Maverick Woo, Sang Kil, Cha Samantha et al. · 1988
Black-box mutational fuzzing is a simple yet effective tech-nique to find bugs in software. Given a set of program-seed pairs, we ask how to schedule the fuzzings of these pairs in order to maximize the number of unique bugs found at any point in time. We develop an analytic framework using a mathematical model of black-box mutational fuzzing and use it to evaluate 26 existing and new randomized online scheduling algorithms. Our experiments show that one of our new scheduling algorithms outperforms the multi-armed bandit algorithm in the current version of the CERT Basic Fuzzing Framework (BFF) by finding 1.5 × more unique bugs in the same amount of time.
Cited by 0
SpringerReference · 2011
Cited by 0
Todd Fitzgerald · Auerbach Publications eBooks · 2011
It’s everywhere. It’s saved blatantly on the desktop of a coworker’s unattended computer, just waiting to hop onto the next flash drive and head out of the company. It lingers just a click away, ready to be uploaded and e-mailed to a competing company. It lies nakedly on a manager’s desk, eager to be picked up by criminal hands. It lurks in an unsecured network drive, hoping to be discovered by someone with malicious intentions. It’s unstructured data and it’s demanding attention.
Cited by 0
Yan Zhu, Gail‐Joon Ahn, Hongxin Hu et al. · 2010
Even though role-based access control (RBAC) can tremendously help us minimize the complexity in administering users, it is still needed to realize the notion of roles at the resource level. In this paper, we propose a practical cryptographic RBAC model, called role-key hierarchy model, to support various security features including signature and encryption based on role-key hierarchy. With the help of rich algebraic structure of elliptic curve, we introduce a role-based cryptosystem construction to verify the rationality and validity of our proposed model. Also, a proof-of-concept prototype implementation and performance evaluation are discussed to demonstrate the feasibility and efficiency of our mechanisms.
Cited by 16
Yan Zhu, Gail‐Joon Ahn, Hongxin Hu et al. · 2010
Even though role-based access control (RBAC) can tremen-dously help us minimize the complexity in administering users, it is still needed to realize the notion of roles at the resource level. In this paper, we propose a practical cryp-tographic RBAC model, called role-key hierarchy model, to support various security features including signature and en-cryption based on role-key hierarchy. With the help of rich algebraic structure of elliptic curve, we introduce a role-based cryptosystem construction to verify the rationality and validity of our proposed model. Also, a proof-of-concept prototype implementation and performance evaluation are discussed to demonstrate the feasibility and efficiency of our mechanisms.
Cited by 0
Chirila, Sanda M. · Library and Archives Canada (Government of Canada) · 1997
Cited by 0
Steven A. Demurjian, Yejun He, T. C. Ting et al. · IFIP advances in information and communication technology · 2000
Cited by 4
S. A. Demurjian, Y. He, T. C. Ting et al. · 2008
In the age of information technology, organizations of all types are seeking to effectively utilize and disseminate information, by designing and developing dependable and secure distributed computing environments that allow existing and future systems to inter-operate. While many existing access control approaches (mandatory, discretionary, and role-based) can be leveraged for the support of security in distributed and web-based settings, their assumptions of a centralized computing model may be insufficient in a distributed setting. In recent years, agent computing has emerged as a new computing paradigm, particularly suited to distributed and web-based applications. This paper explores software agents, focusing on their ability to support role-based security in a dynamic, object-based setting which is suitable for distributed and web-based applications. The agent approaches differ in their utilization of agents (stationary and mobile) and the granularity level of the involved classes/objects. We also report on our prototyping efforts using aglets, a Java-based mobile agent model from IBM. 1.
Cited by 0
Jang, Dongsoo · ThinkTech (Texas Tech University) · 2017
Role-Based Access Control (RBAC) is a well-known access control security service that restricts access to valuable assets (or objects) using the roles in an organization. However, any security services, such as access control or cryptosystem, might be broken by attacks or inadvertences. Though a RBAC system is strongly designed against the attacks, it can be contaminated by attacks during the operation, or by careless implementation or maintenance. \nThis dissertation describes security failure-tolerant role-based access control (SRBAC) that tolerates the security breaches of RBAC by means of another access control security service, such as extended access control list (EACL). The threats to RBAC are analyzed to identify possible security breaches on an assumption that any security services might be always broken down. The security breaches caused by the threats to RBAC are tolerated with the EACL, which extends ACL. \nSRBAC is formalized using the set theory to clarify the access control entities (components) and their relationships. A prototype tool is developed to support and validate SRBAC that tolerates the security breaches of RBAC. A healthcare system is modeled with SRBAC to illustrate the proposed approach.
Cited by 0Open access
Akash Singh · 2012
We use symmetric keys to encrypt and decrypt attribute values. These keys are distributed only to the brokers that are trusted with the attribute values. The system will never deliver these keys to clients. This reduces the number of nodes that are trusted with sensitive keys, and that take part in key management protocols. This does not affect security since local brokers encrypt and decrypt attribute values on behalf of connected clients, and deliver events to clients over secure links. To support cryptographic properties such as key freshness, and forward and backward secrecy [22], the system requires key management service(s). A representation of quantified trust relationships, the trust dependency graph, and a sample QuanTM application specific to the KeyNote trust management language, are also proposed.
Cited by 4
Yolanta Beresnevichiene · CL Technical Reports · 2021
Security requirements approached at the enterprise level initiate the need for models that capture the organisational and distributed aspects of information usage. Such models have to express organisation-specific security policies and internal controls aiming to protect information against unauthorised access and modification, and against usage of information for unintended purposes. This technical report describes a systematic approach to modelling the security requirements from the perspective of job functions and tasks performed in an organisation. It deals with the design, analysis, and management of security abstractions and mechanisms in a unified framework. The basis of access control policy in this framework is formulated around a semantic construct of a role. Roles are granted permissions according to the job functions that exist in an organisation, and then users are assigned to roles on basis of their specific job responsibilities. In order to ensure that permissions included in the roles are used by users only for purposes corresponding to the organisation’s present business needs, a novel approach of “active” context-based access control is proposed. The usage of role permissions in this approach is controlled according to the emerging context associated with progress of various tasks in the organisation. The work explores formally the security properties of the established model, in particular, support for separation of duty and least privilege principles that are important requirements in many commercial systems. Results have implications for understanding different variations of separation of duty policy that are currently used in the role-based access control. Finally, a design architecture of the defined security model is presented detailing the components and processing phases required for successful application of the model to distributed computer environments. The model provides opportunities for the implementers, based on application requirements, to choose between several alternative design approaches.
Cited by 11Open access
I. Al-Ghonaim Mohammed, David M. Dilts · Computers & Security · 1994
Cited by 38
Giuri, L., Iglio, P, Fondazione Ugo Bordoni (FUB), Rome (Italy) · OpenGrey (Institut de l'Information Scientifique et Technique) · 1996
Cited by 0
D. S. Bhilare, A.K. Ramani, Sanjay Tanwani · 2009
Information Security has become a serious concern for academic institutions for their normal functioning. This paper proposes a metric based assurance plan, keeping in view the resource limitation of small institutions. Modular approach of the proposed solution allows institutions to switch to higher version as they grow and augment more resources. Organization structure necessary to monitor the proposed plan is also proposed with non traditional roles and their job description. For every control an appropriate role is identified and associated with that metric. This modular & responsibility driven approach will ensure that a basic minimum protection plan is in place and overall security monitoring and control is also improved.
Cited by 5
M. Liebrand, Henry Ellis, Charles E. Phillips et al. · IFIP advances in information and communication technology · 2003
Cited by 12Open access
Gao, Fan. (12387619) · INDIGO (University of Illinois at Chicago) · 2022
This thesis was scanned from the print manuscript for digital preservation and is copyright the author.\n Researchers can access this thesis by asking their local university, institution or public library to\n make a request on their behalf. Monash staff and postgraduate students can use the link in the References field.
Cited by 0Open access
Luigi Logrippo · Journal of Information Security and Applications · 2025
• By using efficient algorithms it is possible to explore the data flows enabled by RBAC systems, with various combinations of subjects and roles assigned to subjects. • Given RBAC configurations, it is possible to determine what are the levels of secrecy (or confidentiality) and integrity of the subjects and objects involved. • Different models of access control and data flow control, such as access control matrices, multi-level or label-based access control and RBAC are mutually translatable. • The effects of RBAC role reconfigurations on secrecy and integrity can be evaluated. We show how data security concepts such as data flow, secrecy (or confidentiality) and integrity can be defined for RBAC, Role-Based Access Control. In contrast to the prevailing literature that uses a lattice model to express such concepts, we demonstrate the use of a partial order model that is more general. This is done by using the concepts of “partial order of equivalence classes” and of “security labels” that can be associated with RBAC subjects and objects and determine their mutual data flows, as well as their secrecy and integrity properties. Our model allows to reason on RBAC configurations with different assignments of roles to subjects. On the converse, we demonstrate a method for obtaining RBAC configurations from data security requirements or security label assignments. These results are supported by a proof showing that three methods for defining data flow: by access control matrices or lists, by labels and by roles, are equivalent and mutually convertible by efficient algorithms. We show how RBAC state changes, or “reconfigurations” can be defined in this framework, and what are the effects of elementary reconfigurations on data flow, secrecy and integrity of data.
Cited by 0Open access
Matunda Nyanchama, Sylvia Osborn · 2007
This paper examines the application of information flow analysis to rolebased protection systems. Starting with basic information flow axioms and a security policy, we propose a means of ensuring that a given role-based scheme is consistent with the specified security policy. The proposed method uses graph theory and, in particular, treats this problem as an instance of subgraph isomorphism to determine the consistency of a role-based scheme with a given security policy. Keywords: Security policy, information flow, role, role-based protection, subgraph isomorphism. 1 Introduction Role-based security is a flexible means of managing large numbers of access rights. A role is a named collection of privileges [2, 14, 21] where a privilege is a unit of access to system information. User-role authorization grants the user access to the privileges defined in the role. 1 This work was supported in part by a grant from the Natural Science & Engineering Research Council of Canada. 1369 Rol...
Cited by 0
Emre Uzun, Vijayalakshmi Atluri, Jaideep Vaidya et al. · Journal of Computer Security · 2014
Providing restrictive and secure access to resources is a challenging and socially important problem. Among the many formal security models, Role Based Access Control (RBAC) has become the norm in many of today's organizations for enforcing security. For every model, it is necessary to analyze and prove that the corresponding system is secure. Such analysis helps understand the implications of security policies and helps organizations gain confidence on the control they have on resources while providing access, and devise and maintain policies. In this paper, we consider security analysis for the Temporal RBAC (TRBAC), one of the extensions of RBAC. The TRBAC considered in this paper allows temporal restrictions on roles themselves, user-permission assignments (UA), permission-role assignments (PA), as well as role hierarchies (RH). Towards this end, we first propose a suitable administrative model that governs changes to temporal policies. Then we propose our security analysis strategy, that essentially decomposes the temporal security analysis problem into smaller and more manageable RBAC security analysis sub-problems for which the existing RBAC security analysis tools can be employed. We then evaluate them from a practical perspective by evaluating their performance using simulated data sets.
Cited by 19
Gui Yan · 2003
A role-based access control model is analyzed and the related concepts are defined. The implemented model and algorithms are presented. A new feasible security solution is provided for the problems existing in the authentication and authorization on web application. As a result, a web security management system is implemented by using the role-based access control model. The system has sound, stable and valid performances of application in real environments.
Cited by 4