15751084
Decentralized user-role assignment for Web-based intranets
The intricacy of security administration is one of the most challenging problems in large networked systems. This problem is especially serious in the Web environment, which consists of synthesis of technologies and composition of various constituents. Role-Based Access Control (RBAC) can reduce the complexity and cost of security administration in large networked applications. Using RBAC itself to manage RBAC provides additional administrative convenience. The main contribution of this paper is to extend the RBAC/Web system (developed at NIST) with the URA97 model for user-role assignment (developed at GMU) to decentralize the details of RBAC administration on the Web without losing central control over the system policy.
17648841
Role-based access control on the web
Current approaches to access control on the Web servers do not scale to enterprise-wide systems because they are mostly based on individual user identities. Hence we were motivated by the need to manage and enforce the strong and efficient RBAC access control technology in large-scale Web environments. To satisfy this requirement, we identify two different architectures for RBAC on the Web, called user-pull and server-pull. To demonstrate feasibility, we implement each architecture by integrating and extending well-known technologies such as cookies, X.509, SSL, and LDAP, providing compatibility with current web technologies. We describe the technologies we use to implement RBAC on the Web in different architectures. Based on our experience, we also compare the tradeoffs of the different approaches.
14631475
RBAC on the Web by Secure Cookies
Current approaches to access control on Web servers do not scale to enterprise-wide systems, since they are mostly based on individual users. Therefore, we were motivated by the need to manage and enforce the strong access control technology of RBAC in large-scale Web environments. Cookies can be used to support RBAC on the Web, holding users’ role information. However, it is insecure to store and transmit sensitive information in cookies. Cookies are stored and transmitted in clear text, which is readable and easily forged. In this paper, we describe an implementation of Role-Based Access Control with role hierarchies on the Web by secure cookies. Since a user’s role information is contained in a set of secure cookies and transmitted to the corresponding Web servers, these servers can trust the role information in the cookies after cookie-verification procedures and use it for role-based access control. In our implementation, we used CGI scripts and PGP (Pretty Good Privacy) to provide security services to secure cookies. The approach is transparent to users and applicable to existing Web servers and browsers.
42838112
Trusted Identity and Session Management Using Secure Cookies
The concept of federated identity management is increasingly coming to use in order to bring Service Providers closer to customers. Users are being provided an enriched experience while carrying out business on the Web at reduced overhead and improved customer service. The idea of maintaining a single profile and gaining access to multiple services has been accepted well by the customers. However, the benefits of breaking through just one set of credentials to gain access to multiple services has made the concept of Federated Identity Management of high interest to malicious users. In this paper, we analyze the structure of a generic Federated Identity Management System and explore the .NET Passport framework in depth. We explore the current security mechanisms adopted by the .NET Passport and identify potential security weaknesses. We then propose our new approaches to enhance the security services in .NET Passport by using Secure Cookies. Our approaches are transparent to and compatible with the current .NET Passport server. Finally, we prove the feasibility by implementing our ideas in a real system.
18041119
Component integrity check and recovery against malicious codes
With the rise in usage of software components in distributed computing applications, the importance of safeguarding these components has assumed great significance. In trying to ensure the survivability of these components, we enable a mission-critical application to detect malicious codes in a component downloaded from a remote location and recover the original functionality of the compromised component. In our work, we use digital signatures to ensure the integrity of software components in a large distributed system. By detecting unauthorized add-ons to the original components we can ensure that only legitimate software components are allowed to execute in a protected software environment. We also explore techniques to recover the original functionality of the component under attack by removing the affected portion from the component. In this paper we introduce the system architecture and the support mechanisms for our proposed approaches
17152003
WLAN Security: Current and Future
Wireless LAN deployment improves users' mobility, but it also brings a range of security issues that affect emerging standards and related technologies.
404376
Power-aware deterministic block allocation for low-power way-selective cache structure
This paper proposes a power-aware cache block allocation algorithm for the way-selective set-associative cache on embedded systems to reduce energy consumption without additional delay or performance degradation. For this goal, way selection logic and specialized replacement policy are designed to enable only one way of set-associative cache as in the direct-mapped cache. Overall cache access time becomes almost the same as that of a conventional set associative cache with accessing additional way selection logic. Because data array can be accessed without waiting for tag comparison, multiplexer delay can be removed totally. The simulation result shows that the proposed architecture can reduce a per access power consumption by 59% over conventional set-associative caches with average 0.06% of negligible performance loss.
17981428
SECK: survivable and efficient clustered keying for wireless sensor networks
A wireless sensor network (WSN) typically consists of a large number of small sensor nodes and one or more high-end control and data aggregation nodes. Sensor nodes have limited computation and communication capabilities, and communicate via wireless links. Consequently, WSNs are highly vulnerable to attacks. This vulnerability is exacerbated when WSNs have to operate unattended in a hostile environment, such as battlefields. In this paper, we propose a novel self-organizing key management scheme for large-scale WSNs, called Sunivable and efficient clustered keying (SECK). Our scheme was designed specifically to address the key management issues within the low-tier of a hierarchical network architecture. Previous approaches for WSN key management adequately addressed operational issues, but to a large extent, ignored robustness and recoverability issues. Using simulation and analysis, we show that SECK is highly robust against key and node captures, and has noteworthy advantages over other key management schemes.
26579916
A Monge Property for the D-dimensional Transportation Problem
Abstract In 1963, Hoffman gave necessary and sufficient conditions under which a family of O( mn )-time greedy algorithms solves the classical two-dimensional transportation problem with m sources and n sinks. One member of this family, an algorithm based on the “northwest corner rule”, is of particular interest, as its running time is easily reduced to O(m + n). When restricted to this algorithm, Hoffman's result can be expressed as follows: the northwest-corner-rule greedy algorithm solves the two-dimensional transportation problem for all source and supply vectors if and only if the problem's cost array C = { c [ i , j ]} possesses what is known as the (two-dimensional) Monge property, which requires c [ i 1 , j 1 ] + c [ i 2 , j 2 ] ⩽ c [ i 1 , j 2 ] + c [ i 2 , j 1 ] for i 1 i 2 and j 1 j 2 . This paper generalizes this last result to a higher dimensional variant of the transportation problem. We show that the natural extension of the northwest-corner-rule greedy algorithm solves an instance of the d -dimensional transportation problem if and only if the problem's cost array possesses a d -dimensional Monge property recently proposed by Aggarwal and Park in the context of their study of monotone arrays. We also give several new examples of cost arrays with this d -dimensional Monge property.
5761929
Dual-beam structured-light scanning for 3-D object modeling
In this paper we present our Dual-Beam Structured-Light Scanner (DSLS), a scanning system that generates range maps much richer than those obtained from a conventional structured-light scanning system. Range maps produced by DSLS require fewer registrations for 3-D modeling. We show that the DSLS system more easily satisfies what are often difficult-to-satisfy conditions for determining the 3-D coordinates of an arbitrary object point. Two specific advantages of DSLS over conventional structured-light scanning are: (1) A single scan by the DSLS system is capable of generating range data on more surfaces than possible with the conventional approach using the same number of camera images. And (2) since the data collected by DSLS is more free of self-occlusions, the object needs be examined from a smaller number of viewpoints.
31766769
Improved selection in totally monotone arrays
This paper's main result is an -time algorithm for computing the kth smallest entry in each row of an m×n totally monotone array. (A two-dimensional array A={a[i, j]} is totally monotone if for all i1<i2 and j1<j2, a[i1, j1]<a[i1, j2] implies a[i2, j1]<a[i2, j2].) For large values of k (in particular, for k=⌈n/2⌉), this algorithm is significantly faster than the O(k(m + n))-time algorithm for the same problem due to Kravets and Park. An immediate consequence of this result is an O(n3/2lg1/2 n)-time algorithm for computing the kth nearest neighbor of each vertex of a convex n-gon. In addition to the main result, we also give an O(n lg m)-time algorithm for computing an approximate median in each row of an m×n totally monotone array; this approximate median is an entry whose rank in its row lies between ⌊n/4⌋ and ⌈3n/4⌉ − 1.