17648841
Role-based access control on the web
Current approaches to access control on the Web servers do not scale to enterprise-wide systems because they are mostly based on individual user identities. Hence we were motivated by the need to manage and enforce the strong and efficient RBAC access control technology in large-scale Web environments. To satisfy this requirement, we identify two different architectures for RBAC on the Web, called user-pull and server-pull. To demonstrate feasibility, we implement each architecture by integrating and extending well-known technologies such as cookies, X.509, SSL, and LDAP, providing compatibility with current web technologies. We describe the technologies we use to implement RBAC on the Web in different architectures. Based on our experience, we also compare the tradeoffs of the different approaches.
13486405
Static vs. dynamic recovery models for survivable distributed systems
The need for survivability is more pressing for mission-critical systems, especially when they are integrated with other COTS products or services. As information systems became more complex and the interdependence of these systems became higher, the survivability picture became more complicated. In this paper, we introduce two basic models with respect to static and dynamic models, where each model has restart and continue modes. We describe each approach and compare the trade-offs in terms of simplicity, resource efficiency, adaptation, service downtime, immunization, and robustness. Later, we introduce a hybrid model by combining these two basic models. Our approaches are transparent to the client side and can be applied to existing distributed systems by extending the server side with the components necessary for the schemes.
18041119
Component integrity check and recovery against malicious codes
With the rise in usage of software components in distributed computing applications, the importance of safeguarding these components has assumed great significance. In trying to ensure the survivability of these components, we enable a mission-critical application to detect malicious codes in a component downloaded from a remote location and recover the original functionality of the compromised component. In our work, we use digital signatures to ensure the integrity of software components in a large distributed system. By detecting unauthorized add-ons to the original components we can ensure that only legitimate software components are allowed to execute in a protected software environment. We also explore techniques to recover the original functionality of the component under attack by removing the affected portion from the component. In this paper we introduce the system architecture and the support mechanisms for our proposed approaches
17375890
Binding identities and attributes using digitally signed certificates
A certificate is digitally signed by a certificate authority (CA) to confirm that the information in the certificate is valid and belongs to the subject. Certificate users can verify the integrity and validity of a certificate by checking the issuing CA's digital signature in the certificate and, if necessary, chasing certificate chain and revocation lists. Usually, we use certificates to provide the integrity of identity or attribute information of the subject. Attributes must be coupled with the corresponding identities. We introduce comprehensive approaches to bind identity and attribute certificates, identifying three different techniques: monolithic, autonomic, and chained signatures. We describe each technique and analyze the relative advantages and disadvantages of each.
17152003
WLAN Security: Current and Future
Wireless LAN deployment improves users' mobility, but it also brings a range of security issues that affect emerging standards and related technologies.
11332993
Fine-Grained and Scalable Approaches for Message Integrity
When we have multiple users compiling a single message, including shared contents, metadata, policy, and so on, the integrity of the contents created by individual users needs to be maintained in an effective manner. There is an urgent need for new mechanisms in a trusted content-sharing environment to support multiple signers for the same message, which can be dynamically updated with autonomous protection and maintenance mechanisms. In our previous work we identified and compared three different binding mechanisms including monolithic, autonomous, and chained binding mechanisms, using digital signatures. The original work was designed and implemented for digital certificates. In this paper we apply those schemes with extension to the organization-to-organization messaging services that require effective integrity verification and tracking mechanisms at the user-level in the receiving organization in a scalable manner with fine granularity. We implement our ideas in the Java remote method invocation (RMI) platform and discuss the trade-offs of the signature schemes based on our experimental results
31766769
Improved selection in totally monotone arrays
This paper's main result is an -time algorithm for computing the kth smallest entry in each row of an m×n totally monotone array. (A two-dimensional array A={a[i, j]} is totally monotone if for all i1<i2 and j1<j2, a[i1, j1]<a[i1, j2] implies a[i2, j1]<a[i2, j2].) For large values of k (in particular, for k=⌈n/2⌉), this algorithm is significantly faster than the O(k(m + n))-time algorithm for the same problem due to Kravets and Park. An immediate consequence of this result is an O(n3/2lg1/2 n)-time algorithm for computing the kth nearest neighbor of each vertex of a convex n-gon. In addition to the main result, we also give an O(n lg m)-time algorithm for computing an approximate median in each row of an m×n totally monotone array; this approximate median is an entry whose rank in its row lies between ⌊n/4⌋ and ⌈3n/4⌉ − 1.
9979797
A truncated least squares approach to the detection of specular highlights in color images
One of the most difficult aspects of dealing with illumination effects in computer vision is accounting for specularity in the images of real objects. The specular regions in an image are often saturated - which creates problem for all image processing algorithms that use decision thresholds. Such algorithms include those for edge detection, region segmentation, etc. Detecting specularity and whenever possible compensating for it are obviously advantageous. Along these lines, this paper represents a new specularity detection and compensation method which is based on the notion of truncated least-squares approximation to the function that maps the color distribution between two images of an object under different illumination conditions. We also present a protocol for the evaluation of the current method for specularity detection. Our protocol as currently formulated uses human subjects to grade the specularity detection method.
1384536
Mining association rules with adjustable accuracy
In this paper, we devise efficient algorithms for mining association rules with adjustable accuracy. It is noted that several applications require mining the transaction data to capture the customer behavior frequently. In those applications, the efficiency of data mining could be a more important faktor t.han the requirement for complete accuracy of the mining results. Allowing imprecise results can significantly improve the data mining efficiency. In this paper, two methods for mining association rules with adjustable accuracy are developed. By dealing with the concept of sampling, both methods obtain some essential knowledge from a sampled subset first, and in light of that knowledge, perform efficient association rule mining on the entire database. A technique of relaxing the support factor based on the sampling size is devised to achieve the desired level of accuracy. These two methods differ from each other in their ways of utilizing the sampled data. Performance of these two methods is comparatively analyzed. As shown by our experimental results, the relaxation factor, as well as the sample size, can be properly adjusted so as to improve the result accuracy while minimizing the corresponding execution time, thereby allowing us to effectively achieve a design trade-off between accuracy and efficiency with two control parameters. It is shown that with the advantage of controlled sampling, the proposed methods are very flexible and efficient, and can in general lead to results of a very high degree of accuracy.
10180647
Specularity elimination in range sensing for accurate 3D modeling of specular objects
We present a novel range sensing method that is capable of constructing accurate 3D models of specular objects. Our method utilizes a new range imaging concept called multipeak range imaging, which accounts for the effects of mutual reflections. False measurements generated by mutual reflections are then eliminated by applying a series of constraint tests based on local smoothness, global coordinate consistency and visibility consistency. We show the usefulness of our method by applying the method to three real objects with specular surfaces. The ground truth data for those three objects were also acquired in order to evaluate the elimination of false measurements and to justify the selection of the parameters in the constraint tests. Experimental results indicate that our method significantly improves upon the traditional methods for constructing reliable 3D models of specular objects with complex shapes.
5714667
Extending software communications architecture for QoS support in SDR signal processing
The software communications architecture (SCA) is middleware for providing component interfaces and dynamic reconfigurability to software define radio (SDR) modems and it is widely adopted by the SDR forum. Although its main application domains include real-time signal processing, SCA lacks QoS support. We thus propose a QoS-enabled extension of SCA called Q-SCA. Our extended architecture incorporates a new waveform model, extended domain profiles that describe QoS requirements, and a modified application instantiation process that supports both admission control and resource allocation. We show the viability of Q-SCA through full implementation and experiments.