Search

The main question addressed in this work is how the specification, deployment and management of application-oriented access control policies in distributed object systems can be supported in a way that increases the overall security. The first chapters of this thesis examine the problems that need to be addressed and identify a number of requirements for manageable access control. The overall management task is analyzed and structured into subtasks that are performed by potentially separate managers: principals or credentials management, object and domain management, and policy management. Also, the tasks of policy deployment and development are examined. As a result, we identify the requirements for documentation, support for communication between the involved parties, and for suitable management abstractions. It is concluded that an integrated approach to secure software development and management is required and that it can best be supported by the definition of a declarative policy language. Looking at the current technology for CORBA security reveals conceptual scalability problems and lack of structured support for policy design. Therefore, this thesis proposes a new view-based access model and a declarative specification language called view policy language (VPL). The abstractions of this language are designed to support deployment and development as well as management of application policies. The central concepts of VPL are views as a first-class concept for the type-safe aggregation of access rights, roles as a task-oriented abstraction of callers, and schemas as a means of specifying triggered dynamic changes in the protection state. To prove the practical relevance of these concepts, a comprehensive case study is analyzed and implemented. The technical feasibility of view-based access control is shown through an implementation of the required security infrastructure, which includes an interceptor-based access control mechanism, a language compiler, view and role repositories, and graphical management tools., Das zentrale Thema dieser Arbeit ist eine geeignete Unterstützung für die Spezifikation, die Installation und das Management von Zugriffsschutzpolitiken. Eine solche Unterstützung erhöht die Gesamtsicherheit eines verteilten Objektsystems, indem zum einen der flexible Ausdruck von Sicherheitsanforderungen erleichtert und zum anderen gleichzeitig eine grosse Zahl möglicher Fehlerquellen ausgeschlossen wird. Die Arbeit untersucht zunächst Anforderungen an handhabbaren Zugriffsschutz. Die Aufgabe des Zugriffsschutzmanagements wird analysiert und in Unteraufgaben gegliedert, die von verschiedenen, möglicherweise getrennten Managern wahrgenommen werden, nämlich die Verwaltung von Principals und Zertifikaten, von Objekten und Domänen, sowie die Politikverwaltung selbst. Darüberhinaus wurden auch die Aufgaben der Politikinstallation und -entwicklung betrachtet. Aus der Analyse der Anforderungen an die Dokumentation, die Unterstützung der Kommunikation zwischen den Beteiligten und die benötigten Sprachkonzepte ergibt sich, dass ein integrierter Ansatz für die Entwicklung und das Management von Zugriffsschutzpolitiken am besten durch die Definition einer deklarativen Politiksprache unterstützt werden kann. Der Beitrag dieser Arbeit besteht in einem neuen, sichtenbasierten Zugriffsschutzmodell und einer deklarative Politiksprache namens View Policy Language (VPL), das den genannten Anforderungen genügt. Die Abstraktionen dieser Sprache wurden speziell für die Unterstützung sowohl des Entwurfs wie der Installation und des Managements von Politiken entworfen. Die zentralen Sprachkonzepte von VPL sind Sichten als ein first-class Konzept für die typsichere Aggregation von Zugriffsrechten, Rollen als aufgabenorientierte Abstraktion von Aufrufern, sowie Schemata als Mittel zur Spezifikation automatisch ausgelöster, dynamischer Änderungen des Schutzzustandes. Die praktische Relevanz dieser Konzepte wurde durch die Implementierung einer realistischen Fallstudie gezeigt. Das Beispiel zeigt die Verwendung von Rollen, Sichten, Schemata, negativen Rechten und bedingten Sichten im Kontext eines Systems zur Begutachtung eingereichter Konferenzbeiträge. Die technische Machbarkeit sichtenbasierten Zugriffsschutzes wurde durch die Implementierung der erforderlichen Sicherheitsinfrastruktur nachgewiesen, die einen Interceptor-basierten Zugriffsschutzmechanismus, einen VPL-Übersetzer, Sichten- und Rollenrepositories sowie graphische Managementwerkzeuge umfasst.

The advent of multipoint (multicast-based) applications and the growth and complexity of the Internet has complicated network protocol design and evaluation. In this paper, we present a method for automatic synthesis of worst and best case scenarios for multipoint protocol performance evaluation. Our method uses a fault-oriented test generation (FOTG) algorithm for searching the protocol and system state space to synthesize these scenarios. The algorithm is based on a global finite state machine (FSM) model. We extend the algorithm with timing semantics to handle end-to-end delays and address performance criteria. We introduce the notion of a virtual LAN to represent delays of the underlying multicast distribution tree. As a case study, we use our method to evaluate variants of the timer suppression mechanism, used in various multipoint protocols, with respect to two performance criteria: overhead of response messages and response time. Simulation results for reliable multicast protocols show that our method provides a scalable way for synthesizing worst-case scenarios automatically. We expect our method to serve as a model for applying systematic scenario generation to other multipoint protocols., 23 pages, 12 figures

0 Title 1 0 Contents 3 0 Introduction 5 0.1 Overview 8 0.2 Sources 9 0.3 Acknowledgements 10 1 Preparation 11 1.1 kappa-embeddings 11 1.2 kappa-filtrations 13 1.3 Universal properties 15 1.4 The kappa-Freese-Nation property 18 2 On Tightly kappa-Filtered Boolean Algebras 25 2.1 The number of tightly sigma-filtered Boolean algebras 25 2.2 Characterizations of tight kappa-filteredness 30 2.3 Stone spaces of tightly kappa-filtered Boolean algebras 35 2.4 rc-filtered, but not tightly kappa-filtered 37 2.5 Complete Boolean algebras and tight sigma-filtrations 42 3 The Weak Freese-Nation Property 53 3.1 WFN(P(omega)) in forcing extensions 53 3.2 WFN(P(omega)) and cardinal invariants 80 3.3 More complete Boolean algebras with the WFN 86 Bibliography 92, Abstract We study kappa-filtered and tightly kappa-filtered Boolean algebras for infinite regular cardinals kappa. Tight kappa-filteredness is a generalization of projectivity. kappa-filteredness is equivalent to the socalled kappa- Freese-Nation property (kappa-FN). In the case kappa=aleph_1 these properties are called sigma-filteredness, respectively tight sigma-filteredness. The aleph_1-FN is also called weak Freese-Nation property (WFN). In chapter 1 the basic notions are introduced. Chapter 2 is devoted to tightly kappa-filtered Boolean algebras. We show that there are 2^lambda isomorphism types of tightly sigma-filtered Boolean algebras of size lambda for every infinite cardinal lambda. We give charcterizations of tightly kappa-filtered Boolean algebras. Some results on Stone spaces of projective Boolean algebras are generalized. For every infinite regular cardinal kappa we construct an aleph_0-filtered Boolean algebra, which is not tightly kappa-filtered. We show that P(omega) is not tightly sigma-filtered in the Cohen model for 2^aleph_0=aleph_3. Note that P(omega) is sigma-filtered in that model. We show that no complete Boolean algebra with more than (2^aleph_0)^+ elements is tightly sigma-filtered. In chapter 3 we discuss the WFN. We show that P(omega) fails to have the WFN in many models of set theory obtained by iterated forcing. We then study the cardinal invariants of the continuum under the assumption that P(omega) has the WFN. It turns out that the invariants under consideration have the same values as in a Cohen model with the same size of the continuum. Finally we show that the WFN of P(omega) implies the WFN of many more complete c.c.c. Boolean algebras., Die Arbeit befasst sich mit kappa-filtrierten sowie mit eng kappa-filtrierten Booleschen Algebren, wobei kappa eine unendliche reguläre Kardinalzahl ist. Enge kappa-Filtriertheit verallgemeinert Projektivität. kappa-Filtriertheit ist äquivalent zur sogenannten kappa-Freese-Nation-Eigenschaft (kappa-FN). Im Fall kappa=aleph_1 spricht man von sigma-Filtriertheit bzw. enger sigma- Filtriertheit. Die aleph_1-FN wird auch als schwache Freese-Nation-Eigenschaft (WFN) bezeichnet. Nach Einführung der grundlegenden Begriffe im ersten Kapitel, werden im zweiten Kapitel eng kappa-filtrierte Boolesche Algebren untersucht. Zunächst wird gezeigt, dass es für jede unendliche Kardinalzahl lambda 2^lambda Isomorphietypen eng sigma-filtrierter Boolescher Algebren der Mächtigkeit lambda gibt. Anschließend werden verschiedene Charakterisierungen eng kappa- filtrierter Boolescher Algebren gegeben und gewisse Resultate über Stone-Räume projektiver Algebren verallgemeinert. F&uumlr; jedes unendliche reguläre kappa wird eine aleph_0-filtrierte Boolesche Algebra konstruiert, die nicht eng kappa-filtriert ist. Es wird gezeigt, dass P(omega) im Cohen-Modell für 2^aleph_0=aleph_3 zwar sigma-filtriert, aber nicht eng sigma-filtriert ist und dass keine vollständige Boolesche Algebra mit mehr als (2^aleph_0)^+ Elementen eng sigma-filtriert ist. Im dritten Kapitel wird die WFN diskutiert. Es wird gezeigt, dass P(omega) in sehr vielen Modellen, die durch iteriertes Forcing gewonnen wurden, nicht die WFN hat. Anschließend werden Kardinalzahlinvarianten des Kontinuums unter der Annahme, dass P(omega) die WFN hat, studiert. Es stellt sich heraus, dass alle untersuchten Invarianten die gleichen Werte haben, wie in einem Cohen-Modell mit derselben Größe des Kontinuums. Schließlich wird gezeigt, dass die WFN von P(omega) die WFN vieler weiterer vollständiger c.c.c. Boolescher Algebren impliziert.

Network firewalls and routers use a rule database to decide which packets will be allowed from one network onto another. By filtering packets the firewalls and routers can improve security and performance. However, as the size of the rule list increases, it becomes difficult to maintain and validate the rules, and lookup latency may increase significantly. Ordered binary decision diagrams (BDDs) - a compact method of representing and manipulating boolean expressions - are a potential method of representing the rules. This paper presents a new algorithm for representing such lists as a BDD and then shows how the resulting boolean expression can be used to analyse rule sets., Comment: 12 pages; revised and shortened version appeared in Workshop on Dependable IP Systems and Platforms, In Proc ICDSN, June 2000

In an Ideal Shortest Path Algorithm (ISPA), at each moment each router in a network sends all of its traffic down the path that will incur the lowest cost to that traffic. In the limit of an infinitesimally small amount of traffic for a particular router, its routing that traffic via an ISPA is optimal, as far as cost incurred by that traffic is concerned. We demonstrate though that in many cases, due to the side-effects of one router's actions on another routers performance, having routers use ISPA's is suboptimal as far as global aggregate cost is concerned, even when only used to route infinitesimally small amounts of traffic. As a particular example of this we present an instance of Braess' paradox for ISPA's, in which adding new links to a network decreases overall throughput. We also demonstrate that load-balancing, in which the routing decisions are made to optimize the global cost incurred by all traffic currently being routed, is suboptimal as far as global cost averaged across time is concerned. This is also due to "side-effects", in this case of current routing decision on future traffic. The theory of COllective INtelligence (COIN) is concerned precisely with the issue of avoiding such deleterious side-effects. We present key concepts from that theory and use them to derive an idealized algorithm whose performance is better than that of the ISPA, even in the infinitesimal limit. We present experiments verifying this, and also showing that a machine-learning-based version of this COIN algorithm in which costs are only imprecisely estimated (a version potentially applicable in the real world) also outperforms the ISPA, despite having access to less information than does the ISPA. In particular, this COIN algorithm avoids Braess' paradox., 28 pages

Mobile code presents a number of threats to machines that execute it. We introduce an approach for protecting machines and the resources they hold from mobile code, and describe a system based on our approach for protecting host machines from Java 1.1 applets. In our approach, each Java applet downloaded to the protected domain is rerouted to a dedicated machine (or set of machines), the {\em playground}, at which it is executed. Prior to execution the applet is transformed to use the downloading user's web browser as a graphics terminal for its input and output, and so the user has the illusion that the applet is running on her own machine. In reality, however, mobile code runs only in the sanitized environment of the playground, where user files cannot be mounted and from which only limited network connections are accepted by machines in the protected domain. Our playground thus provides a second level of defense against mobile code that circumvents language-based defenses. The paper presents the design and implementation of a playground for Java 1.1 applets, and discusses extensions of it for other forms of mobile code including Java 1.2., preprint of a paper to appear in IEEE Transactions on Software Engineering

We study how to efficiently diffuse updates to a large distributed system of data replicas, some of which may exhibit arbitrary (Byzantine) failures. We assume that strictly fewer than $t$ replicas fail, and that each update is initially received by at least $t$ correct replicas. The goal is to diffuse each update to all correct replicas while ensuring that correct replicas accept no updates generated spuriously by faulty replicas. To achieve reliable diffusion, each correct replica accepts an update only after receiving it from at least $t$ others. We provide the first analysis of epidemic-style protocols for such environments. This analysis is fundamentally different from known analyses for the benign case due to our treatment of fully Byzantine failures---which, among other things, precludes the use of digital signatures for authenticating forwarded updates. We propose two epidemic-style diffusion algorithms and two measures that characterize the efficiency of diffusion algorithms in general. We characterize both of our algorithms according to these measures, and also prove lower bounds with regards to these measures that show that our algorithms are close to optimal.

This paper describes an architecture for a distributing processing system that would allow remote procedure calls to invoke other services as messages are passed between clients and servers. It proposes that an additional class of data processing objects be located in the software communications channel. The objects in this channel would then be used to enforce protocols on client-server applications without any additional effort by the application programmers. For example, services such as key-management, time-stamping, sequencing and encryption can be implemented at different levels of the software communications stack to provide a complete authentication service. A distributing processing environment could be used to control broadband network data delivery. Architectures and invocation semantics are discussed, Example classes and interfaces for channel objects are given in the Java programming language., 35 pages, 10 figures

This paper provides a proof of the proposed Internet standard Transport Level Security protocol using the Gong-Needham-Yahalom logic. It is intended as a teaching aid and hopes to show to students: the potency of a formal method for protocol design; some of the subtleties of authenticating parties on a network where all messages can be intercepted; the design of what should be a widely accepted standard., Comment: 22 pages, 2 figures, 1 appendix

Adaptivity, both of the individual agents and of the interaction structure among the agents, seems indispensable for scaling up multi-agent systems (MAS s) in noisy environments. One important consideration in designing adaptive agents is choosing their action spaces to be as amenable as possible to machine learning techniques, especially to reinforcement learning (RL) techniques. One important way to have the interaction structure connecting agents itself be adaptive is to have the intentions and/or actions of the agents be in the input spaces of the other agents, much as in Stackelberg games. We consider both kinds of adaptivity in the design of a MAS to control network packet routing. We demonstrate on the OPNET event-driven network simulator the perhaps surprising fact that simply changing the action space of the agents to be better suited to RL can result in very large improvements in their potential performance: at their best settings, our learning-amenable router agents achieve throughputs up to three and one half times better than that of the standard Bellman-Ford routing algorithm, even when the Bellman-Ford protocol traffic is maintained. We then demonstrate that much of that potential improvement can be realized by having the agents learn their settings when the agent interaction structure is itself adaptive.

A secure reliable multicast protocol enables a process to send a message to a group of recipients such that all correct destinations receive the same message, despite the malicious efforts of fewer than a third of the total number of processes, including the sender. This has been sh own to be a useful tool in building secure distributed services, albeit with a cost that typically grows linearly with the size of the system. For very large networks, for which this is prohibitive, we present two approaches for reducing the cost: First, we show a protocol whose cost is on the order of the number of tolerated failures. Secondly, we show how relaxing the consistency requirement to a probabilistic guarantee can reduce the associated cost, effectively to a constant., Comment: preprint of a paper to appear in the Distributed Computing Journal

The Cross-Industry Working Team (XIWT), with the support of the Stanford University Consortium for Research on Information Security and Policy (CRISP), sponsored a symposium on cross-industry activities aimed at improving the reliability, dependability, and robustness of the information infrastructure. Held 3-4 November 1998 in Crystal City, Virginia, the symposium engaged representatives from industry, academia, and government in discussion of current and potential cross-industry, cross-sector activities including information exchange, collaborative operations, and cooperative research and development. This proceedings summarizes the discussions and results of the meeting.

A security policy states the acceptable actions of an information system, as the actions bear on security. There is a pressing need for organizations to declare their security policies, even informal statements would be better than the current practice. But, formal policy statements are preferable to support (1) reasoning about policies, e.g., for consistency and completeness, (2) automated enforcement of the policy, e.g., using wrappers around legacy systems or after the fact with an intrusion detection system, and (3) other formal manipulation of policies, e.g., the composition of policies. We present LaSCO, the Language for Security Constraints on Objects, in which a policy consists of two parts: the domain (assumptions about the system) and the requirement (what is allowed assuming the domain is satisfied). Thus policies defined in LaSCO have the appearance of conditional access control statements. LaSCO policies are specified as expressions in logic and as directed graphs, giving a visual view of policy. LaSCO has a simple semantics in first order logic (which we provide), thus permitting policies we write, even for complex policies, to be very perspicuous. LaSCO has syntax to express many of the situations we have found to be useful on policies or, more interesting, the composition of policies. LaSCO has an object-oriented structure, permitting it to be useful to describe policies on the objects and methods of an application written in an object-oriented language, in addition to the traditional policies on operating system objects. A LaSCO specification can be automatically translated into executable code that checks an invocation of a program with respect to a policy. The implementation of LaSCO is in Java, and generates wrappers to check Java programs with respect to a policy., 28 pages, 22 figures, in color (but color is not essential for viewing); UC Davis CS department technical report (July 22, 1998)

We investigate, in the Shannon model, the security of constructions corresponding to double and (two-key) triple DES. That is, we consider F_{k1}(F_{k2}(.)) and F_{k1}(F_{k2}^{-1}(F_{k1}(.))) with the component functions being ideal ciphers. This models the resistance of these constructions to ``generic'' attacks like meet in the middle attacks. We obtain the first proof that composition actually increases the security of these constructions in some meaningful sense. We compute a bound on the probability of breaking the double cipher as a function of the number of computations of the base cipher made, and the number of examples of the composed cipher seen, and show that the success probability is the square of that for a single key cipher. The same bound holds for the two-key triple cipher. The first bound is tight and shows that meet in the middle is the best possible generic attack against the double cipher., Comment: An extended abstract of this paper appeared in the proceedings of Crypto 98 conference (Springer Verlag LNCS Vol 1462, 1998). This is the full version

In the on-line file-caching problem problem, the input is a sequence of requests for files, given on-line (one at a time). Each file has a non-negative size and a non-negative retrieval cost. The problem is to decide which files to keep in a fixed-size cache so as to minimize the sum of the retrieval costs for files that are not in the cache when requested. The problem arises in web caching by browsers and by proxies. This paper describes a natural generalization of LRU called Landlord and gives an analysis showing that it has an optimal performance guarantee (among deterministic on-line algorithms). The paper also gives an analysis of the algorithm in a so-called ``loosely'' competitive model, showing that on a ``typical'' cache size, either the performance guarantee is O(1) or the total retrieval cost is insignificant., ACM-SIAM Symposium on Discrete Algorithms (1998)

Some anonymity schemes might in principle protect users from pervasive network surveillance - but only if all messages are independent and unlinkable. Users in practice often need pseudonymity - sending messages intentionally linkable to each other but not to the sender - but pseudonymity in dynamic networks exposes users to intersection attacks. We present Buddies, the first systematic design for intersection attack resistance in practical anonymity systems. Buddies groups users dynamically into buddy sets, controlling message transmission to make buddies within a set behaviorally indistinguishable under traffic analysis. To manage the inevitable tradeoffs between anonymity guarantees and communication responsiveness, Buddies enables users to select independent attack mitigation policies for each pseudonym. Using trace-based simulations and a working prototype, we find that Buddies can guarantee non-trivial anonymity set sizes in realistic chat/microblogging scenarios, for both short-lived and long-lived pseudonyms., Comment: 15 pages, 8 figures