, F. Luccio

引用次数: 11

Hybrid Monitoring of Attacker Knowledge 攻击者知识的混合监控

2016 IEEE 29th Computer Security Foundations Symposium (CSF) Pub Date : 2016-06-01 DOI: 10.1109/CSF.2016.23

Frédéric Besson, Nataliia Bielova, T. Jensen

引用次数: 11

Compositional Verification and Refinement of Concurrent Value-Dependent Noninterference 并发值相关不干扰的组合验证与改进

2016 IEEE 29th Computer Security Foundations Symposium (CSF) Pub Date : 2016-06-01 DOI: 10.1109/CSF.2016.36

Toby C. Murray, Robert Sison, Edward Pierzchalski, C. Rizkallah

引用次数: 53

On Access Control, Capabilities, Their Equivalence, and Confused Deputy Attacks 访问控制、能力、等价性和混淆代理攻击

2016 IEEE 29th Computer Security Foundations Symposium (CSF) Pub Date : 2016-06-01 DOI: 10.1109/CSF.2016.18

Vineet Rajani, D. Garg, Tamara Rezk

引用次数: 9

On Post-compromise Security 论被入侵后的安全

2016 IEEE 29th Computer Security Foundations Symposium (CSF) Pub Date : 2016-06-01 DOI: 10.1109/CSF.2016.19

Katriel Cohn-Gordon, C. Cremers, L. Garratt

引用次数: 111

Analysis of Key Wrapping APIs: Generic Policies, Computational Security 关键封装api分析:通用策略，计算安全性

2016 IEEE 29th Computer Security Foundations Symposium (CSF) Pub Date : 2016-06-01 DOI: 10.1109/CSF.2016.27

Guillaume Scerri, Ryan Stanley-Oakes

引用次数: 22

Micro-policies for Web Session Security Web会话安全的微策略

2016 IEEE 29th Computer Security Foundations Symposium (CSF) Pub Date : 2016-06-01 DOI: 10.1109/CSF.2016.20

Stefano Calzavara, R. Focardi, Niklas Grimm, Matteo Maffei

{"title":"Micro-policies for Web Session Security","authors":"Stefano Calzavara, R. Focardi, Niklas Grimm, Matteo Maffei","doi":"10.1109/CSF.2016.20","DOIUrl":"https://doi.org/10.1109/CSF.2016.20","url":null,"abstract":"Micro-policies, originally proposed to implement hardware-level security monitors, constitute a flexible and general enforcement technique, based on assigning security tags to system components and taking security actions based on dynamic checks over these tags. In this paper, we present the first application of micro-policies to web security, by proposing a core browser model supporting them and studying its effectiveness at securing web sessions. In our view, web session security requirements are expressed in terms of a simple, declarative information flow policy, which is then automatically translated into a micro-policy enforcing it. This leads to a browser-side enforcement mechanism which is elegant, sound and flexible, while being accessible to web developers. We show how a large class of attacks against web sessions can be uniformly and effectively prevented by the adoption of this approach. We also develop a proof-of-concept implementation of a significant core of our proposal as a Google Chrome extension, Michrome: our experiments show that Michrome can be easily configured to enforce strong security policies without breaking the functionality of websites.","PeriodicalId":6500,"journal":{"name":"2016 IEEE 29th Computer Security Foundations Symposium (CSF)","volume":"25 1","pages":"179-193"},"PeriodicalIF":0.0,"publicationDate":"2016-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"86751324","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 12

A Calculus for Flow-Limited Authorization 流量限制授权的演算

2016 IEEE 29th Computer Security Foundations Symposium (CSF) Pub Date : 2016-06-01 DOI: 10.1109/CSF.2016.17

Owen Arden, A. Myers

{"title":"A Calculus for Flow-Limited Authorization","authors":"Owen Arden, A. Myers","doi":"10.1109/CSF.2016.17","DOIUrl":"https://doi.org/10.1109/CSF.2016.17","url":null,"abstract":"Real-world applications routinely make authorization decisions based on dynamic computation. Reasoning about dynamically computed authority is challenging. Integrity of the system might be compromised if attackers can improperly influence the authorizing computation. Confidentiality can also be compromised by authorization, since authorization decisions are often based on sensitive data such as membership lists and passwords. Previous formal models for authorization do not fully address the security implications of permitting trust relationships to change, which limits their ability to reason about authority that derives from dynamic computation. Our goal is a way to construct dynamic authorization mechanisms that do not violate confidentiality or integrity. We introduce the Flow-Limited Authorization Calculus (FLAC), which is both a simple, expressive model for reasoning about dynamic authorization and also an information flow control language for securely implementing various authorization mechanisms. FLAC combines the insights of two previous models: it extends the Dependency Core Calculus with features made possible by the Flow-Limited Authorization Model. FLAC provides strong end-to-end information security guarantees even for programs that incorporate and implement rich dynamic authorization mechanisms. These guarantees include noninterference and robust declassification, which prevent attackers from influencing information disclosures in unauthorized ways. We prove these security properties formally for all FLAC programs and explore the expressiveness of FLAC with several examples.","PeriodicalId":6500,"journal":{"name":"2016 IEEE 29th Computer Security Foundations Symposium (CSF)","volume":"1 1","pages":"135-149"},"PeriodicalIF":0.0,"publicationDate":"2016-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"85281641","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 21

Relative Perfect Secrecy: Universally Optimal Strategies and Channel Design 相对完全保密:普遍最优策略与渠道设计

2016 IEEE 29th Computer Security Foundations Symposium (CSF) Pub Date : 2016-06-01 DOI: 10.1109/CSF.2016.12

M. Khouzani, P. Malacaria

{"title":"Relative Perfect Secrecy: Universally Optimal Strategies and Channel Design","authors":"M. Khouzani, P. Malacaria","doi":"10.1109/CSF.2016.12","DOIUrl":"https://doi.org/10.1109/CSF.2016.12","url":null,"abstract":"Perfect secrecy describes cases where an adversary cannot learn anything about the secret beyond its prior distribution. A classical result by Shannon shows that a necessary condition for perfect secrecy is that the adversary should not be able to eliminate any of the possible secrets. In this paper we answer the following fundamental question: What is the lowest leakage of information that can be achieved when some of the secrets have to be eliminated? We address this question by deriving the minimum leakage in closed-form, and explicitly providing \"universally optimal\" randomized strategies, in the sense that they guarantee the minimum leakage irrespective of the measure of entropy used to quantify the leakage. We then introduce a generalization of Rényi family of asymmetric measures of leakage which generalizes the g-leakage and show that a slight modification of our strategies are optimal with respect to an important class of such measures. Subsequently, we show that our schemes constitute the Nash Equilibria of closely related two-person zero sum games. This game perspective provides implicit solutions for a wider set of structural constraints and asymmetric entropies. Finally we demonstrate how this work can also be seen as designing a universally optimal channel given a specified prior.","PeriodicalId":6500,"journal":{"name":"2016 IEEE 29th Computer Security Foundations Symposium (CSF)","volume":"23 1","pages":"61-76"},"PeriodicalIF":0.0,"publicationDate":"2016-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"85151668","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 17

Secure Software Licensing: Models, Constructions, and Proofs 安全软件许可:模型、构造和证明

2016 IEEE 29th Computer Security Foundations Symposium (CSF) Pub Date : 2016-06-01 DOI: 10.1109/CSF.2016.10

S. Costea, B. Warinschi

引用次数: 3