Search

Although identity management systems (notably OAuth 2.0 and OpenID Connect) have been widely adopted by a range of Relying Parties and Identity Providers, it is not yet clear whether practical implementations of these systems are actually secure. In this thesis we investigate this question. In doing so we describe two large-scale empirical studies of the security of real-world identity management systems; the purposes of these studies include identifying areas for improvement in the design and implementation of the systems, as well as addressing issues acting as barriers to adoption. As part of the underlying goal of improving operational security, a new scheme is also proposed to enhance user security for OpenID Connect. In the first of the two studies we examined 60 Relying Parties (RPs) and ten Identity Providers (IdPs) supporting OAuth 2.0 based identity management services in China. In the second study we considered 103 RPs supporting OpenID Connect-based identity management using Google as the IdP. In both cases we recorded and carefully analysed the browser-relayed messages sent between the RP and IdP, identifying a number of major security vulnerabilities, some with very serious potential consequences for end user security. We further designed and implemented proof-of-concept attacks to demonstrate the seriousness of the vulnerabilities we identified. We also reported the vulnerabilities to the most seriously affected parties, helped them to fix the problem, as well as providing detailed recommendations for both IdPs and RPs, designed to reduce the risk of such vulnerabilities occurring in the future. To improve user security when using OpenID Connect, a novel client-based scheme is proposed, designed to mitigate phishing attacks and to provide a consistent user interface. A prototype of the scheme is described, which allows for greater user control during the authentication process.

The increasing utilization of intelligent agents has led to a growing demand for policy frame- works to govern their behavior. AOPL (Authority Obligation Policy Language) stands as a well- established policy framework within the logic-based AI (Artificial Intelligence) community. This thesis evaluated the suitability and effectiveness of AOPL by comparing it against other prominent policy frameworks. The evaluation assessed their capacity to effectively express policies, including role-based policies, and their ability to analyze policies. The methodology comprised a series of literature policy scenarios designed to test the scalability and efficiency of the policy frameworks. Additionally, the AOPL framework was extended with missing features identified through comparison with EPA (Expressive Policy Analysis) and other logic-based policy frameworks. The outcome of this research contributed to a better understanding of the strengths and limitations of these policy frameworks, providing valuable insights for the development of future policy-based intelligent agent systems.

In the United States, 34.2% of healthcare costs result from administrative spending (Himmelstein, Campbell, & Woolhandler, 2020). The costliest and most time-consuming of these administrative processes is precertification. Precertification is a health insurer requirement that providers obtain permission before providing planned medical procedures in order to be eligible for payment. The Council for Affordable Quality Healthcare (CAQH) tracks adoption of the Health Insurance Portability and Accountability (HIPAA) mandated transactions to measure the progress in reducing cost and burden associated with administrative processes. CAQH estimated that the healthcare industry spent $767 million in 2020 on obtaining precertification. The requirement to obtain precertification can affect the processes and workflows across an organization, including scheduling, access, patient care, information systems, coding, and billing. This illustrative case study examined the precertification process for a large multispecialty physician group to determine its challenges and impacts. The study gathered information through a review of claims denied for missing precertification and individual in-depth semi-structured interviews with leaders responsible for aspects of the precertification process. The research focused on identifying the necessary steps in the precertification and denial resolution process and the challenges posed by this administrative requirement. The research identified several challenges in the precertification process, most of which can be linked to one of three broad categories; lack of standardization, time required to obtain approval, and lack of recognition of provider specialty and place of service considerations. Recommendations for improving this process include proposals for the industry, insurance companies, and the physician organization.

In order to build machine-checked proven-secure software, we need formal se curity policies that express what it means to be “secure.” We must then show that the semantics of our software matches the semantics of those policies. This requires formal semantics for both programs and policies. In this dissertation, we explore the semantics of effectful programs and the semantics of authorization policies. The most well-known class of effects are those that can be given semantics via a monad, though current research also focuses on those that can be given a semantics via a comonad. We compare three methods for combining these two popular options: one method requires extra semantic structure, whereas the other methods can be applied to any monadic and comonadic effects. If the extra semantic structure needed for the first method exists then the three semantics are equivalent. Otherwise, we show that the two remaining semantics correspond to strict and lazy interpretations of the effects. On the other side, we use authorization logics to express authorization policies. Authorization logics can be given semantics using either models or a proof system. We build a model theory for an authorization logic that more-closely expresses how authorization logics are used by systems than traditional models. We also build a proof system for an authorization logic that ensures that proofs of authorization respect information-security policies.

Authentication and authorization systems can be found in almost every software system, and consequently affects every aspect of our lives. Despite the variety in the software that relies on authorization, the authorization subsystem itself is almost universally architected following a common pattern with unfortunate characteristics.The first of these is that there usually exists a set of centralized servers that hosts the set of users and their permissions. This results in a number of security threats, such as permitting the operator of the authorization system to view or even change the permission data for all users. Secondly, these systems do not permit federation across administrative domains, as there is no safe choice of system operator: any operator would have visibility and control in all administrative domains, which is unacceptable. Thirdly, these systems do not offer transitive delegation: when a user grants permission to another user, the permissions of the recipient are not predicated upon the permissions of the granter. This makes it very difficult to reason about permissions as the complexity of the system grows, especially in the federation across domains case where no party can have absolute visibility into all permissions.Whilst several other systems, such as financial systems (e.g. blockchains) and communication systems (e.g. Signal / WhatsApp) have recently been reinvented to incorporate decentralization and privacy, there has been little attention paid to improving the authorization systems. This work aims to address that by asking the question ``How can we construct an authorization system that supports first-class transitive delegation across administrative domains without trusting a central authority or compromising on privacy?''We survey several models for authorization and find that Graph Based Authorization, where principals are vertices in a graph and delegation between principals are edges in the graph, is capable of capturing transitive delegation as a first class primitive, whilst also retaining compatibility with existing techniques such as Discretionary Access Control or Role Based Access Control. A proof of permission in the Graph Based Authorization model is represented by a path through the graph formed from the concatenation of individual edges. Whilst prior implementations of Graph Based Authorization do not meet the decentralization or privacy-preserving goals, we find that this is not intrinsic, and can be remedied by introducing two new techniques. The first is the construction of a global storage tier that cryptographically proves its integrity, and the second is an encryption technique that preserves the privacy of attestations in global storage.The horizontally-scalable storage tier is based on a new data structure, the Unequivocable Log Derived Map, which is composed of three Merkle trees. Consistency proofs over these trees allow a server to prove that objects exist or do not exist within storage, as well as proving that the storage is append-only (no previously inserted objects have been removed). Our scheme advances prior work in this field by permitting efficient auditing that scales with the number of additions to the storage rather than scaling with the total number of stored objects. By utilizing cryptographic proofs of integrity, we force storage servers to either behave honestly, or become detected as compromised. Thus, even though the architecture is centralized for availability and performance, it is does not introduce any central authorities.The design of the storage does not ensure the privacy of the permission data stored within it. We address this through the introduction of Reverse Discoverable Encryption. This technique uses the objects representing grants of permission as a key dissemination channel, thus operating without communication between participants. By using Wildcard Key Derivation Identity Based Encryption in a non-standard way (with no central Private Key Generator) we allow for permission objects to be encrypted using the authorization policy as a key. Thus, RDE permits the recipient of some permissions to decrypt other compatible permissions granted to the grantee that could be concatenated together to form a valid proof. RDE therefore protects the privacy of permission objects in storage whilst still permitting decryption of those objects by authorized parties.We construct an implementation of these techniques, named WAVE, and evaluate its performance. We find that WAVE has similar performance to the widely used OAuth system and performs better than the equally widely used LDAP system, despite offering significantly better security properties. We present an advancement to Graph Based Authorization which efficiently represents complex authorization proofs as a compact subgraph rather than a sequence of linear paths, and present a technique for efficient discovery of such proofs.To validate our techniques and ensure their efficacy in practice, we pose an additional question: ``How can we leverage WAVE to improve the security of IoT communications?'' We present a microservice architecture that abstracts the interfaces of IoT devices to permit a uniform security policy to be applied to heterogeneous devices of similar function. This is achieved by enforcing security policy at the communication bus and using hardware abstraction microservices to adapt the interfaces that devices expose on this communication bus. We construct and evaluate an instance of this communication bus, WAVEMQ and find that, with appropriate caching, its performance is comparable to that of prior publish/subscribe information busses. We discover that by enforcing WAVE's security model in the core of the network, we gain a resistance to denial of service attacks. This is particularly valuable in the IoT context where devices are typically resource constrained or connected by a bandwidth-limited link.

It is possible that, as you read this, there is someone out there standing in for you, speaking in your voice, acting in your stead, making agreements on your behalf, or conceding a point you might not have wanted them to. They are not your congressperson, your lawyer, or your spouse—nor anyone else authorized by means of a formal, corporately organized election or selection procedure. There is another sort of representative out there, someone you did not elect, someone you perhaps would not elect, of whom you may never have heard, speaking or acting on your behalf right now—they are an informal political representative. Formal political representation is a familiar topic within democratic theory. Much less discussed, though no less widespread, is informal political representation: a practice in which a person speaks or acts for a group before an audience, despite never having been elected or selected to do so by means of a corporately organized election or selection procedure. Informal political representation is an everyday feature of our public communicative landscape. It is woven taut into the fabric of our political lives. Malala Yousafzai claims: “I speak not for myself, but so those without a voice can be heard.” Bono claims to “represent a lot of people who have no voice at all,” though “[t]hey haven’t asked me either. It’s cheeky, but I hope they’re glad I do . . . ” President Trump, before his nomination, was said “to give a voice to those who have long felt silenced.” The informal representative, though neither elected nor selected, is ubiquitous and politically influential. They increase the visibility of marginalized and oppressed groups, give voice to interests not adequately expressed in formal political fora, influence public discourse, and serve as conduits between the represented and policymakers. They can, as Dr. Martin Luther King, Jr., did in Montgomery, negotiate on a group’s behalf. But so far, few have attempted to provide a theory of this phenomenon that gives full attention to both its conceptual and normative foundations. My dissertation provides a theory of informal political representation that does not treat the phenomenon as a mere deviant case of formal political representation, but rather takes informal political representation on its own terms. In Chapter One, “The Phenomenon of Informal Political Representation,” I provide a novel account of this phenomenon. I argue that a person or group emerges as an informal political representative when and because they have been taken by an audience (on the basis of sufficient evidence) to speak or act on behalf of a group—call this audience uptake. Characterizing the phenomenon in this way reveals that one can end up speaking or acting for others though they are reluctant to do so (the unwilling representative) and perhaps even though they are unaware they are in such a position (the unwitting representative). In Chapter Two, “Representative Powers,” I make a distinction between two types of powers that informal representatives can have with respect to those they represent: de facto power and normative powers. The informal representative has de facto power simply in virtue of receiving audience uptake. The informal representative’s de facto power is their ability to affect the interests and constrain the choices available to the represented group. Because the informal representative has de facto power to impact the represented group’s circumstances, they have corresponding general moral duties to the represented group, even if neither the representative nor the represented group wants that representative to occupy the position. The informal representative may also have normative powers with respect to the represented, but only if the representative has received group uptake. I illustrate the phenomenon of group uptake using the example of the Montgomery bus boycott, during which King emerged as an informal representative for black Montgomerians. In Chapter Three, “Democracy Within, Justice Without: The Duties of Informal Political Representatives,” I focus on cases of informal political representation where the representative speaks or acts for a group whose members are not afforded equal treatment in their society. I argue that, to promote the realization of a society of equals, informal representatives for such groups must aim to satisfy two types of duties: (i) justice without duties: the representative’s duties to use their position to promote conditions of social equality for the represented group when they are before an audience; and (ii) democracy within duties: the representative’s duty to forge a democratic relationship between themself and the represented whereby they treat the represented as their equals and do not dominate the represented. In Chapter Four, “The Complaints of the Represented,” I provide a framework for understanding the legitimate complaints that the represented may raise against the informal political representative. The relationship between the informal representative and those they represent is a wide-ranging and many-voiced conversation. It is a dialogue, an ongoing exchange of ideas, reasons, explanations, and justifications passed between the representative and the represented. As such, it is important to understand one of the most important features of that ongoing exchange—namely, the legitimate complaints of the represented. The aim of this chapter is to zero in on those types of legitimate complaints which could only sensibly be raised against someone who is in the position of informal representative and which could only sensibly be raised by the represented themselves. In Chapter Five, “The Limits of Similitude and Deference,” I consider two principles that have been endorsed as necessary constraints on the practice of informal political representation, which I call, respectively, The Demand for Similitude (Similitude) and The Demand for Deference (Deference). According to Similitude, one may be an informal representative for a group only if either one is oneself a member of that group or one is descriptively similar to the group’s members. According to Deference, if one is an informal representative for a group, then one ought always to defer to that group’s members when deciding how to represent the group. I argue that these two principles, when stated as necessary constraints, are false. I offer that, instead, we have good reason to endorse weaker versions of these two principles. I then argue that, in fact, (i) in some cases, we should favor representation by people who are neither members of the group they represent nor descriptively similar to group members, and (ii) in some cases, deference to the group’s members is not best for the represented group.

As Internet of Things (IoT) systems further emerge, we face unprecedented security and privacy challenges, especially with regards to the collected data. This data typically consists of sensor readings, tagged with metadata. For scalability, ubiquitous access, and sharing possibilities, the data is most often stored in the cloud. Securing date while in transit and in particular when being stored in the cloud is of utmost importance, as the data can be used to infer privacy-sensitive information. Moreover, transparent and secure data sharing (e.g., sharing with friends or domain experts) is considered a key requirement for the practicality and success of typical IoT systems. In today’s cloud-centric designs, users have no choice but to trust centralized parties. The increased number of security and privacy incidents, such as system compromises or unauthorized trade with users data, show that this trust is not always justified. Despite varying levels of privacy-awareness among users of different age and geopolitical groups, and even societal shifts towards privacy pragmatism and indifference, the security and privacy threats do usually have far-reaching implications, demanding adequate mechanisms and measures to address them. In this dissertation, we investigate building secure IoT systems that protect data confidentiality and retain data ownership. We build secure systems that allow reducing the trust end-users are required to put into third parties within the IoT ecosystem, specifically towards the cloud storage and service providers. More importantly, we take a new approach on empowering the user with ownership and fine-grained access control for IoT data without sacrificing performance or security. In particular, we present three approaches to enabling a secure IoT ecosystem: (i) Talos: Talos is a system that stores IoT data securely in a cloud database while still allowing query processing over the encrypted data. Talos protects data even if the server is compromised. We enable this by encrypting IoT data with a set of cryptographic schemes such as order- preserving and partially homomorphic encryption. We tailor Talos to accommodate for the resource asymmetry of the IoT, particularly towards constrained IoT devices. We assess the feasibility of Talos on low-power devices with and without cryptographic hardware accelerators and quantify its overhead concerning energy consumption, computation time, and latency. With a thorough evaluation of our prototype implementation, we show that Talos is a practical system that can provide a high level of security with reasonable overhead. (ii) Pilatus: Storage of data on cloud services naturally facilitates data sharing with third-party services and other users, but bears privacy risks. We present Pilatus, a data protection platform that extends Talos where the cloud stores only encrypted data, yet is still able to process a defined set of database queries (e.g., range or sum). Pilatus features a novel encrypted data sharing scheme based on re-encryption, with revocation capabilities and in situ key-update. Our solution includes a suite of novel techniques that enable efficient partially homomorphic encryption, decryption, and sharing. We present performance optimizations that render these cryptographic tools practical for mobile platforms. We implement a prototype of Pilatus and evaluate it thoroughly. Our optimizations achieve a performance gain within one order of magnitude compared to state-of-the-art realizations. (iii) Droplet: Droplet is a secure data management system that we designed from the ground up to accommodate for the distributed nature of the IoT and revive the IoT from the current vertical design paradigm. The consequent myriad of isolated data silos of classical vertical architectures is hard to manage and prevent heterogeneous applications from interacting with our IoT data. To address this challenge, we leverage the blockchain technology to bootstrap trust for a distributed, secure, and resilient access control and data management scheme. Droplet handles time series data, enables reliable sharing among heterogeneous applications without intermediate trust entities, and features a cryptographically-protected fine-grained and scalable access control mechanism to data streams. We leverage a hash-chain-based key management mechanism to enable interval sharing and compact key distribution. The built-in cryptocurrency feature of blockchains allows the integration of economic incentives into our system. These properties enable a variety of applications that are presently not easily realizable using existing systems. The systems proposed and discussed in this dissertation demonstrate that end-to-end encryption with secure sharing can be achieved in IoT ecosystems with a modest overhead, while maintaining a consistent user- experience.

Enforcing the confidentiality and integrity of information is critical in distributed applications. Production systems typically use some form of authorization mechanism to protect information, but these mechanisms do not typically provide end-to-end information security guarantees. Information flow control mechanisms provide end-to-end security, but their guarantees break down when trust relationships may change dynamically, a common scenario in production environments. This dissertation presents flow-limited authorization, a new foundation for enforcing information security. Flow-limited authorization is an approach to authorization in that it can be used to reason about whether a principal is permitted to perform an action. It is an approach to information flow control in that it can be used to reason about whether a flow of information is secure. This dissertation presents the theoretical foundation of this approach, the Flow-Limited Authorization Model (FLAM). FLAM uses a novel principal algebra that unifies authority and information flow policies and a logic for making secure authorization and information flow decisions. This logic ensures that such decisions cannot be influenced by attackers or leak confidential information. We embed the FLAM logic in a core programming model, the Flow-Limited Authorization Calculus (FLAC). FLAC programs selectively enable flows of information; the type system ensures that attackers cannot create unauthorized flows. A well-typed FLAC not only ensures proper authorization, but also secure information flow. The FLAC approach to secure programming is instantiated in FLAME, a library and compiler plugin for enforcing flow-limited authorization in Haskell programs. Flame uses type-level constraints and monadic effects to statically enforce flow-limited authorization for Haskell programs in a modular way.

The Internet of Things (IoT) brings about benefits through interaction with humans and the physical world using a variety of technologies including sensors, actuators, controls, mobile devices and cloud computing. However, these benefits can be hampered by malicious interventions of attackers when the IoT is not protected properly. Hence, authentication and authorization comprise critical parts of basic security processes and are sorely needed in the IoT. Characteristics of the IoT render existing security measures such as SSL/TLS (Secure Socket Layer/Transport Layer Security) and network architectures ineffective against emerging networks and devices. Heterogeneity, scalability, and operation in open environments are serious challenges that need to be addressed to make the IoT secure. Moreover, many existing cloud-based solutions for the security of the IoT rely too much on remote servers over possibly vulnerable Internet connections.This dissertation presents locally centralized, globally distributed authentication and authorization to address the IoT security challenges. Centralized security solutions make system management simpler and enable agile responses to failures or threats, while having a single point of failure and making it challenging to scale. Solutions based on distributed trust are more resilient and scalable, but they increase each entity's overhead and are more difficult to manage. The proposed approach leverages an emerging network architecture based on edge computers by using them as locally centralized points for authentication and authorization of the IoT. This allows heterogeneity and an agile access control to be handled locally, without having to depend on remote servers. Meanwhile, the proposed approach has a globally distributed architecture throughout the Internet for robustness and scalability.The proposed approach is realized as SST (Secure Swarm Toolkit), an open-source toolkit for construction and deployment of an authentication and authorization service infrastructure for the IoT, for validation of locally centralized, globally distributed trust management. SST includes a local authorization entity called Auth to be deployed on edge computers which are used as a gateway for authorization as well as for the Internet. Software building blocks provided by SST, called accessors, enable IoT developers to readily integrate their IoT applications with the SST infrastructure, by encapsulating cryptographic operations and key management. In addition to protection against network-based intruders, SST supports a secure migration mechanism for enhancing availability in the case of failures or threats of denial-of-service attacks, based on globally distributed and trusted Auths.For evaluation, I provide a formal security analysis using an automated verification tool to rigorously show that SST provides necessary security guarantees. I also demonstrate the scalability of the proposed approach with a mathematical analysis, as well as experiments to evaluate security overhead of network entities under different security profiles supported by SST. The effectiveness of the secure migration technique is shown through a case study and simulation based on a concrete IoT application.

In the current digital age, almost every healthcare organization (HCO) has moved from storing patient health records on paper to storing them electronically. Health Information Exchange (HIE) is the ability to share (or transfer) patients’ health information between different HCOs while maintaining national security standards like the Health Insurance Portability and Accountability Act (HIPAA) of 1996. Over the past few years, research has been conducted to develop privacy and access control frameworks for HIE systems. The goal of this dissertation is to address the privacy and access control concerns by building practical and efficient HIE frameworks to secure the sharing of patients’ health information. The first solution allows secure HIE among different healthcare providers while focusing primarily on the privacy of patients’ information. It allows patients to authorize a certain type of health information to be retrieved, which helps prevent any unintentional leakage of information. The privacy solution also provides healthcare providers with the capability of mutual authentication and patient authentication. It also ensures the integrity and auditability of health information being exchanged. The security and performance study for the first protocol shows that it is efficient for the purpose of HIE and offers a high level of security for such exchanges. The second framework presents a new cloud-based protocol for access control to facilitate HIE across different HCOs, employing a trapdoor hash-based proxy signature in a novel manner to enable secure (authenticated and authorized) on-demand access to patient records. The proposed proxy signature-based scheme provides an explicit mechanism for patients to authorize the sharing of specific medical information with specific HCOs, which helps prevent any undesired or unintentional leakage of health information. The scheme also ensures that such authorizations are authentic with respect to both the HCOs and the patient. Moreover, the use of proxy signatures simplifies security auditing and the ability to obtain support for investigations by providing non-repudiation. Formal definitions, security specifications, and a detailed theoretical analysis, including correctness, security, and performance of both frameworks are provided which demonstrate the improvements upon other existing HIE systems.

Software as a Service (SaaS) clouds cooperate to provide services, which often provoke multi-party authorization. Some special cases of three-party authorization such as Facebook Single Sign On and PayPal Express Checkout have been widely used, however the general multi-party authorization as well as its security has not been well studied.This thesis focuses on secure multi-party authorization in clouds. First of all, the multi-party authorization problem is formalized by abstracting a class of real-world authorization services.It is found that, to solve the multi-party authorization problem, one should first solve the so-called name matching problem. Failing on name matching has led to fatal attacks against existing three-party authorization protocols.After formalization of the name matching problem, its inherent difficulty is unveiled by laying name matching into the family of Byzantine agreement problems. The name matching problem is then studied in the scenarios of no adversary, a single adversary, and multiple adversaries. Both the impossibility and positive results are presented. In the latter cases, name matching protocols are designed and their security with concurrent self composition is proved with Protocol Composition Logic.Furthermore, an algorithm is proposed to detect the vulnerabilities on name matching for multi-party authorization protocols. Applying the algorithm on existing three- and four-party authorization protocols reveals new design flaws, which can cause name matching attacks against PayPal Express Checkout, Alipay PeerPay, and Amazon FPS Marketplace.Secure name matching protocols are used as subroutines to construct multi-party authorization protocols. Their security is proved under the scenarios of no adversary, a single adversary, and multiple adversaries. In the case study, two new authorization services (data exchange and sales affiliation) are designed with the proposed protocols.Attackers not only exploit design flaws in authorization protocols, but also in their implementation. One of the attackers' major goals is to steal a victim's confidential data. The attackers often successfully escape from being detected by hiding themselves behind stepping-stones (e.g., VPN, proxy and SSH tunneling). How to traceback this kind of attackers is an open problem. In the thesis, a Pebbletrace system is presented. The system creates Pebbleware based on zero-day vulnerabilities and embeds it into victims' confidential data. If the data is stolen, Pebbleware enables the system to exploit the attackers behind stepping stones. The Pebbletrace system is evaluated in the case where Zeus bots are used and shows promising results.

Nexus Authorization Logic (NAL) provides a principled basis for specifying and reasoning about credentials and authorization policies. It extends prior access control logics that are based on "says" and "speaks for" operators. NAL enables authorization of access requests to depend on (i) the source or pedigree of the requester, (ii) the outcome of any mechanized analysis of the requester, or (iii) the use of trusted software to encapsulate or modify the requester. To illustrate the convenience and expressive power of this approach to authorization, a document-viewer application suite was implemented for the [alpha]-Nexus operating system. One of the viewers enforces policies that concern the integrity of excerpts a document contains; another viewer enforces confidentiality policies specified by labels tagging blocks of text; and a third viewer enforces policies that impose chain-ofcustody restrictions on stages of an image-editing pipeline. To study how compatible this approach to authorization is with existing principles for building trustworthy systems, a filesystem that pervasively instantiates a number of well-known security principles was implemented for [alpha]-Nexus. The design and overall performance of this filesystem was compared to a Linux filesystem that largely ignores the security principles.

Flow analysis has always been a great concern for a network system. An attacker can gain important information through several ways by monitoring the frequency and timing of network packets or by impersonating another user through remote access. Access to a network system based on single-factor authentication is nothing but monitoring the perimeter around the network leaving a company's a network wide open for the inside threat. There is a necessity to develop a classic network to reduce or eliminate threats within the organization. This thesis will analyze the flows to inspect every activity performed within the network in order for the untrusted flows to earn their way in becoming trusted flows based on notion of flow activity matching a specified pattern affiliated with the role.

In the U.S. Congress, the authorization-appropriation process is the formal model that establishes the separation between legislative and funding bills. Additionally, it determines the jurisdiction of the congressional committees that oversee those bills. However, a number of scholars have concluded that the authorization-appropriations dichotomy is substantially different in practice than the model suggests. Research in this area has shown that broad changes over the years have altered the roles of the authorization and appropriations committees. At different times, members of the appropriations committees have been regarded as guardians of the federal treasury, advocates of federal funds for their congressional district, or partisans in support of a political agenda (Adler, 2000). In addition to these roles, appropriators evidently have become more active in policymaking -- a role that traditionally has been the domain of the authorizing committees. To further explore the policymaking role of appropriators, this dissertation used a case study approach that traced appropriators' interactions with the executive branch, focusing on a federal agency and its links with the appropriations subcommittees that have oversight and funding jurisdiction over the agency's programs. Specifically, the study analyzed the relationship between the House and Senate Subcommittees on Labor, Health and Human Services, Education, and Related Agencies (L/ HHS) and the U.S. Department of Health and Human Services' Agency for Healthcare Research and Quality (AHRQ) during the period from 1989-2009. Through an examination of critical incidents and contextual elements, this dissertation examined whether the Subcommittees on L/HHS increasingly have become significant players in shaping AHRQ's policies and direction. In addition, the dissertation examined the impacts on AHRQ and possible reciprocal [Agency] influences on the Subcommittees. This research has the potential to build on existing works related to the dynamics of the authorization-appropriations process. Moreover, this research could provide a conceptual framework for analyzing the roles that the other congressional appropriations subcommittees play in relation to the executive branch agencies under their jurisdictions.

Administration of access control is a major issue in large-scale computer systems. Many such computer systems proposed over recent years aim at reducing the effort required to govern access. Role-based access control (RBAC) systems are a huge benefit to this point. They reduce the tasks of an administrator or authorities when users take on different roles in an organization and need to be assigned different access rights or privileges based on these roles. RBAC is a very expressive and flexible access control mechanism that makes it possible to have security policies based on the principle of least privilege, static and dynamic separation of duties, conflicts between roles and permissions, and many more. This research proposes the use of negative permissions and remote authorization for improving the scalability of an RBAC implementation. We discuss how negative permissions would fit in the proposed RBAC model. The thesis describes a mechanism to implement such an RBAC system utilizing negative authorizations. Our implementation is an extension of the Java 2 security architecture to support negative authorizations. We provide support for hierarchy of roles and de-confliction of positive and negative authorizations using the most specific takes precedence model. Future extensions to the model and optimizations to the implemented algorithm are proposed. Another aspect of this thesis is the application of above RBAC model in a distributed environment utilizing a remote authorization management system. A remote authorization mechanism is appropriate in many client-server systems where there is control over the resources at an intermediate communication stack or a middleware component enforces the access rules. In our client-server architecture, an authorization server uses an RBAC system to control access to resources under its domain, and the enforcement of access rules is provided by a security overlay on privileged resources. We address how our negative permissions and remote authorization schemes augment RBAC scalability. We provide the requisite abstraction through UML and architecture diagrams for implementation in other languages and systems. A comparison of this work to other related research done in the RBAC domain is carried out, and future work in this area is discussed.