NDLI: Architectures for practical security

Please wait, while we are loading the content...

A model of triangulating environments for policy authoring

On the definition of role mining

Access control in practice: pain points

Role-based access control (RBAC) in Java via proxy objects using annotations

A card requirements language enabling privacy-preserving access control

Solving the access-control puzzle: finding the pieces and putting them together

An architecture for enforcing end-to-end access control over web applications

New access models for healthcare

Towards analyzing complex operating system access control configurations

Mining roles with noisy data

Role updating for assignments

Modular context-aware access control for medical sensor networks

Access control policy translation and verification within heterogeneous data federations

Automated management of network access control from design to enforcement

Monitoring security policies with metric first-order temporal logic

StateMiner: an efficient similarity-based approach for optimal mining of role hierarchy

Enforcing spatial constraints for mobile RBAC systems

Privacy-preserving trust verification

Data protection models for service provisioning in the cloud

Architectures for practical security

Role mining based on weights

Capability-based delegation model in RBAC

Personalizing access control by generalizing access control

An access control model for mobile physical objects

Architectures for practical security

Content Provider	ACM Digital Library
Author	Gligor, Virgil
Abstract	Few of the system architectures for security proposed for the past four decades (e.g., fine-grain domains of protection, virtual machines) have made a significant difference on client-side security. In this presentation, I examine some of the reasons for this and some of the lessons learned to date. Focus on client-side security is warranted primarily because it is substantially more difficult to achieve than server security in practice, since clients interact with human users directly. I argue that system and application partitioning to meet user security needs is now feasible, and that special focus must be placed on how to design and implement trustworthy communication, not merely secure channels, between system partitions. Two forms of partitioning system and network components are described. The first, which is inspired by Lampson's Red/Green separation idea [1], partitions system resources instead of "virtualizing" them, and switches between partitions only under (human) user control exercised via a trusted path. Neither operating systems nor applications can escape their partition or transfer control to other partitions behind the user's back [2] as a consequence of malware or insider attacks. Trustworthy communication among system and network partitions, which can be established only via network communication, goes beyond firewalls, guards and filters. The extent to which one partition accepts input from or outputs to another depends on the accountability of, and trust established with, the input provider and output receiver. It also depends on input-rate throttling and output propagation control, which often require establishing some degree of control over remote communication end points. The second form of partitioning separates programmer-selected, security-sensitive code blocks from untrusted operating system code, applications and devices, and provides strong guarantees of data secrecy and integrity, as well as execution integrity, to an external entity via attestation [3]. Again, the key criterion for the separation and isolation of sensitive code partitions from untrusted code is the ability to establish trustworthy communication between security-sensitive and untrusted code; e.g., the security-sensitive code accepts only input whose validity it can verify in its own partition, and provides output only in areas that are legitimately accessible to untrusted code. The design of security-sensitive code partitions relies on source code analysis for modularity, where module input/output control -- not just security-policy isolation and code size minimization -- is a property of interest. Several applications of security-sensitive code isolation are illustrated.
Starting Page	161
Ending Page	162
Page Count	2
File Format	PDF
ISBN	9781450300490
DOI	10.1145/1809842.1809845
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	2010-06-09
Publisher Place	New York
Access Restriction	Subscribed
Subject Keyword	Architectures
Content Type	Text
Resource Type	Article

Central Library (ISO-9001:2015 Certified)
Indian Institute of Technology Kharagpur
Kharagpur, West Bengal, India | PIN - 721302

See location in the Map
03222 282435
Mail: support@ndl.gov.in

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in