11119047
Component-abnormality detection and immunization for survivable systems in large distributed environments
18041119
Component integrity check and recovery against malicious codes
With the rise in usage of software components in distributed computing applications, the importance of safeguarding these components has assumed great significance. In trying to ensure the survivability of these components, we enable a mission-critical application to detect malicious codes in a component downloaded from a remote location and recover the original functionality of the compromised component. In our work, we use digital signatures to ensure the integrity of software components in a large distributed system. By detecting unauthorized add-ons to the original components we can ensure that only legitimate software components are allowed to execute in a protected software environment. We also explore techniques to recover the original functionality of the component under attack by removing the affected portion from the component. In this paper we introduce the system architecture and the support mechanisms for our proposed approaches
14631475
RBAC on the Web by Secure Cookies
Current approaches to access control on Web servers do not scale to enterprise-wide systems, since they are mostly based on individual users. Therefore, we were motivated by the need to manage and enforce the strong access control technology of RBAC in large-scale Web environments. Cookies can be used to support RBAC on the Web, holding users’ role information. However, it is insecure to store and transmit sensitive information in cookies. Cookies are stored and transmitted in clear text, which is readable and easily forged. In this paper, we describe an implementation of Role-Based Access Control with role hierarchies on the Web by secure cookies. Since a user’s role information is contained in a set of secure cookies and transmitted to the corresponding Web servers, these servers can trust the role information in the cookies after cookie-verification procedures and use it for role-based access control. In our implementation, we used CGI scripts and PGP (Pretty Good Privacy) to provide security services to secure cookies. The approach is transparent to users and applicable to existing Web servers and browsers.
42838112
Trusted Identity and Session Management Using Secure Cookies
The concept of federated identity management is increasingly coming to use in order to bring Service Providers closer to customers. Users are being provided an enriched experience while carrying out business on the Web at reduced overhead and improved customer service. The idea of maintaining a single profile and gaining access to multiple services has been accepted well by the customers. However, the benefits of breaking through just one set of credentials to gain access to multiple services has made the concept of Federated Identity Management of high interest to malicious users. In this paper, we analyze the structure of a generic Federated Identity Management System and explore the .NET Passport framework in depth. We explore the current security mechanisms adopted by the .NET Passport and identify potential security weaknesses. We then propose our new approaches to enhance the security services in .NET Passport by using Secure Cookies. Our approaches are transparent to and compatible with the current .NET Passport server. Finally, we prove the feasibility by implementing our ideas in a real system.
17648841
Role-based access control on the web
Current approaches to access control on the Web servers do not scale to enterprise-wide systems because they are mostly based on individual user identities. Hence we were motivated by the need to manage and enforce the strong and efficient RBAC access control technology in large-scale Web environments. To satisfy this requirement, we identify two different architectures for RBAC on the Web, called user-pull and server-pull. To demonstrate feasibility, we implement each architecture by integrating and extending well-known technologies such as cookies, X.509, SSL, and LDAP, providing compatibility with current web technologies. We describe the technologies we use to implement RBAC on the Web in different architectures. Based on our experience, we also compare the tradeoffs of the different approaches.
7753152
Countering Insider Threats in Personal Devices
The information age is a time when organizations are networked back and forth with multiple wires, different communication channels, many sophisticated information systems, and most importantly through the almighty Internet. This project focuses on responses that are most beneficial to organizations in regards to the internal threats. Mainly, it addresses the issues connected to the broad use of laptops, desktops, and other personal devices such as flash drives. During research there were thought different ways of mitigating the issue of insider threats. The result of this analysis is the Diamond Theory. It ties four methods of increasing the security of personal devices: software design, information retrieval, detection technology design and information policy design. All four corners of the diamond are represented by four different techniques that increase the security of personal devices and thus the defense against insider threats. These techniques are described as theoretical premises that shall be fulfilled in order to have the security raised to the maximum. Additionally, these methods are interdependent of each other and must work together to meet the overall goal of the theory.
17981428
SECK: survivable and efficient clustered keying for wireless sensor networks
A wireless sensor network (WSN) typically consists of a large number of small sensor nodes and one or more high-end control and data aggregation nodes. Sensor nodes have limited computation and communication capabilities, and communicate via wireless links. Consequently, WSNs are highly vulnerable to attacks. This vulnerability is exacerbated when WSNs have to operate unattended in a hostile environment, such as battlefields. In this paper, we propose a novel self-organizing key management scheme for large-scale WSNs, called Sunivable and efficient clustered keying (SECK). Our scheme was designed specifically to address the key management issues within the low-tier of a hierarchical network architecture. Previous approaches for WSN key management adequately addressed operational issues, but to a large extent, ignored robustness and recoverability issues. Using simulation and analysis, we show that SECK is highly robust against key and node captures, and has noteworthy advantages over other key management schemes.
62242004
Object boundary edge selection using normal direction derivatives of a contour in a complex scene
Nguyen proposed a method [H.T., Nguyen et al., 2002] for tracking a nonparameterized object (subject) contour in a single video stream. Nguyen's approach combined outputs of two steps: creating a predicted contour and removing background edges. We propose a method to increase object tracking accuracy by improving the background edge removal process. Nguyen's background edge removal method of leaving many irrelevant edges is subject to inaccurate contour tracking. Our accurate tracking is based on reducing affects from irrelevant edges by selecting the boundary edge only. We select high-valued edge pixels of average image intensity gradients in the contour normal direction. Our experimental results show that our tracking approach is robust enough to handle a complex-textured scene.
36445748
InCore: Accounting and Charging Heterogeneous Unix Systems
14438478
A Certificate-Based Signature Scheme
In this paper, we propose the security notion of certificate-based signature that uses the same parameters and certificate revocation strategy as the encryption scheme presented at Eurocrypt 2003 by Gentry. Certificate-based signature preserves advantages of certificate-based encryption, such as implicit certification and no private key escrow. We present concrete certificate-based signature schemes derived from pairings on elliptic curves and prove their security in the random oracle model assuming that the underlying group is GDH. Additionally, we propose a concrete delegation-by-certificate proxy signature scheme which is derived from a certificate-based signature scheme after simple modifications. Our proxy scheme is provably secure in the random oracle model under the security notion defined by Boldyreva, Palacio and Warinschi.
9979797
A truncated least squares approach to the detection of specular highlights in color images
One of the most difficult aspects of dealing with illumination effects in computer vision is accounting for specularity in the images of real objects. The specular regions in an image are often saturated - which creates problem for all image processing algorithms that use decision thresholds. Such algorithms include those for edge detection, region segmentation, etc. Detecting specularity and whenever possible compensating for it are obviously advantageous. Along these lines, this paper represents a new specularity detection and compensation method which is based on the notion of truncated least-squares approximation to the function that maps the color distribution between two images of an object under different illumination conditions. We also present a protocol for the evaluation of the current method for specularity detection. Our protocol as currently formulated uses human subjects to grade the specularity detection method.