Proceedings of the ... ACM symposium on access control models and technologies. ACM Symposium on Access Control Models and Technologies最新文献_第10页

A framework for verification and optimal reconfiguration of event-driven role based access control policies 用于验证和优化重新配置事件驱动的基于角色的访问控制策略的框架

Proceedings of the ... ACM symposium on access control models and technologies. ACM Symposium on Access Control Models and Technologies Pub Date : 2012-06-20 DOI: 10.1145/2295136.2295172

Basit Shafiq, Jaideep Vaidya, A. Ghafoor, E. Bertino

引用次数: 12

Ensuring authorization privileges for cascading user obligations 确保级联用户义务的授权特权

Proceedings of the ... ACM symposium on access control models and technologies. ACM Symposium on Access Control Models and Technologies Pub Date : 2012-06-20 DOI: 10.1145/2295136.2295144

Omar Chowdhury, M. Pontual, W. Winsborough, Ting Yu, Keith Irwin, Jianwei Niu

{"title":"Ensuring authorization privileges for cascading user obligations","authors":"Omar Chowdhury, M. Pontual, W. Winsborough, Ting Yu, Keith Irwin, Jianwei Niu","doi":"10.1145/2295136.2295144","DOIUrl":"https://doi.org/10.1145/2295136.2295144","url":null,"abstract":"User obligations are actions that the human users are required to perform in some future time. These are common in many practical access control and privacy and can depend on and affect the authorization state. Consequently, a user can incur an obligation that she is not authorized to perform which may hamper the usability of a system. To mitigate this problem, previous work introduced a property of the authorization state, accountability, which requires that all the obligatory actions to be authorized when they are attempted. Although, existing work provides a specific and tractable decision procedure for a variation of the accountability property, it makes a simplified assumption that no cascading obligations may happen, i.e., obligatory actions cannot further incur obligations. This is a strong assumption which reduces the expressive power of past models, and thus cannot support many obligation scenarios in practical security and privacy policies. In this work, we precisely specify the strong accountability property in the presence of cascading obligations and prove that deciding it is NP-hard. We provide for several special yet practical cases of cascading obligations (i.e., repetitive, finite cascading, etc.) a tractable decision procedure for accountability. Our experimental results illustrate that supporting such special cases is feasible in practice.","PeriodicalId":74509,"journal":{"name":"Proceedings of the ... ACM symposium on access control models and technologies. ACM Symposium on Access Control Models and Technologies","volume":"38 1","pages":"33-44"},"PeriodicalIF":0.0,"publicationDate":"2012-06-20","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"81277451","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 3

SCUTA: a server-side access control system for web applications SCUTA:用于web应用程序的服务器端访问控制系统

Proceedings of the ... ACM symposium on access control models and technologies. ACM Symposium on Access Control Models and Technologies Pub Date : 2012-06-20 DOI: 10.1145/2295136.2295152

Xi Tan, Wenliang Du, Tongbo Luo, Karthick Duraisamy Soundararaj

{"title":"SCUTA: a server-side access control system for web applications","authors":"Xi Tan, Wenliang Du, Tongbo Luo, Karthick Duraisamy Soundararaj","doi":"10.1145/2295136.2295152","DOIUrl":"https://doi.org/10.1145/2295136.2295152","url":null,"abstract":"The Web is playing a very important role in our lives, and is becoming an essential element of the computing infrastructure. Unfortunately, its importance makes it the preferred target of attacks. Web-based vulnerabilities now outnumber traditional computer security concerns. A recent study shows that over 80 percent of web sites have had at least one serious vulnerability. We believe that the Web's problems, to a large degree, are caused by the inadequacy of its underlying access control systems. To reduce the number of vulnerabilities, it is essential to provide web applications with better access control models that can adequately address the protection needs of the current Web.\u0000 As a part of the efforts to develop a better access control system for the Web, we focus on the server-side access control in this paper. We introduce a new concept called subsession, based on which, we have developed a ringbased access control system (called Scuta) for web servers. Scuta provides a fine-grained and backward-compatible access control mechanism for web applications. We have implemented Scuta in PHP, and have conducted comprehensive case studies to evaluate its benefits.","PeriodicalId":74509,"journal":{"name":"Proceedings of the ... ACM symposium on access control models and technologies. ACM Symposium on Access Control Models and Technologies","volume":"23 1","pages":"71-82"},"PeriodicalIF":0.0,"publicationDate":"2012-06-20","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"88592418","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 6

Android permissions: a perspective combining risks and benefits Android权限:风险与收益相结合的视角

Proceedings of the ... ACM symposium on access control models and technologies. ACM Symposium on Access Control Models and Technologies Pub Date : 2012-06-20 DOI: 10.1145/2295136.2295141

B. Sarma, Ninghui Li, Christopher S. Gates, Rahul Potharaju, C. Nita-Rotaru, Ian Molloy

{"title":"Android permissions: a perspective combining risks and benefits","authors":"B. Sarma, Ninghui Li, Christopher S. Gates, Rahul Potharaju, C. Nita-Rotaru, Ian Molloy","doi":"10.1145/2295136.2295141","DOIUrl":"https://doi.org/10.1145/2295136.2295141","url":null,"abstract":"The phenomenal growth of the Android platform in the past few years has made it a lucrative target of malicious application (app) developers. There are numerous instances of malware apps that send premium rate SMS messages, track users' private data, or apps that, even if not characterized as malware, conduct questionable actions affecting the user's privacy or costing them money. In this paper, we investigate the feasibility of using both the permissions an app requests, the category of the app, and what permissions are requested by other apps in the same category to better inform users whether the risks of installing an app is commensurate with its expected benefit. Existing approaches consider only the risks of the permissions requested by an app and ignore both the benefits and what permissions are requested by other apps, thus having a limited effect. We propose several risk signals that and evaluate them using two datasets, one consists of 158,062 Android apps from the Android Market, and another consists of 121 malicious apps. We demonstrate the effectiveness of our proposal through extensive data analysis.","PeriodicalId":74509,"journal":{"name":"Proceedings of the ... ACM symposium on access control models and technologies. ACM Symposium on Access Control Models and Technologies","volume":"57 1","pages":"13-22"},"PeriodicalIF":0.0,"publicationDate":"2012-06-20","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"81344362","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 339

Practical risk aggregation in RBAC models RBAC模型中的实际风险聚合

Proceedings of the ... ACM symposium on access control models and technologies. ACM Symposium on Access Control Models and Technologies Pub Date : 2012-06-20 DOI: 10.1145/2295136.2295158

Suresh Chari, Jorge Lobo, Ian Molloy

引用次数: 6

Encryption-enforced access control for an RFID discovery service 用于RFID发现服务的加密强制访问控制

Proceedings of the ... ACM symposium on access control models and technologies. ACM Symposium on Access Control Models and Technologies Pub Date : 2012-06-20 DOI: 10.1145/2295136.2295161

F. Kerschbaum, Leonardo Weiss Ferreira Chaves

引用次数: 5

Visualizing security in business processes 可视化业务流程中的安全性

Proceedings of the ... ACM symposium on access control models and technologies. ACM Symposium on Access Control Models and Technologies Pub Date : 2011-06-15 DOI: 10.1145/1998441.1998465

Ganna Monakova, A. Schaad

引用次数: 4

An authorization scheme for version control systems 版本控制系统的授权方案

Proceedings of the ... ACM symposium on access control models and technologies. ACM Symposium on Access Control Models and Technologies Pub Date : 2011-06-15 DOI: 10.1145/1998441.1998460

Sitaram Chamarty, Hiren D. Patel, Mahesh V. Tripunitara

引用次数: 3

Usable access control for all 所有可用的访问控制

Proceedings of the ... ACM symposium on access control models and technologies. ACM Symposium on Access Control Models and Technologies Pub Date : 2011-06-15 DOI: 10.1145/1998441.1998469

R. Reeder

引用次数: 2

Modeling data flow in socio-information networks: a risk estimation approach 社会信息网络中的数据流建模:一种风险评估方法

Proceedings of the ... ACM symposium on access control models and technologies. ACM Symposium on Access Control Models and Technologies Pub Date : 2011-06-15 DOI: 10.1145/1998441.1998458

Ting Wang, M. Srivatsa, D. Agrawal, Ling Liu

{"title":"Modeling data flow in socio-information networks: a risk estimation approach","authors":"Ting Wang, M. Srivatsa, D. Agrawal, Ling Liu","doi":"10.1145/1998441.1998458","DOIUrl":"https://doi.org/10.1145/1998441.1998458","url":null,"abstract":"Information leakage via the networks formed by subjects (e.g., Facebook, Twitter) and objects (e.g., blogosphere) - some of whom may be controlled by malicious insiders - often leads to unpredicted access control risks. While it may be impossible to precisely quantify information flows between two entities (e.g., two friends in a social network), this paper presents a first attempt towards leveraging recent advances in modeling socio-information networks to develop a statistical risk estimation paradigm for quantifying such insider threats. In the context of socio-information networks, our models estimate the following likelihoods: prior flow - has a subject $s$ acquired covert access to object o via the networks? posterior flow - if s is granted access to o, what is its impact on information flows between subject s' and object o'? network evolution - how will a newly created social relationship between s and s' influence current risk estimates? Our goal is not to prescribe a one-size-fits-all solution; instead we develop a set of composable network-centric risk estimation operators, with implementations configurable to concrete socio-information networks. The efficacy of our solutions is empirically evaluated using real-life datasets collected from the IBM SmallBlue project and Twitter.","PeriodicalId":74509,"journal":{"name":"Proceedings of the ... ACM symposium on access control models and technologies. ACM Symposium on Access Control Models and Technologies","volume":"54 1","pages":"113-122"},"PeriodicalIF":0.0,"publicationDate":"2011-06-15","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"77765749","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 15