首页 > 最新文献

Cloud Computing Security Workshop最新文献

英文 中文
HengHa: data harvesting detection on hidden databases 恒哈:对隐藏数据库的数据采集检测
Pub Date : 2010-10-08 DOI: 10.1145/1866835.1866847
Shiyuan Wang, D. Agrawal, A. E. Abbadi
The back-end databases of web-based applications are a major data security concern to enterprises. The problem becomes more critical with the proliferation of enterprise hosted web applications in the cloud. While prior work has concentrated on malicious attacks that try to break into the database using vulnerabilities of web applications, little work has focused on the threat of data harvesting through web form interfaces, in which large collections of the underlying data can be harvested and sensitive information can be learnt by iteratively submitting legitimate queries and analyzing the returned results for designing new queries. To defend against data harvesting without compromising usability, we consider a detection approach. We summarize the characteristics of data harvesting, and propose the notions of query correlation and result coverage for data harvesting detection. We design a detection system called HengHa, in which Heng examines the correlation among queries in a session, and Ha evaluates the data coverage of the results of queries in the same session. The experimental results verify the effectiveness and efficiency of HengHa for data harvesting detection.
基于web的应用程序的后端数据库是企业关注的主要数据安全问题。随着云中企业托管web应用程序的激增,这个问题变得更加关键。虽然之前的工作主要集中在恶意攻击,试图利用web应用程序的漏洞进入数据库,很少有工作集中在通过web表单接口收集数据的威胁,其中可以收集大量底层数据,并通过迭代提交合法查询和分析返回结果来学习敏感信息,以设计新的查询。为了防止数据收集而不影响可用性,我们考虑了一种检测方法。总结了数据采集的特点,提出了数据采集检测中查询相关性和结果覆盖率的概念。我们设计了一个名为HengHa的检测系统,其中Heng检查会话中查询之间的相关性,Ha评估同一会话中查询结果的数据覆盖率。实验结果验证了恒哈算法在数据采集检测中的有效性和高效性。
{"title":"HengHa: data harvesting detection on hidden databases","authors":"Shiyuan Wang, D. Agrawal, A. E. Abbadi","doi":"10.1145/1866835.1866847","DOIUrl":"https://doi.org/10.1145/1866835.1866847","url":null,"abstract":"The back-end databases of web-based applications are a major data security concern to enterprises. The problem becomes more critical with the proliferation of enterprise hosted web applications in the cloud. While prior work has concentrated on malicious attacks that try to break into the database using vulnerabilities of web applications, little work has focused on the threat of data harvesting through web form interfaces, in which large collections of the underlying data can be harvested and sensitive information can be learnt by iteratively submitting legitimate queries and analyzing the returned results for designing new queries. To defend against data harvesting without compromising usability, we consider a detection approach. We summarize the characteristics of data harvesting, and propose the notions of query correlation and result coverage for data harvesting detection. We design a detection system called HengHa, in which Heng examines the correlation among queries in a session, and Ha evaluates the data coverage of the results of queries in the same session. The experimental results verify the effectiveness and efficiency of HengHa for data harvesting detection.","PeriodicalId":300613,"journal":{"name":"Cloud Computing Security Workshop","volume":"8 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2010-10-08","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131611738","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 10
First principles vulnerability assessment 第一原则脆弱性评估
Pub Date : 2010-10-08 DOI: 10.1145/1866835.1866852
J. Kupsch, B. Miller, E. Heymann, Eduardo César
Clouds and Grids offer significant challenges to providing secure infrastructure software. As part of a our effort to secure such middleware, we present First Principles Vulnerability Assessment (FPVA), a new analyst-centric (manual) technique that aims to focus the analyst's attention on the parts of the software system and its resources that are most likely to contain vulnerabilities that would provide access to high-value assets. FPVA finds new threats to a system and is not dependent on a list of known threats. Manual assessment is labor-intensive, making the use of automated assessment tools quite attractive. We compared the results of FPVA to those of the top commercial tools, providing the first significant evaluation of these tools against a real-world known collection of serious vulnerabilities. While these tools can find common problems in a program's source code, they miss a significant number of serious vulnerabilities found by FPVA. We are now using the results of this comparison study to guide our future research into improving automated software assessment.
云和网格为提供安全的基础设施软件带来了重大挑战。作为我们努力确保中间件安全的一部分,我们提出了第一原则漏洞评估(FPVA),这是一种新的以分析人员为中心的(手动)技术,旨在将分析人员的注意力集中在软件系统及其资源中最有可能包含漏洞的部分,这些漏洞将提供对高价值资产的访问。FPVA发现对系统的新威胁,而不依赖于已知威胁的列表。手动评估是劳动密集型的,使得使用自动评估工具非常有吸引力。我们将FPVA的结果与顶级商业工具的结果进行了比较,针对现实世界中已知的严重漏洞集合,对这些工具进行了首次重要的评估。虽然这些工具可以发现程序源代码中的常见问题,但它们错过了FPVA发现的大量严重漏洞。我们现在正在使用这个比较研究的结果来指导我们未来对改进自动化软件评估的研究。
{"title":"First principles vulnerability assessment","authors":"J. Kupsch, B. Miller, E. Heymann, Eduardo César","doi":"10.1145/1866835.1866852","DOIUrl":"https://doi.org/10.1145/1866835.1866852","url":null,"abstract":"Clouds and Grids offer significant challenges to providing secure infrastructure software. As part of a our effort to secure such middleware, we present First Principles Vulnerability Assessment (FPVA), a new analyst-centric (manual) technique that aims to focus the analyst's attention on the parts of the software system and its resources that are most likely to contain vulnerabilities that would provide access to high-value assets. FPVA finds new threats to a system and is not dependent on a list of known threats.\u0000 Manual assessment is labor-intensive, making the use of automated assessment tools quite attractive. We compared the results of FPVA to those of the top commercial tools, providing the first significant evaluation of these tools against a real-world known collection of serious vulnerabilities. While these tools can find common problems in a program's source code, they miss a significant number of serious vulnerabilities found by FPVA. We are now using the results of this comparison study to guide our future research into improving automated software assessment.","PeriodicalId":300613,"journal":{"name":"Cloud Computing Security Workshop","volume":"134 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2010-10-08","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127549494","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 26
Seeding clouds with trust anchors 用信任的锚播种云
Pub Date : 2010-10-08 DOI: 10.1145/1866835.1866843
Joshua Schiffman, Thomas Moyer, H. Vijayakumar, T. Jaeger, P. Mcdaniel
Customers with security-critical data processing needs are beginning to push back strongly against using cloud computing. Cloud vendors run their computations upon cloud provided VM systems, but customers are worried such host systems may not be able to protect themselves from attack, ensure isolation of customer processing, or load customer processing correctly. To provide assurance of data processing protection in clouds to customers, we advocate methods to improve cloud transparency using hardware-based attestation mechanisms. We find that the centralized management of cloud data centers is ideal for attestation frameworks, enabling the development of a practical approach for customers to trust in the cloud platform. Specifically, we propose a cloud verifier service that generates integrity proofs for customers to verify the integrity and access control enforcement abilities of the cloud platform that protect the integrity of customer's application VMs in IaaS clouds. While a cloud-wide verifier service could present a significant system bottleneck, we demonstrate that aggregating proofs enables significant overhead reductions. As a result, transparency of data security protection can be verified at cloud-scale.
有安全关键数据处理需求的客户开始强烈反对使用云计算。云供应商在云提供的VM系统上运行他们的计算,但客户担心这样的主机系统可能无法保护自己免受攻击,无法确保客户处理的隔离,或者无法正确加载客户处理。为了向客户提供云中的数据处理保护保证,我们提倡使用基于硬件的认证机制来提高云透明度的方法。我们发现,云数据中心的集中管理对于认证框架来说是理想的,这使得开发一种实用的方法能够让客户信任云平台。具体而言,我们提出了一种云验证服务,该服务为客户生成完整性证明,以验证云平台的完整性和访问控制执行能力,从而保护IaaS云中客户应用程序vm的完整性。虽然云范围的验证器服务可能会带来严重的系统瓶颈,但我们证明了聚合证明可以显著减少开销。因此,可以在云规模上验证数据安全保护的透明度。
{"title":"Seeding clouds with trust anchors","authors":"Joshua Schiffman, Thomas Moyer, H. Vijayakumar, T. Jaeger, P. Mcdaniel","doi":"10.1145/1866835.1866843","DOIUrl":"https://doi.org/10.1145/1866835.1866843","url":null,"abstract":"Customers with security-critical data processing needs are beginning to push back strongly against using cloud computing. Cloud vendors run their computations upon cloud provided VM systems, but customers are worried such host systems may not be able to protect themselves from attack, ensure isolation of customer processing, or load customer processing correctly. To provide assurance of data processing protection in clouds to customers, we advocate methods to improve cloud transparency using hardware-based attestation mechanisms. We find that the centralized management of cloud data centers is ideal for attestation frameworks, enabling the development of a practical approach for customers to trust in the cloud platform. Specifically, we propose a cloud verifier service that generates integrity proofs for customers to verify the integrity and access control enforcement abilities of the cloud platform that protect the integrity of customer's application VMs in IaaS clouds. While a cloud-wide verifier service could present a significant system bottleneck, we demonstrate that aggregating proofs enables significant overhead reductions. As a result, transparency of data security protection can be verified at cloud-scale.","PeriodicalId":300613,"journal":{"name":"Cloud Computing Security Workshop","volume":"27 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2010-10-08","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121189859","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 124
Content oriented virtual domains for secure information sharing across organizations 面向内容的虚拟域,用于跨组织的安全信息共享
Pub Date : 2010-10-08 DOI: 10.1145/1866835.1866838
Takayuki Sasaki, Masayuki Nakae, Ryuichi Ogawa
Secure information sharing across different organizations is an emerging issue for collaborative software development, product design, etc. Virtual domains have been proposed for this issue so far. A virtual domain is a collaborative workspace comprising virtual computer resources dedicated to a particular collaborative activity, and it is subject to information sharing policies that restrict the scope of information sharing within the domain. This paper proposes a method of constructing Content Oriented Virtual Domains, which leverages existing common services such as e-mail, Web, and file servers, therefore enabling us to construct a secure collaborative workspace at lower cost than existing methods that require such services to be reconstructed in the same domain. This paper also shows an experimental implementation of the method and its performance evaluation results.
跨不同组织的安全信息共享是协作软件开发、产品设计等领域的一个新兴问题。到目前为止,针对这个问题已经提出了虚拟域。虚拟域是一个协作工作空间,包含专用于特定协作活动的虚拟计算机资源,并且受信息共享策略的约束,该策略限制了域中信息共享的范围。本文提出了一种构建面向内容的虚拟域的方法,该方法利用了现有的公共服务,如电子邮件、Web和文件服务器,因此使我们能够以较低的成本构建一个安全的协作工作空间,而现有的方法需要在同一域中重构这些服务。最后给出了该方法的实验实现和性能评价结果。
{"title":"Content oriented virtual domains for secure information sharing across organizations","authors":"Takayuki Sasaki, Masayuki Nakae, Ryuichi Ogawa","doi":"10.1145/1866835.1866838","DOIUrl":"https://doi.org/10.1145/1866835.1866838","url":null,"abstract":"Secure information sharing across different organizations is an emerging issue for collaborative software development, product design, etc. Virtual domains have been proposed for this issue so far. A virtual domain is a collaborative workspace comprising virtual computer resources dedicated to a particular collaborative activity, and it is subject to information sharing policies that restrict the scope of information sharing within the domain.\u0000 This paper proposes a method of constructing Content Oriented Virtual Domains, which leverages existing common services such as e-mail, Web, and file servers, therefore enabling us to construct a secure collaborative workspace at lower cost than existing methods that require such services to be reconstructed in the same domain. This paper also shows an experimental implementation of the method and its performance evaluation results.","PeriodicalId":300613,"journal":{"name":"Cloud Computing Security Workshop","volume":"21 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2010-10-08","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126265522","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 7
Authentication in the clouds: a framework and its application to mobile users 云中的身份验证:一个框架及其在移动用户中的应用
Pub Date : 2010-10-08 DOI: 10.1145/1866835.1866837
Richard Chow, M. Jakobsson, R. Masuoka, J. Molina, Yuan Niu, E. Shi, Z. Song
Cloud computing is a natural fit for mobile security. Typical handsets have input constraints and practical computational and power limitations, which must be respected by mobile security technologies in order to be effective. We describe how cloud computing can address these issues. Our approach is based on a flexible framework for supporting authentication decisions we call TrustCube (to manage the authentication infrastructure) and on a behavioral authentication approach referred to as implicit authentication (to translate user behavior into authentication scores). The combination results in a new authentication paradigm for users of mobile technologies, one where an appropriate balance between usability and trust can be managed through flexible policies and dynamic tuning.
云计算是移动安全的天然选择。典型的手机有输入限制和实际的计算和功率限制,必须尊重移动安全技术,以便有效。我们将描述云计算如何解决这些问题。我们的方法基于一个灵活的框架,用于支持我们称为TrustCube的身份验证决策(用于管理身份验证基础设施),以及一种称为隐式身份验证的行为身份验证方法(将用户行为转换为身份验证分数)。这种组合为移动技术用户提供了一种新的身份验证范式,在这种范式中,可以通过灵活的策略和动态调优来管理可用性和信任之间的适当平衡。
{"title":"Authentication in the clouds: a framework and its application to mobile users","authors":"Richard Chow, M. Jakobsson, R. Masuoka, J. Molina, Yuan Niu, E. Shi, Z. Song","doi":"10.1145/1866835.1866837","DOIUrl":"https://doi.org/10.1145/1866835.1866837","url":null,"abstract":"Cloud computing is a natural fit for mobile security. Typical handsets have input constraints and practical computational and power limitations, which must be respected by mobile security technologies in order to be effective. We describe how cloud computing can address these issues. Our approach is based on a flexible framework for supporting authentication decisions we call TrustCube (to manage the authentication infrastructure) and on a behavioral authentication approach referred to as implicit authentication (to translate user behavior into authentication scores). The combination results in a new authentication paradigm for users of mobile technologies, one where an appropriate balance between usability and trust can be managed through flexible policies and dynamic tuning.","PeriodicalId":300613,"journal":{"name":"Cloud Computing Security Workshop","volume":"56 12","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2010-10-08","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"120825039","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 164
Privacy preserving mapping schemes supporting comparison 支持比较的保护隐私的映射方案
Pub Date : 2010-10-08 DOI: 10.1145/1866835.1866846
Qiang Tang
To cater to the privacy requirements in cloud computing, we introduce a new primitive, namely Privacy Preserving Mapping (PPM) schemes supporting comparison. An PPM scheme enables a user to map data items into images in such a way that, with a set of images, any entity can determine the <, =, > relationships among the corresponding data items. We propose three privacy notions, namely ideal privacy, level-1 privacy, and level-2 privacy, and three constructions satisfying these privacy notions respectively.
为了满足云计算中的隐私需求,我们引入了一种新的原语,即支持比较的隐私保持映射(PPM)方案。PPM方案使用户能够以这样一种方式将数据项映射到图像中,即使用一组图像,任何实体都可以确定相应数据项之间的关系。我们提出了理想隐私、一级隐私和二级隐私三种隐私概念,并分别提出了满足这些隐私概念的三种结构。
{"title":"Privacy preserving mapping schemes supporting comparison","authors":"Qiang Tang","doi":"10.1145/1866835.1866846","DOIUrl":"https://doi.org/10.1145/1866835.1866846","url":null,"abstract":"To cater to the privacy requirements in cloud computing, we introduce a new primitive, namely Privacy Preserving Mapping (PPM) schemes supporting comparison. An PPM scheme enables a user to map data items into images in such a way that, with a set of images, any entity can determine the <, =, > relationships among the corresponding data items. We propose three privacy notions, namely ideal privacy, level-1 privacy, and level-2 privacy, and three constructions satisfying these privacy notions respectively.","PeriodicalId":300613,"journal":{"name":"Cloud Computing Security Workshop","volume":"14 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2010-10-08","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114879379","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 18
Towards a discipline of mission-aware cloud computing 朝着任务感知云计算的方向发展
Pub Date : 2010-10-08 DOI: 10.1145/1866835.1866839
R. Sandhu, R. Boppana, R. Krishnan, Jeff Reich, Todd Wolff, Josh Zachry
Even as cloud computing gains rapid traction in the commercial marketplace the twin concerns of availability and security remain paramount to potential customers, especially in the enterprise. Concurrently the vision of what cyber security means is itself changing. The US Department of Defense (henceforth DoD) has recently promulgated a new doctrine of mission assurance in contrast to the earlier approach of information assurance. We argue that this concept of mission assurance is equally applicable to the commercial sector, and has high relevance to the availability and security concerns of cloud computing. While the business community may prefer alternate terms such as "business application assurance," "business function assurance" or "mission effectiveness" we propose to stay with established DoD terminology. Our basic position is that in order to achieve mission assurance in the new paradigm of cloud computing we need to instrument the cloud with hooks and supporting protocols and mechanisms to enable deployment of mission-driven performance, resilience and security policies into the computing and communication infrastructure. The cloud must therefore evolve from its current mission-oblivious state to become mission-aware. This position paper speculates on the research challenges in making this happen.
尽管云计算在商业市场上获得了快速的发展,但对潜在客户来说,可用性和安全性仍然是最重要的,尤其是在企业中。与此同时,人们对网络安全的理解本身也在发生变化。美国国防部(以下简称DoD)最近颁布了一项新的任务保证原则,与早期的信息保证方法形成对比。我们认为,任务保证的概念同样适用于商业部门,并且与云计算的可用性和安全性问题高度相关。虽然商业团体可能更喜欢替代术语,如“业务应用程序保证”、“业务功能保证”或“任务有效性”,但我们建议保留已建立的DoD术语。我们的基本立场是,为了在云计算的新范式中实现任务保证,我们需要为云提供挂钩和支持协议和机制,以便在计算和通信基础设施中部署任务驱动的性能、弹性和安全策略。因此,云必须从当前的任务无关状态进化为任务感知状态。这份立场文件推测了实现这一目标的研究挑战。
{"title":"Towards a discipline of mission-aware cloud computing","authors":"R. Sandhu, R. Boppana, R. Krishnan, Jeff Reich, Todd Wolff, Josh Zachry","doi":"10.1145/1866835.1866839","DOIUrl":"https://doi.org/10.1145/1866835.1866839","url":null,"abstract":"Even as cloud computing gains rapid traction in the commercial marketplace the twin concerns of availability and security remain paramount to potential customers, especially in the enterprise. Concurrently the vision of what cyber security means is itself changing. The US Department of Defense (henceforth DoD) has recently promulgated a new doctrine of mission assurance in contrast to the earlier approach of information assurance. We argue that this concept of mission assurance is equally applicable to the commercial sector, and has high relevance to the availability and security concerns of cloud computing. While the business community may prefer alternate terms such as \"business application assurance,\" \"business function assurance\" or \"mission effectiveness\" we propose to stay with established DoD terminology. Our basic position is that in order to achieve mission assurance in the new paradigm of cloud computing we need to instrument the cloud with hooks and supporting protocols and mechanisms to enable deployment of mission-driven performance, resilience and security policies into the computing and communication infrastructure. The cloud must therefore evolve from its current mission-oblivious state to become mission-aware. This position paper speculates on the research challenges in making this happen.","PeriodicalId":300613,"journal":{"name":"Cloud Computing Security Workshop","volume":"96 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2010-10-08","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127542306","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 35
Security audits of multi-tier virtual infrastructures in public infrastructure clouds 公共基础设施云中的多层虚拟基础设施安全审计
Pub Date : 2010-10-08 DOI: 10.1145/1866835.1866853
Sören Bleikertz, M. Schunter, Christian W. Probst, D. Pendarakis, Konrad Eriksson
Cloud computing has gained remarkable popularity in the recent years by a wide spectrum of consumers, ranging from small start-ups to governments. However, its benefits in terms of flexibility, scalability, and low upfront investments, are shadowed by security challenges which inhibit its adoption. Managed through a web-services interface, users can configure highly flexible but complex cloud computing environments. Furthermore, users misconfiguring such cloud services poses a severe security risk that can lead to security incidents, e.g., erroneous exposure of services due to faulty network security configurations. In this article we present a novel approach in the security assessment of the end-user configuration of multi-tier architectures deployed on infrastructure clouds such as Amazon EC2. In order to perform this assessment for the currently deployed configuration, we automated the process of extracting the configuration using the Amazon API. In the assessment we focused on the reachability and vulnerability of services in the virtual infrastructure, and presented a way for the visualization and automated analysis based on reachability and attack graphs. We proposed a query and policy language for the analysis which can be used to obtain insights into the configuration and to specify desired and undesired configurations. We have implemented the security assessment in a prototype and evaluated it for practical scenarios. Our approach effectively allows to remediate today's security concerns through validation of configurations of complex cloud infrastructures.
近年来,云计算在从小型初创企业到政府的广泛消费者中获得了显著的普及。然而,它在灵活性、可伸缩性和低前期投资方面的好处被阻碍其采用的安全挑战所掩盖。通过web服务界面进行管理,用户可以配置高度灵活但复杂的云计算环境。此外,用户错误配置此类云服务会带来严重的安全风险,可能导致安全事件,例如,由于网络安全配置错误而错误暴露服务。在本文中,我们提出了一种对部署在Amazon EC2等基础架构云上的多层体系结构的最终用户配置进行安全评估的新方法。为了对当前部署的配置执行此评估,我们使用Amazon API自动化了提取配置的过程。在评估中,我们重点关注了虚拟基础设施中服务的可达性和脆弱性,并提出了一种基于可达性和攻击图的可视化和自动化分析方法。我们提出了一种用于分析的查询和策略语言,该语言可用于深入了解配置并指定所需和不需要的配置。我们已经在原型中实现了安全评估,并针对实际场景对其进行了评估。我们的方法通过验证复杂云基础设施的配置,有效地解决了当今的安全问题。
{"title":"Security audits of multi-tier virtual infrastructures in public infrastructure clouds","authors":"Sören Bleikertz, M. Schunter, Christian W. Probst, D. Pendarakis, Konrad Eriksson","doi":"10.1145/1866835.1866853","DOIUrl":"https://doi.org/10.1145/1866835.1866853","url":null,"abstract":"Cloud computing has gained remarkable popularity in the recent years by a wide spectrum of consumers, ranging from small start-ups to governments. However, its benefits in terms of flexibility, scalability, and low upfront investments, are shadowed by security challenges which inhibit its adoption. Managed through a web-services interface, users can configure highly flexible but complex cloud computing environments. Furthermore, users misconfiguring such cloud services poses a severe security risk that can lead to security incidents, e.g., erroneous exposure of services due to faulty network security configurations.\u0000 In this article we present a novel approach in the security assessment of the end-user configuration of multi-tier architectures deployed on infrastructure clouds such as Amazon EC2. In order to perform this assessment for the currently deployed configuration, we automated the process of extracting the configuration using the Amazon API. In the assessment we focused on the reachability and vulnerability of services in the virtual infrastructure, and presented a way for the visualization and automated analysis based on reachability and attack graphs. We proposed a query and policy language for the analysis which can be used to obtain insights into the configuration and to specify desired and undesired configurations. We have implemented the security assessment in a prototype and evaluated it for practical scenarios. Our approach effectively allows to remediate today's security concerns through validation of configurations of complex cloud infrastructures.","PeriodicalId":300613,"journal":{"name":"Cloud Computing Security Workshop","volume":"53 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2010-10-08","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126492568","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 101
Remote data checking for network coding-based distributed storage systems 基于网络编码的分布式存储系统的远程数据校验
Pub Date : 2010-10-08 DOI: 10.1145/1866835.1866842
Bo Chen, Reza Curtmola, G. Ateniese, R. Burns
Remote Data Checking (RDC) is a technique by which clients can establish that data outsourced at untrusted servers remains intact over time. RDC is useful as a prevention tool, allowing clients to periodically check if data has been damaged, and as a repair tool whenever damage has been detected. Initially proposed in the context of a single server, RDC was later extended to verify data integrity in distributed storage systems that rely on replication and on erasure coding to store data redundantly at multiple servers. Recently, a technique was proposed to add redundancy based on network coding, which offers interesting tradeoffs because of its remarkably low communication overhead to repair corrupt servers. Unlike previous work on RDC which focused on minimizing the costs of the prevention phase, we take a holistic look and initiate the investigation of RDC schemes for distributed systems that rely on network coding to minimize the combined costs of both the prevention and repair phases. We propose RDC-NC, a novel secure and efficient RDC scheme for network coding-based distributed storage systems. RDC-NC mitigates new attacks that stem from the underlying principle of network coding. The scheme is able to preserve in an adversarial setting the minimal communication overhead of the repair component achieved by network coding in a benign setting. We implement our scheme and experimentally show that it is computationally inexpensive for both clients and servers.
远程数据检查(RDC)是一种技术,通过这种技术,客户可以确定外包给不受信任的服务器的数据在一段时间内保持完整。RDC是一种有用的预防工具,允许客户端定期检查数据是否损坏,并且在检测到损坏时作为修复工具。RDC最初是在单服务器环境下提出的,后来被扩展到分布式存储系统中的数据完整性验证,这些系统依赖于复制和擦除编码在多个服务器上冗余存储数据。最近,提出了一种基于网络编码增加冗余的技术,由于修复损坏的服务器的通信开销非常低,因此提供了有趣的权衡。与之前专注于最小化预防阶段成本的RDC工作不同,我们对依赖网络编码的分布式系统的RDC方案进行了全面的研究,以最小化预防和修复阶段的综合成本。提出了一种安全高效的分布式存储RDC- nc方案。RDC-NC减轻了源于网络编码基本原理的新攻击。该方案能够在敌对设置下保持网络编码在良性设置下实现的修复组件的最小通信开销。我们实现了我们的方案,并通过实验证明它对客户端和服务器来说都是计算成本低廉的。
{"title":"Remote data checking for network coding-based distributed storage systems","authors":"Bo Chen, Reza Curtmola, G. Ateniese, R. Burns","doi":"10.1145/1866835.1866842","DOIUrl":"https://doi.org/10.1145/1866835.1866842","url":null,"abstract":"Remote Data Checking (RDC) is a technique by which clients can establish that data outsourced at untrusted servers remains intact over time. RDC is useful as a prevention tool, allowing clients to periodically check if data has been damaged, and as a repair tool whenever damage has been detected. Initially proposed in the context of a single server, RDC was later extended to verify data integrity in distributed storage systems that rely on replication and on erasure coding to store data redundantly at multiple servers. Recently, a technique was proposed to add redundancy based on network coding, which offers interesting tradeoffs because of its remarkably low communication overhead to repair corrupt servers.\u0000 Unlike previous work on RDC which focused on minimizing the costs of the prevention phase, we take a holistic look and initiate the investigation of RDC schemes for distributed systems that rely on network coding to minimize the combined costs of both the prevention and repair phases. We propose RDC-NC, a novel secure and efficient RDC scheme for network coding-based distributed storage systems. RDC-NC mitigates new attacks that stem from the underlying principle of network coding. The scheme is able to preserve in an adversarial setting the minimal communication overhead of the repair component achieved by network coding in a benign setting. We implement our scheme and experimentally show that it is computationally inexpensive for both clients and servers.","PeriodicalId":300613,"journal":{"name":"Cloud Computing Security Workshop","volume":"123 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2010-10-08","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"117320317","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 264
Privacy preserving EHR system using attribute-based infrastructure 使用基于属性的基础设施保护隐私的电子病历系统
Pub Date : 2010-10-08 DOI: 10.1145/1866835.1866845
S. Narayan, Martin Gagné, R. Safavi-Naini
Secure management of Electronic Health Records (EHR) in a distributed computing environment such as cloud computing where computing resources including storage is provided by a third party service provider is a challenging task. In this paper, we explore techniques which guarantees security and privacy of medical data stored in the cloud. We show how new primitives in attribute-based cryptography can be used to construct a secure and privacy-preserving EHR system that enables patients to share their data among healthcare providers in a flexible, dynamic and scalable manner.
在云计算等分布式计算环境中,包括存储在内的计算资源由第三方服务提供商提供,电子健康记录(EHR)的安全管理是一项具有挑战性的任务。在本文中,我们探索了保证存储在云中的医疗数据的安全性和隐私性的技术。我们展示了如何使用基于属性的加密中的新原语来构建安全和隐私保护的EHR系统,该系统使患者能够以灵活、动态和可扩展的方式在医疗保健提供者之间共享他们的数据。
{"title":"Privacy preserving EHR system using attribute-based infrastructure","authors":"S. Narayan, Martin Gagné, R. Safavi-Naini","doi":"10.1145/1866835.1866845","DOIUrl":"https://doi.org/10.1145/1866835.1866845","url":null,"abstract":"Secure management of Electronic Health Records (EHR) in a distributed computing environment such as cloud computing where computing resources including storage is provided by a third party service provider is a challenging task. In this paper, we explore techniques which guarantees security and privacy of medical data stored in the cloud. We show how new primitives in attribute-based cryptography can be used to construct a secure and privacy-preserving EHR system that enables patients to share their data among healthcare providers in a flexible, dynamic and scalable manner.","PeriodicalId":300613,"journal":{"name":"Cloud Computing Security Workshop","volume":"9 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2010-10-08","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127042284","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 320
期刊
Cloud Computing Security Workshop
全部 Acc. Chem. Res. ACS Applied Bio Materials ACS Appl. Electron. Mater. ACS Appl. Energy Mater. ACS Appl. Mater. Interfaces ACS Appl. Nano Mater. ACS Appl. Polym. Mater. ACS BIOMATER-SCI ENG ACS Catal. ACS Cent. Sci. ACS Chem. Biol. ACS Chemical Health & Safety ACS Chem. Neurosci. ACS Comb. Sci. ACS Earth Space Chem. ACS Energy Lett. ACS Infect. Dis. ACS Macro Lett. ACS Mater. Lett. ACS Med. Chem. Lett. ACS Nano ACS Omega ACS Photonics ACS Sens. ACS Sustainable Chem. Eng. ACS Synth. Biol. Anal. Chem. BIOCHEMISTRY-US Bioconjugate Chem. BIOMACROMOLECULES Chem. Res. Toxicol. Chem. Rev. Chem. Mater. CRYST GROWTH DES ENERG FUEL Environ. Sci. Technol. Environ. Sci. Technol. Lett. Eur. J. Inorg. Chem. IND ENG CHEM RES Inorg. Chem. J. Agric. Food. Chem. J. Chem. Eng. Data J. Chem. Educ. J. Chem. Inf. Model. J. Chem. Theory Comput. J. Med. Chem. J. Nat. Prod. J PROTEOME RES J. Am. Chem. Soc. LANGMUIR MACROMOLECULES Mol. Pharmaceutics Nano Lett. Org. Lett. ORG PROCESS RES DEV ORGANOMETALLICS J. Org. Chem. J. Phys. Chem. J. Phys. Chem. A J. Phys. Chem. B J. Phys. Chem. C J. Phys. Chem. Lett. Analyst Anal. Methods Biomater. Sci. Catal. Sci. Technol. Chem. Commun. Chem. Soc. Rev. CHEM EDUC RES PRACT CRYSTENGCOMM Dalton Trans. Energy Environ. Sci. ENVIRON SCI-NANO ENVIRON SCI-PROC IMP ENVIRON SCI-WAT RES Faraday Discuss. Food Funct. Green Chem. Inorg. Chem. Front. Integr. Biol. J. Anal. At. Spectrom. J. Mater. Chem. A J. Mater. Chem. B J. Mater. Chem. C Lab Chip Mater. Chem. Front. Mater. Horiz. MEDCHEMCOMM Metallomics Mol. Biosyst. Mol. Syst. Des. Eng. Nanoscale Nanoscale Horiz. Nat. Prod. Rep. New J. Chem. Org. Biomol. Chem. Org. Chem. Front. PHOTOCH PHOTOBIO SCI PCCP Polym. Chem.
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
0
微信
客服QQ
Book学术公众号 扫码关注我们
反馈
×
意见反馈
请填写您的意见或建议
请填写您的手机或邮箱
×
提示
您的信息不完整,为了账户安全,请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
现在去查看 取消
×
提示
确定
Book学术官方微信
Book学术文献互助
Book学术文献互助群
群 号:481959085
Book学术
文献互助 智能选刊 最新文献 互助须知 联系我们:info@booksci.cn
Book学术提供免费学术资源搜索服务,方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。
Copyright © 2023 Book学术 All rights reserved.
ghs 京公网安备 11010802042870号 京ICP备2023020795号-1