42838112
Trusted Identity and Session Management Using Secure Cookies
The concept of federated identity management is increasingly coming to use in order to bring Service Providers closer to customers. Users are being provided an enriched experience while carrying out business on the Web at reduced overhead and improved customer service. The idea of maintaining a single profile and gaining access to multiple services has been accepted well by the customers. However, the benefits of breaking through just one set of credentials to gain access to multiple services has made the concept of Federated Identity Management of high interest to malicious users. In this paper, we analyze the structure of a generic Federated Identity Management System and explore the .NET Passport framework in depth. We explore the current security mechanisms adopted by the .NET Passport and identify potential security weaknesses. We then propose our new approaches to enhance the security services in .NET Passport by using Secure Cookies. Our approaches are transparent to and compatible with the current .NET Passport server. Finally, we prove the feasibility by implementing our ideas in a real system.
7753152
Countering Insider Threats in Personal Devices
The information age is a time when organizations are networked back and forth with multiple wires, different communication channels, many sophisticated information systems, and most importantly through the almighty Internet. This project focuses on responses that are most beneficial to organizations in regards to the internal threats. Mainly, it addresses the issues connected to the broad use of laptops, desktops, and other personal devices such as flash drives. During research there were thought different ways of mitigating the issue of insider threats. The result of this analysis is the Diamond Theory. It ties four methods of increasing the security of personal devices: software design, information retrieval, detection technology design and information policy design. All four corners of the diamond are represented by four different techniques that increase the security of personal devices and thus the defense against insider threats. These techniques are described as theoretical premises that shall be fulfilled in order to have the security raised to the maximum. Additionally, these methods are interdependent of each other and must work together to meet the overall goal of the theory.
18041119
Component integrity check and recovery against malicious codes
With the rise in usage of software components in distributed computing applications, the importance of safeguarding these components has assumed great significance. In trying to ensure the survivability of these components, we enable a mission-critical application to detect malicious codes in a component downloaded from a remote location and recover the original functionality of the compromised component. In our work, we use digital signatures to ensure the integrity of software components in a large distributed system. By detecting unauthorized add-ons to the original components we can ensure that only legitimate software components are allowed to execute in a protected software environment. We also explore techniques to recover the original functionality of the component under attack by removing the affected portion from the component. In this paper we introduce the system architecture and the support mechanisms for our proposed approaches
13486405
Static vs. dynamic recovery models for survivable distributed systems
The need for survivability is more pressing for mission-critical systems, especially when they are integrated with other COTS products or services. As information systems became more complex and the interdependence of these systems became higher, the survivability picture became more complicated. In this paper, we introduce two basic models with respect to static and dynamic models, where each model has restart and continue modes. We describe each approach and compare the trade-offs in terms of simplicity, resource efficiency, adaptation, service downtime, immunization, and robustness. Later, we introduce a hybrid model by combining these two basic models. Our approaches are transparent to the client side and can be applied to existing distributed systems by extending the server side with the components necessary for the schemes.
17648841
Role-based access control on the web
Current approaches to access control on the Web servers do not scale to enterprise-wide systems because they are mostly based on individual user identities. Hence we were motivated by the need to manage and enforce the strong and efficient RBAC access control technology in large-scale Web environments. To satisfy this requirement, we identify two different architectures for RBAC on the Web, called user-pull and server-pull. To demonstrate feasibility, we implement each architecture by integrating and extending well-known technologies such as cookies, X.509, SSL, and LDAP, providing compatibility with current web technologies. We describe the technologies we use to implement RBAC on the Web in different architectures. Based on our experience, we also compare the tradeoffs of the different approaches.
17152003
WLAN Security: Current and Future
Wireless LAN deployment improves users' mobility, but it also brings a range of security issues that affect emerging standards and related technologies.
13229931
A Haptic Teleoperation Approach Based on Contact Force Control
This paper presents a new teleoperation approach using a virtual spring, and local contact force control on the slave robot. The operational space framework provides the control structure needed to achieve decoupled task dynamics. A virtual spring connects the master and slave systems and a closed-loop force controller compensates for the dynamics of the slave system, rendering transparent the effector of the slave robotic system. The active force control approach allows the desired motion and contact forces to be combined in a single force command. The required performance and robustness of force control are achieved by a full state reconstruction using a modified Kalman estimator, which addresses disturbances and modeling uncertainties. The performance of both telepresence and force control are further improved by on-line stiffness estimation of the object in contact with the effector. The redundancy of the mobile manipulation system is addressed through a decoupled decomposition of task and posture dynamics.
3768369
Efficient Data Mining for Path Traversal Patterns
The authors explore a new data mining capability that involves mining path traversal patterns in a distributed information-providing environment where documents or objects are linked together to facilitate interactive access. The solution procedure consists of two steps. First, they derive an algorithm to convert the original sequence of log data into a set of maximal forward references. By doing so, one can filter out the effect of some backward references, which are mainly made for ease of traveling and concentrate on mining meaningful user access sequences. Second, they derive algorithms to determine the frequent traversal patterns-i.e., large reference sequences-from the maximal forward references obtained. Two algorithms are devised for determining large reference sequences; one is based on some hashing and pruning techniques, and the other is further improved with the option of determining large reference sequences in batch so as to reduce the number of database scans required. Performance of these two methods is comparatively analyzed. It is shown that the option of selective scan is very advantageous and can lead to prominent performance improvement. Sensitivity analysis on various parameters is conducted.
929830
Parallel searching in generalized Monge arrays with applications
This paper investigates the parallel time and processor complexities of several searching problems involving Monge and Monge-composite arrays. We present array-searching algorithms for concurrent-readconcurrent-write (CRCW) PRAMS, concurrent-readexclusive-write (CREW) PRAMS, hypercubes, cubeconnected-cycles, and shuffle-exchange networks. All these algorithms run in optimal time, and their processor-time products are all within an O(lg n) factor of the worst-case sequential bounds. Several applications of these algorithms are also given. Two applications improve previous results substantially, and the others provide novel parallel algorithms for problems not previously considered.
9807251
Originator Control in Usage Control
Originator Control is an access control policy that requires recipients to gain originator’s approval for redissemination of disseminated digital object. Originator control policies are one of the generic and key concerns of usage control. Usage control is an emerging concept which encompasses traditional access control and digital rights management solutions. However, current commercial Digital Rights Management (DRM) solutions lack enforcement of access control policies such as role-based access control (RBAC), mandatory access control (MAC), discretionary access control (DAC) and originator control because their control of access to digital object is mainly based on payment. In this paper, we attempt to combine originator control policies and usage control. Then we show how this can extend traditional originator control solutions to enforce access control policies even outside of a local control environment where a central control authority is not available. License and ticket concepts are proposed and used for originator control in usage control. Also, we define seven different solution approaches to deal with various dissemination situations. In addition, we discuss some published DRM solutions and relate these to our solution approaches.
5761929
Dual-beam structured-light scanning for 3-D object modeling
In this paper we present our Dual-Beam Structured-Light Scanner (DSLS), a scanning system that generates range maps much richer than those obtained from a conventional structured-light scanning system. Range maps produced by DSLS require fewer registrations for 3-D modeling. We show that the DSLS system more easily satisfies what are often difficult-to-satisfy conditions for determining the 3-D coordinates of an arbitrary object point. Two specific advantages of DSLS over conventional structured-light scanning are: (1) A single scan by the DSLS system is capable of generating range data on more surfaces than possible with the conventional approach using the same number of camera images. And (2) since the data collected by DSLS is more free of self-occlusions, the object needs be examined from a smaller number of viewpoints.