6952634
A middleware approach for SAINT (secure, automatic, interoperable, and transparent) peer-to-peer content services
Expanded use of the Internet and technological advances are eliciting changes in how individuals manage and share their contents. The Internet has been primarily a client-server-based system, where it is challenging to keep contents up-to-date and consistent among all of the devices. Furthermore, the client-server model has service limitations in heterogeneous computing environments. However, a new peer-to-peer (P2P) model has emerged. In this P2P workplace, each participant (peer) acts as both client and content provider. Compared with services performed by the client-server model, P2P-based content management services have several advantages. In P2P environments, users can manage heterogeneous information resources residing in various platforms perhaps in different policy environments. A P2P-based content management model can provide higher resource availability due to the distributed nature of P2P computing. However, wide-scale application of P2P computing is constrained by limitations associated with the especially sophisticated control mechanisms needed between peers: most current P2P technologies simply focus on sharing services rather than on controls between the peers. In this paper, we introduce a middleware approach to support the underlying mechanisms, providing secure, automatic, interoperable, and transparent (SAINT) services for P2P content management. The underlying mechanisms are based on machine-understandable metadata. Our middleware approach using metadata facilitates the SAINT content management services with rich metadata expression in P2P computing environments. The broad dissemination of our approach allows the application of P2P technology to more reliable and efficient content services within organization or inter-organizations.
14631475
RBAC on the Web by Secure Cookies
Current approaches to access control on Web servers do not scale to enterprise-wide systems, since they are mostly based on individual users. Therefore, we were motivated by the need to manage and enforce the strong access control technology of RBAC in large-scale Web environments. Cookies can be used to support RBAC on the Web, holding users’ role information. However, it is insecure to store and transmit sensitive information in cookies. Cookies are stored and transmitted in clear text, which is readable and easily forged. In this paper, we describe an implementation of Role-Based Access Control with role hierarchies on the Web by secure cookies. Since a user’s role information is contained in a set of secure cookies and transmitted to the corresponding Web servers, these servers can trust the role information in the cookies after cookie-verification procedures and use it for role-based access control. In our implementation, we used CGI scripts and PGP (Pretty Good Privacy) to provide security services to secure cookies. The approach is transparent to users and applicable to existing Web servers and browsers.
17152003
WLAN Security: Current and Future
Wireless LAN deployment improves users' mobility, but it also brings a range of security issues that affect emerging standards and related technologies.
17648841
Role-based access control on the web
Current approaches to access control on the Web servers do not scale to enterprise-wide systems because they are mostly based on individual user identities. Hence we were motivated by the need to manage and enforce the strong and efficient RBAC access control technology in large-scale Web environments. To satisfy this requirement, we identify two different architectures for RBAC on the Web, called user-pull and server-pull. To demonstrate feasibility, we implement each architecture by integrating and extending well-known technologies such as cookies, X.509, SSL, and LDAP, providing compatibility with current web technologies. We describe the technologies we use to implement RBAC on the Web in different architectures. Based on our experience, we also compare the tradeoffs of the different approaches.
42838112
Trusted Identity and Session Management Using Secure Cookies
The concept of federated identity management is increasingly coming to use in order to bring Service Providers closer to customers. Users are being provided an enriched experience while carrying out business on the Web at reduced overhead and improved customer service. The idea of maintaining a single profile and gaining access to multiple services has been accepted well by the customers. However, the benefits of breaking through just one set of credentials to gain access to multiple services has made the concept of Federated Identity Management of high interest to malicious users. In this paper, we analyze the structure of a generic Federated Identity Management System and explore the .NET Passport framework in depth. We explore the current security mechanisms adopted by the .NET Passport and identify potential security weaknesses. We then propose our new approaches to enhance the security services in .NET Passport by using Secure Cookies. Our approaches are transparent to and compatible with the current .NET Passport server. Finally, we prove the feasibility by implementing our ideas in a real system.
18041119
Component integrity check and recovery against malicious codes
With the rise in usage of software components in distributed computing applications, the importance of safeguarding these components has assumed great significance. In trying to ensure the survivability of these components, we enable a mission-critical application to detect malicious codes in a component downloaded from a remote location and recover the original functionality of the compromised component. In our work, we use digital signatures to ensure the integrity of software components in a large distributed system. By detecting unauthorized add-ons to the original components we can ensure that only legitimate software components are allowed to execute in a protected software environment. We also explore techniques to recover the original functionality of the component under attack by removing the affected portion from the component. In this paper we introduce the system architecture and the support mechanisms for our proposed approaches
371162
Security architectures for controlled digital information dissemination
Besides securing transmission of digital information at lower layers, several application-level security solutions for controlled dissemination of digital information have been developed using cryptographic, watermarking or use-control technologies. These dissemination control solutions have been designed for different business purposes. Little research, if any, identifies security architectures for controlling or tracking digital information dissemination in general. The identification of such will provide a foundation for developing appropriate security solutions for organizations' secure dissemination of digital information, and provide a better understanding of current application-level security solutions. We identify eight application-level security architectures based on the following three elements: virtual machine, control set and distribution style. Some of the architectures provide control and tracking capabilities for dissemination and usage of digital information, while others provide only tracking capability. We describe the architectures and compare their capabilities, merits and demerits. In addition, we review briefly some of the required mechanisms, including watermarking and use-control technologies. Also, we relate some of commercial solutions to our security architectures in order to provide insight on the current availability of our solutions architectures.
1384536
Mining association rules with adjustable accuracy
In this paper, we devise efficient algorithms for mining association rules with adjustable accuracy. It is noted that several applications require mining the transaction data to capture the customer behavior frequently. In those applications, the efficiency of data mining could be a more important faktor t.han the requirement for complete accuracy of the mining results. Allowing imprecise results can significantly improve the data mining efficiency. In this paper, two methods for mining association rules with adjustable accuracy are developed. By dealing with the concept of sampling, both methods obtain some essential knowledge from a sampled subset first, and in light of that knowledge, perform efficient association rule mining on the entire database. A technique of relaxing the support factor based on the sampling size is devised to achieve the desired level of accuracy. These two methods differ from each other in their ways of utilizing the sampled data. Performance of these two methods is comparatively analyzed. As shown by our experimental results, the relaxation factor, as well as the sample size, can be properly adjusted so as to improve the result accuracy while minimizing the corresponding execution time, thereby allowing us to effectively achieve a design trade-off between accuracy and efficiency with two control parameters. It is shown that with the advantage of controlled sampling, the proposed methods are very flexible and efficient, and can in general lead to results of a very high degree of accuracy.
5711141
Selection and sorting in totally monotone arrays
A two-dimensional arrayA={a[i, j]} is calledtotally monotone if, for alli1<i2 andj1<j2,a[i1,j1]<a[i1,j2] impliesa[i2,j1]<a[i2,j2]. Totally monotone arrays were introduced in 1987 by Aggarwal, Klawe, Moran, Shor, and Wilber, who showed that several problems in computational geometry and VLSI river routing could be reduced to the problem of finding a maximum entry in each row of a totally monotone array. In this paper we consider several selection and sorting problems involving totally monotone arrays and give a number of applications of solutions for these problems. In particular, we obtain the following results for anm × n totally monotone arrayA:1.Thek largest (ork smallest) entries in each row ofA can be computed inO(k(m + n)) time. This result allows us to determine thek farthest (ork nearest) neighbors of each vertex of a convexn-gon inO(kn) time.2.Provided the transpose ofA is also totally monotone, thek largest (ork smallest) entries overall inA can be computed inO(m + n + k lg(mn/k)) time. This result allows us to find thek farthest (ork nearest) pairs of vertices from a convexn-gon inO(n + k lg(n2/k)) time.3.The rows ofA can be sorted inO(mn) time whenm ≥n and inO(mn(1 + lg(n/m))) time whenm < n. This result allows us to solve the of Ω(S) on the number of combinations of row permutations possible for a totally monotone array would imply an Ω(lgS) lower bound on the time necessary to sort the array's rows in a linear decision tree model.)4.In Subsection 4.2 we applied our algorithm for sorting the rows of a totally monotone array to the neighbor-ranking problem for the vertices of a convex polygonP. We then extended this technique to arbitrary point sets. It remains open whether our two selection algorithms for totally monotone arrays, which we also applied to the vertices of a convex polygon, can likewise be applied to arbitrary point sets.
13229931
A Haptic Teleoperation Approach Based on Contact Force Control
This paper presents a new teleoperation approach using a virtual spring, and local contact force control on the slave robot. The operational space framework provides the control structure needed to achieve decoupled task dynamics. A virtual spring connects the master and slave systems and a closed-loop force controller compensates for the dynamics of the slave system, rendering transparent the effector of the slave robotic system. The active force control approach allows the desired motion and contact forces to be combined in a single force command. The required performance and robustness of force control are achieved by a full state reconstruction using a modified Kalman estimator, which addresses disturbances and modeling uncertainties. The performance of both telepresence and force control are further improved by on-line stiffness estimation of the object in contact with the effector. The redundancy of the mobile manipulation system is addressed through a decoupled decomposition of task and posture dynamics.
7650136
Fuzzy-logic zero-moment-point trajectory generation for reduced trunk motions of biped robots
Trunk motions are typically used in biped robots to stabilize the locomotion. However, they can be very large for some leg trajectories unless they are carefully designed. This paper proposes a fuzzy-logic zero-moment-point (ZMP) trajectory generator that would eventually reduce the swing motion of the trunk significantly even though the leg trajectory is casually designed, for example, simply to avoid obstacles. The fuzzy-logic ZMP trajectory generator uses the leg trajectory as an input. The resulting ZMP trajectory is similar to that of a human one and continuously moves forward in the direction of the locomotion. The trajectory of the trunk to stabilize the locomotion is determined by solving a differential equation with the ZMP trajectory and the leg trajectory known. The proposed scheme is simulated on a 7-DOF biped robot in the sagittal plane. The simulation results show that the ZMP trajectory generated by the proposed fuzzy-logic generator increases the stability of the locomotion and thus reduces the motion range of the trunk significantly.