795953
GKMPAN: an efficient group rekeying scheme for secure multicast in ad-hoc networks
We present GKMPAN, an efficient and scalable group rekeying protocol for secure multicast in ad hoc networks. Our protocol exploits the property of ad hoc networks that each member of a group is both a host and a router, and distributes the group key to member nodes via a secure hop-by-hop propagation scheme. A probabilistic scheme based on predeployed symmetric keys is used for implementing secure channels between members for group key distribution. GKMPAN also includes a novel distributed scheme for efficiently updating the predeployed keys. GKMPAN has three attractive properties. First, it is significantly more efficient than group rekeying schemes that were adapted from those proposed for wired networks. Second, GKMPAN has the property of partial statelessness; that is, a node can decode the current group key even if it has missed a certain number of previous group rekeying operations. This makes it very attractive for ad hoc networks where nodes may lose packets due to transmission link errors or temporary network partitions. Third, in GKMPAN the key server does not need any information about the topology of the ad hoc network or the geographic location of the members of the group. We study the security and performance of GKMPAN through detailed analysis and simulation.
21321848
Reasoning with advanced policy rules and its application
to access control
This paper presents a formal framework to represent and manage advanced policy rules, which incorporate the notions of provision and obligation. Provisions are those conditions that need to be satisfied or actions that must be performed by a user or an agent before a decision is rendered, while obligations are those conditions or actions that must be fulfilled by either the user or agent or by the system itself within a certain period of time after the decision. This paper proposes a specific formalism to express provisions and obligations within a policy and investigates a reasoning mechanism within this framework. A policy decision may be supported by more than one rule-based derivation, each associated with a potentially different set of provisions and obligations (called a global PO set). The reasoning mechanism can derive all the global PO sets for each specific policy decision and facilitates the selection of the best one based on numerical weights assigned to provisions and obligations as well as on semantic relationships among them. The formal results presented in the paper hold for many applications requiring the specification of policies, but this paper illustrates the use of the proposed policy framework in the security domain only.
31223197
Modeling Multilevel Entities Using Single Level Objects
An earlier paper by Jajodia and Kogan [5] introduced an approach for building multilevel secure object-oriented database systems based on a secure message filtering mechanism. Under this approach each object has a unique security level and, therefore, multilevel objects are not supported. In the present paper, we discuss an approach, based on composite objects, that allows multilevel entities to be represented in terms of single level objects. The main qualifying aspect of our approach is that the object interfaces can be provided to users as if multilevel objects were directly supported.
17632069
Secure Selective Exclusion in Ad Hoc Wireless Network
A wireless sensor network can be seen as a large number (hundreds of thousand) of small (a few cubic millimetres) devices, battery powered, with very limited hardware resources. Such a network has been studied specifically in the ad hoc model, where the sensors autonomously set up a network infrastructure. We propose here an extension to the current wireless ad hoc sensor network (WSN) model (in particular the base station model), by introducing a Supervisor which has very few interactions with the network, it is mobile in itself, it could have more powerful hardware and it is asynchronous with respect to the sensors. Nevertheless, the Supervisor has to interact with the sensor network, for example to invoke the command to exclude from the network a selected sensor. We believe such a model is particularly suitable for, but not limited to, military applications. We then propose a distributed, cooperative, parallel algorithm for this model that assures the following properties: it enforces both the secure exclusion of a selected compromised sensor from the network and the rekeying of the remaining sensors. It has an overall low overhead both in terms of computation and required transmitted messages. It is scalable, since the algorithm requires only limited, local knowledge of the network topology. Finally, it can be adopted, as an independent layer, to enforce secure exclusion in other models.
28618164
Bootstrapping a data mining intrusion detection system
The application of data mining techniques in intrusion detection has received a lot of attention lately. Most of the approaches require of a training phase based on the availability of labelled data, where the labels indicate whether the points correspond to normal events or attacks. Unfortunately, this labelled data is not readily available in practice. In this paper we present a novel method based in intersecting segments of unlabelled data and using the intersection as the base data for unsupervised learning (clustering). The clustering algorithm, along with a method to find outliers with respect to the base clusters form the basis for separation of unlabelled data into groups of points that are normal (attack-free) and points that correspond to attacks. We show that the technique is very sucessful in separating points of the data sets of the DARPA, Lincoln Labs evaluation of 1999.
31726649
Scalable Group Rekeying for Secure Multicast: A Survey
Many group key management approaches have been recently proposed for providing scalable group rekeying to support secure communications for large and dynamic groups. We give an overview of these approaches and show the research trends. Finally, we discuss some new research directions on this subject.
17317346
Representative instances and γ-acyclic relational schemes
In this paper, we study under what conditions will a pairwise inconsistent relational database ≪R,r≫ have a universal/representative instance L. If R is γ-acyclic and r satisfies all existence constraints, then it is possible to construct a universal instance L, using unmarked nulls, whose total projections onto R yield exactly the relations in r. We show that L would actually be a representative instance under a set of functional dependencies if R satisfies the additional mild condition: for any functional dependency X → A where A is a single attribute, whenever XA is contained in two relation schemes R and R' of R, it follows that R ∩R' is a relation scheme of R, having X as one of its keys.
1118243
Managing replicated files in partitioned distributed database systems
In this paper, we describe a consistency control algorithm for managing replicated files in the face of network partitioning due to node or communication link failures. It adopts a conservative approach in that mutual consistency among copies of a file is maintained by permitting files to be accessed only in a single partition. Our algorithm has the property that it permits dynamic switching between the “dynamic voting” algorithm and the “linearly ordered copies” algorithm. This aspect is not only appealing but results in greater file availability than in all previously published conservative algorithms.
8520486
Local Area Networks: Software and Related Issues
In this paper, we present a review of the issues that affect the software requirements for a local area network. We introduce protocols for the local area networks and characterize their software needs. Two approaches to operating systems are outlined and examples of each approach are presented. Various applications which use local area networks and performance issues are also discussed.
13942242
A Scheme of Parallel Processing for MIMD Systems
This paper presents a recognition procedure for parallel tasks in the user program written in a conventional programming language. To establish our program model, it describes the parallelism of the program in tenns of a process flow graph in which the relationships among processes are of predecessors and successors. And finally it presents a parallel processing scheme which realizes automatically the recognition of parallel tasks and schedules these tasks for parallel execution.
21910023
On Universal and Representative Instances for Inconsistent Databases