14631475
RBAC on the Web by Secure Cookies
Current approaches to access control on Web servers do not scale to enterprise-wide systems, since they are mostly based on individual users. Therefore, we were motivated by the need to manage and enforce the strong access control technology of RBAC in large-scale Web environments. Cookies can be used to support RBAC on the Web, holding users’ role information. However, it is insecure to store and transmit sensitive information in cookies. Cookies are stored and transmitted in clear text, which is readable and easily forged. In this paper, we describe an implementation of Role-Based Access Control with role hierarchies on the Web by secure cookies. Since a user’s role information is contained in a set of secure cookies and transmitted to the corresponding Web servers, these servers can trust the role information in the cookies after cookie-verification procedures and use it for role-based access control. In our implementation, we used CGI scripts and PGP (Pretty Good Privacy) to provide security services to secure cookies. The approach is transparent to users and applicable to existing Web servers and browsers.
7753152
Countering Insider Threats in Personal Devices
The information age is a time when organizations are networked back and forth with multiple wires, different communication channels, many sophisticated information systems, and most importantly through the almighty Internet. This project focuses on responses that are most beneficial to organizations in regards to the internal threats. Mainly, it addresses the issues connected to the broad use of laptops, desktops, and other personal devices such as flash drives. During research there were thought different ways of mitigating the issue of insider threats. The result of this analysis is the Diamond Theory. It ties four methods of increasing the security of personal devices: software design, information retrieval, detection technology design and information policy design. All four corners of the diamond are represented by four different techniques that increase the security of personal devices and thus the defense against insider threats. These techniques are described as theoretical premises that shall be fulfilled in order to have the security raised to the maximum. Additionally, these methods are interdependent of each other and must work together to meet the overall goal of the theory.
18041119
Component integrity check and recovery against malicious codes
With the rise in usage of software components in distributed computing applications, the importance of safeguarding these components has assumed great significance. In trying to ensure the survivability of these components, we enable a mission-critical application to detect malicious codes in a component downloaded from a remote location and recover the original functionality of the compromised component. In our work, we use digital signatures to ensure the integrity of software components in a large distributed system. By detecting unauthorized add-ons to the original components we can ensure that only legitimate software components are allowed to execute in a protected software environment. We also explore techniques to recover the original functionality of the component under attack by removing the affected portion from the component. In this paper we introduce the system architecture and the support mechanisms for our proposed approaches
17648841
Role-based access control on the web
Current approaches to access control on the Web servers do not scale to enterprise-wide systems because they are mostly based on individual user identities. Hence we were motivated by the need to manage and enforce the strong and efficient RBAC access control technology in large-scale Web environments. To satisfy this requirement, we identify two different architectures for RBAC on the Web, called user-pull and server-pull. To demonstrate feasibility, we implement each architecture by integrating and extending well-known technologies such as cookies, X.509, SSL, and LDAP, providing compatibility with current web technologies. We describe the technologies we use to implement RBAC on the Web in different architectures. Based on our experience, we also compare the tradeoffs of the different approaches.
17152003
WLAN Security: Current and Future
Wireless LAN deployment improves users' mobility, but it also brings a range of security issues that affect emerging standards and related technologies.
42838112
Trusted Identity and Session Management Using Secure Cookies
The concept of federated identity management is increasingly coming to use in order to bring Service Providers closer to customers. Users are being provided an enriched experience while carrying out business on the Web at reduced overhead and improved customer service. The idea of maintaining a single profile and gaining access to multiple services has been accepted well by the customers. However, the benefits of breaking through just one set of credentials to gain access to multiple services has made the concept of Federated Identity Management of high interest to malicious users. In this paper, we analyze the structure of a generic Federated Identity Management System and explore the .NET Passport framework in depth. We explore the current security mechanisms adopted by the .NET Passport and identify potential security weaknesses. We then propose our new approaches to enhance the security services in .NET Passport by using Secure Cookies. Our approaches are transparent to and compatible with the current .NET Passport server. Finally, we prove the feasibility by implementing our ideas in a real system.
33018547
Object Boundary Edge Selection for Accurate Contour Tracking Using Multi-level Canny Edges
We propose a method of selecting only tracked subject boundary edges in a video stream with changing background and a moving camera. Our boundary edge selection is done in two steps; first, remove background edges using an edge motion, second, from the output of the previous step, select boundary edges using a normal direction derivative of the tracked contour. In order to remove background edges, we compute edge motions and object motions. The edges with different motion direction than the subject motion are removed. In selecting boundary edges using the contour normal direction, we compute image gradient values on every edge pixels, and select edge pixels with large gradient values. We use multi-level Canny edge maps to get proper details of a scene. Detailed-level edge maps give us more scene information even though the tracked object boundary is not clear, because we can adjust the detail level of edge maps for a scene. We use Watersnake model to decide a new tracked contour. Our experimental results show that our approach is superior to Nguyen’s.
16063217
Dynamic Bit-width Adaptation in DCT: Image Quality versus Computation Energy Trade-off
We present a dynamic bit-width adaptation scheme in DCT applications for efficient trade-off between image quality and computation energy. Based on sensitivity differences of 64 DCT coefficients, various operand bit-widths are used for different frequency components to reduce computation energy in DCT operation. Numerical results show that our DCT architecture can achieve power savings ranging from 36 % to 75% compared to normal operation
8508201
Cryptanalysis of Some Group-Oriented Proxy Signature Schemes
A proxy signature scheme allows an entity to delegate its signing power to another entity. Since the notion of proxy signatures was first introduced, many proxy signature schemes and various extensions have been considered. As an example, the notion of threshold proxy signature or proxy multi-signature was introduced as a group-oriented variant. In this paper, we show that the threshold proxy signature scheme proposed by Hsu and Wu, and the proxy multi-signature schemes independently proposed by Chen et al. and Hsu et al. are all insecure against the malicious original singer(s). Our result provides a simple example that the way to put the secret parts together should be carefully considered.
14990532
Weaving Aspects into Real-Time Operating System Design Using Object-Oriented Model Transformation
Despite of the proliferation of object-oriented and component technology, their application to real-time operating systems (RTOS) has been limited since most design concerns in RTOSes crosscut software components and these are critical to deliver required performance and functionality. Aspect-Oriented Programming (AOP) is a very effective means to solve the crosscutting problem. However, we have observed the following limitations of the current AOP framework: (1) the current text-based AOP languages cannot clearly show how aspects are weaved together, (2) their granularity is too coarse to capture all aspects in an RTOS, (3) it is difficult to control the weaving process, since aspect weavers are usually hard-coded. In this paper, we propose a new AOP framework that provides (1) a graphical aspect programming environment that visualizes aspects, crosscutting classes, and method structures, (2) a new aspect model that supports a sub-method level granularity where an aspect is defined as a set of classes, and (3) an aspect weaving process specified by an object-oriented meta-model transformation. Since our aspect-oriented programming framework improves the expressiveness of the crosscutting concerns of RTOSes and automates aspect weaver generation, it can enhance RTOS customization.
947674
Visual exploration of genetic likelihood space
Linkage analysis is used to localize human disease genes on the genome and it can involve the exploration and interpretation of a seven-dimensional genetic likelihood space. Existing genetic likelihood exploration techniques are quite cumbersome and slow, and do not help provide insight into the shape and features of the high-dimensional likelihood surface. The objective of our visualization is to provide an efficient visual exploration of the complex genetic likelihood space so that researchers can assimilate more information in the least possible time. In this paper, we present new visualization tools for interactive and efficient exploration of the multi-dimensional likelihood space. Our tools provide interactive manipulation of active ranges of the six model parameters determining the dependent variable, scaled genetic likelihood, or HLOD. Using filtering, color, and an approach inspired by "worlds-within-worlds" [5, 6], researchers can quickly obtain a more informative and insightful visual interpretation of the space.