首页 > 最新文献

2015 10th International Conference on Availability, Reliability and Security最新文献

英文 中文
Optimizing IT Service Costs with Respect to the Availability Service Level Objective 根据可用性服务水平目标优化IT服务成本
Sascha Bosse, Matthias Splieth, K. Turowski
Meeting the availability service level objective while minimizing the costs of the IT service provision is a major challenge for IT service designers. In order to optimize component choices and redundancy mechanisms, the redundancy allocation problem (RAP) was defined. RAP solution algorithms support decision makers with (sub)optimal design configurations that trade-off availability and costs. However, the existing RAP definitions are not suitable for IT service design since they do not include inter-component dependencies such as common mode failures. Therefore, a RAP definition is provided in this paper in which the characteristics of modern IT systems such as standby mechanisms, performance degradation and generic dependencies are integrated. The RAP definition and an adapted genetic algorithm are applied to optimize the costs of an excerpt of an application service provider's IT system landscape. The results demonstrate that the developed approach is applicable and suitable to minimize IT service costs while fulfilling the availability guarantees that are documented in service level agreements.
在满足可用性服务级别目标的同时最小化IT服务提供的成本是IT服务设计人员面临的主要挑战。为了优化部件选择和冗余机制,定义了冗余分配问题(RAP)。RAP解决方案算法通过权衡可用性和成本的(次)最优设计配置支持决策者。然而,现有的RAP定义不适合IT服务设计,因为它们不包括组件间依赖关系,比如公共模式故障。因此,本文提供了一个RAP定义,其中集成了现代IT系统的特征,如备用机制、性能退化和一般依赖关系。应用RAP定义和自适应遗传算法来优化应用程序服务提供商IT系统景观摘录的成本。结果表明,所开发的方法是适用的,适合于最小化IT服务成本,同时满足服务水平协议中记录的可用性保证。
{"title":"Optimizing IT Service Costs with Respect to the Availability Service Level Objective","authors":"Sascha Bosse, Matthias Splieth, K. Turowski","doi":"10.1109/ARES.2015.11","DOIUrl":"https://doi.org/10.1109/ARES.2015.11","url":null,"abstract":"Meeting the availability service level objective while minimizing the costs of the IT service provision is a major challenge for IT service designers. In order to optimize component choices and redundancy mechanisms, the redundancy allocation problem (RAP) was defined. RAP solution algorithms support decision makers with (sub)optimal design configurations that trade-off availability and costs. However, the existing RAP definitions are not suitable for IT service design since they do not include inter-component dependencies such as common mode failures. Therefore, a RAP definition is provided in this paper in which the characteristics of modern IT systems such as standby mechanisms, performance degradation and generic dependencies are integrated. The RAP definition and an adapted genetic algorithm are applied to optimize the costs of an excerpt of an application service provider's IT system landscape. The results demonstrate that the developed approach is applicable and suitable to minimize IT service costs while fulfilling the availability guarantees that are documented in service level agreements.","PeriodicalId":331539,"journal":{"name":"2015 10th International Conference on Availability, Reliability and Security","volume":"36 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2015-08-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131765142","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 4
Advanced Identity and Access Policy Management Using Contextual Data 使用上下文数据的高级身份和访问策略管理
Matthias Hummer, Michael Kunz, M. Netter, L. Fuchs, G. Pernul
Due to compliance and IT security requirements, company-wide Identity and Access Management within organizations has gained significant importance in research and practice over the last years. Companies aim at standardizing user management policies in order to reduce administrative overhead and strengthen IT security. Despite of its relevance, hardly any supportive means for the automated detection and refinement as well as management of policies are available. As a result, policies outdate over time, leading to security vulnerabilities and inefficiencies. Existing research mainly focuses on policy detection without providing the required guidance for policy management. This paper closes the existing gap by proposing a Dynamic Policy Management Process which structures the activities required for policy management in Identity and Access Management environments. In contrast to current approaches it fosters the consideration of contextual user management data for policy detection and refinement and offers result visualization techniques that foster human understanding. In order to underline its applicability, this paper provides a naturalistic evaluation based on real-life data from a large industrial company.
由于遵从性和IT安全需求,在过去几年中,组织内部的公司范围的身份和访问管理在研究和实践中变得非常重要。公司的目标是标准化用户管理策略,以减少管理开销并加强IT安全性。尽管它具有相关性,但几乎没有任何支持策略自动检测和改进以及管理的手段。因此,策略会随着时间的推移而过时,从而导致安全漏洞和效率低下。现有的研究主要集中在策略检测上,没有为策略管理提供必要的指导。本文提出了一个动态策略管理流程,该流程构建了身份和访问管理环境中策略管理所需的活动,从而缩小了现有的差距。与当前的方法相比,它促进了对上下文用户管理数据的考虑,以进行策略检测和改进,并提供了促进人类理解的结果可视化技术。为了强调其适用性,本文基于一家大型工业公司的真实数据提供了一个自然的评估。
{"title":"Advanced Identity and Access Policy Management Using Contextual Data","authors":"Matthias Hummer, Michael Kunz, M. Netter, L. Fuchs, G. Pernul","doi":"10.1109/ARES.2015.40","DOIUrl":"https://doi.org/10.1109/ARES.2015.40","url":null,"abstract":"Due to compliance and IT security requirements, company-wide Identity and Access Management within organizations has gained significant importance in research and practice over the last years. Companies aim at standardizing user management policies in order to reduce administrative overhead and strengthen IT security. Despite of its relevance, hardly any supportive means for the automated detection and refinement as well as management of policies are available. As a result, policies outdate over time, leading to security vulnerabilities and inefficiencies. Existing research mainly focuses on policy detection without providing the required guidance for policy management. This paper closes the existing gap by proposing a Dynamic Policy Management Process which structures the activities required for policy management in Identity and Access Management environments. In contrast to current approaches it fosters the consideration of contextual user management data for policy detection and refinement and offers result visualization techniques that foster human understanding. In order to underline its applicability, this paper provides a naturalistic evaluation based on real-life data from a large industrial company.","PeriodicalId":331539,"journal":{"name":"2015 10th International Conference on Availability, Reliability and Security","volume":"61 8","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2015-08-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131874273","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 8
Advanced Attribute-Based Key Management for Mobile Devices in Hybrid Clouds 混合云中移动设备基于属性的高级密钥管理
Jaemin Park, Eunchan Kim, Sungjin Park, Cheoloh Kang
Mobile cloud computing requires the efficient approach to access the outsourced data in public clouds due to resource scarceness of mobile devices. To this end, the outsourced data should be protected efficiently from being accessed in plaintext by unauthorized users and public clouds. User revocation should be appropriately managed to guarantee backward secrecy, collusion resistance, and key freshness. In this paper, we present AKMD (Advanced Attribute-based Key Management for Mobile Devices in Hybrid Clouds), an improved key management in hybrid clouds using cipher text-policy attribute-based encryption to allow only authorized users to access the outsourced data stored in public clouds while guaranteeing the efficiency by delegating the key management tasks to private clouds. We introduce new two procedures to handle user revocations, rekey of data encryption keys and policy renewal to support the backward secrecy and key freshness. Our implementation and analysis show that AKMD improves efficiency in security computations and key storage space for mobile devices and guarantees the improved security.
由于移动设备资源的稀缺性,移动云计算需要有效的方法来访问公共云中的外包数据。为此,应有效保护外包数据,防止未经授权的用户和公共云以明文形式访问。用户撤销应该得到适当的管理,以保证反向保密、抗合谋和密钥的新鲜度。在本文中,我们提出了AKMD (Advanced Attribute-based Key Management for Mobile Devices In Hybrid cloud),这是一种改进的混合云密钥管理方法,使用基于密文策略属性的加密技术,只允许授权用户访问存储在公共云中的外包数据,同时通过将密钥管理任务委托给私有云来保证效率。我们引入了两个新的过程来处理用户撤销,数据加密密钥的重新密钥和策略更新,以支持向后保密和密钥新鲜度。我们的实现和分析表明,AKMD提高了移动设备的安全计算效率和密钥存储空间,保证了改进后的安全性。
{"title":"Advanced Attribute-Based Key Management for Mobile Devices in Hybrid Clouds","authors":"Jaemin Park, Eunchan Kim, Sungjin Park, Cheoloh Kang","doi":"10.1109/ARES.2015.27","DOIUrl":"https://doi.org/10.1109/ARES.2015.27","url":null,"abstract":"Mobile cloud computing requires the efficient approach to access the outsourced data in public clouds due to resource scarceness of mobile devices. To this end, the outsourced data should be protected efficiently from being accessed in plaintext by unauthorized users and public clouds. User revocation should be appropriately managed to guarantee backward secrecy, collusion resistance, and key freshness. In this paper, we present AKMD (Advanced Attribute-based Key Management for Mobile Devices in Hybrid Clouds), an improved key management in hybrid clouds using cipher text-policy attribute-based encryption to allow only authorized users to access the outsourced data stored in public clouds while guaranteeing the efficiency by delegating the key management tasks to private clouds. We introduce new two procedures to handle user revocations, rekey of data encryption keys and policy renewal to support the backward secrecy and key freshness. Our implementation and analysis show that AKMD improves efficiency in security computations and key storage space for mobile devices and guarantees the improved security.","PeriodicalId":331539,"journal":{"name":"2015 10th International Conference on Availability, Reliability and Security","volume":"3 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2015-08-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115152623","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 1
Countermeasures for Covert Channel-Internal Control Protocols 隐蔽通道内部控制协议的对策
J. Kaur, S. Wendzel, M. Meier
Network covert channels have become a sophisticated means for transferring hidden information over the network, and thereby breaking the security policy of a system. Covert channel-internal control protocols, called micro protocols, have been introduced in the recent years to enhance capabilities of network covert channels. Micro protocols are usually placed within the hidden bits of a covert channel's payload and enable features such as reliable data transfer, session management, and dynamic routing for network covert channels. These features provide adaptive and stealthy communication channels for malware, especially bot nets. Although many techniques are available to counter network covert channels, these techniques are insufficient for countering micro protocols. In this paper, we present the first work to categorize and implement possible countermeasures for micro protocols that can ultimately break sophisticated covert channel communication. The key aspect of proposing these countermeasures is based on the interaction with the micro protocol. We implemented the countermeasures for two micro protocol-based tools: Ping Tunnel and Smart Covert Channel Tool. The results show that our techniques are able to counter micro protocols in an effective manner compared to current mechanisms, which do not target micro protocol-specific behavior.
网络隐蔽通道已经成为一种复杂的通过网络传输隐藏信息,从而破坏系统安全策略的手段。为了提高网络隐蔽信道的性能,近年来引入了隐蔽信道内部控制协议,称为微协议。微协议通常放在隐蔽通道有效负载的隐藏位中,为网络隐蔽通道提供可靠的数据传输、会话管理和动态路由等功能。这些特性为恶意软件,尤其是僵尸网络提供了自适应和隐蔽的通信渠道。虽然有许多技术可用于对抗网络隐蔽通道,但这些技术不足以对抗微协议。在本文中,我们提出了对微协议进行分类和实施可能的对策的第一项工作,这些对策最终可以打破复杂的隐蔽信道通信。提出这些对策的关键是基于与微协议的交互。我们实现了两个基于微协议的工具:Ping隧道和智能隐蔽通道工具的对策。结果表明,与当前不针对微协议特定行为的机制相比,我们的技术能够以有效的方式对抗微协议。
{"title":"Countermeasures for Covert Channel-Internal Control Protocols","authors":"J. Kaur, S. Wendzel, M. Meier","doi":"10.1109/ARES.2015.88","DOIUrl":"https://doi.org/10.1109/ARES.2015.88","url":null,"abstract":"Network covert channels have become a sophisticated means for transferring hidden information over the network, and thereby breaking the security policy of a system. Covert channel-internal control protocols, called micro protocols, have been introduced in the recent years to enhance capabilities of network covert channels. Micro protocols are usually placed within the hidden bits of a covert channel's payload and enable features such as reliable data transfer, session management, and dynamic routing for network covert channels. These features provide adaptive and stealthy communication channels for malware, especially bot nets. Although many techniques are available to counter network covert channels, these techniques are insufficient for countering micro protocols. In this paper, we present the first work to categorize and implement possible countermeasures for micro protocols that can ultimately break sophisticated covert channel communication. The key aspect of proposing these countermeasures is based on the interaction with the micro protocol. We implemented the countermeasures for two micro protocol-based tools: Ping Tunnel and Smart Covert Channel Tool. The results show that our techniques are able to counter micro protocols in an effective manner compared to current mechanisms, which do not target micro protocol-specific behavior.","PeriodicalId":331539,"journal":{"name":"2015 10th International Conference on Availability, Reliability and Security","volume":"38 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2015-08-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114349174","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 12
On the Isofunctionality of Network Access Control Lists 浅谈网络访问控制列表的功能
Malek Belhaouane, Joaquín García, Hervé Debar
In a networking context, Access Control Lists (ACLs) refer to security rules associated to network equipment, such as routers, switches and firewalls. Methods and tools to automate the management of ACLs distributed among several equipment shall verify if the corresponding ACLs are functionally equivalent. In this paper, we address such a verification process. We present a formal method to verify when two ACLs are iso functional and illustrate our proposal over a practical example.
在网络环境中,acl (Access Control Lists)是指与路由器、交换机、防火墙等网络设备相关联的安全规则。对分布在多台设备上的acl进行自动化管理的方法和工具,应验证相应的acl在功能上是否相等。在本文中,我们讨论了这样一个验证过程。我们提出了一种形式化的方法来验证两个acl何时具有相同的功能,并通过一个实际示例说明了我们的建议。
{"title":"On the Isofunctionality of Network Access Control Lists","authors":"Malek Belhaouane, Joaquín García, Hervé Debar","doi":"10.1109/ARES.2015.78","DOIUrl":"https://doi.org/10.1109/ARES.2015.78","url":null,"abstract":"In a networking context, Access Control Lists (ACLs) refer to security rules associated to network equipment, such as routers, switches and firewalls. Methods and tools to automate the management of ACLs distributed among several equipment shall verify if the corresponding ACLs are functionally equivalent. In this paper, we address such a verification process. We present a formal method to verify when two ACLs are iso functional and illustrate our proposal over a practical example.","PeriodicalId":331539,"journal":{"name":"2015 10th International Conference on Availability, Reliability and Security","volume":"20 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2015-08-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115320128","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 4
Securing Web Applications with Better "Patches": An Architectural Approach for Systematic Input Validation with Security Patterns 用更好的“补丁”保护Web应用程序:使用安全模式进行系统输入验证的体系结构方法
Pub Date : 2015-08-24 DOI: 10.1109/ARES.2015.106
J.-W. Sohn, J. Ryoo
Some of the most rampant problems in software security originate from improper input validation. This is partly due to ad hoc approaches taken by software developers when dealing with user inputs. Therefore, it is a crucial research question in software security to ask how to effectively apply well-known input validation and sanitization techniques against security attacks exploiting the user input-related weaknesses found in software. This paper examines the current ways of how input validation is conducted in major open-source projects and attempts to confirm the main source of the problem as these ad hoc responses to the input validation-related attacks such as SQL injection and cross-site scripting (XSS) attacks through a case study. In addition, we propose a more systematic software security approach by promoting the adoption of proactive, architectural design-based solutions to move away from the current practice of chronic vulnerability-centric and reactive approaches.
软件安全中一些最严重的问题源于不正确的输入验证。这部分是由于软件开发人员在处理用户输入时采取的特殊方法。因此,如何有效地应用众所周知的输入验证和清理技术来抵御利用软件中与用户输入相关的弱点进行的安全攻击,是软件安全领域的一个关键研究问题。本文考察了目前主要开源项目中如何进行输入验证的方法,并试图通过一个案例研究来确认问题的主要来源,即这些针对与输入验证相关的攻击(如SQL注入和跨站点脚本攻击)的特殊响应。此外,我们提出了一种更系统化的软件安全方法,通过促进采用主动的、基于架构设计的解决方案来摆脱当前以长期漏洞为中心和被动方法的实践。
{"title":"Securing Web Applications with Better \"Patches\": An Architectural Approach for Systematic Input Validation with Security Patterns","authors":"J.-W. Sohn, J. Ryoo","doi":"10.1109/ARES.2015.106","DOIUrl":"https://doi.org/10.1109/ARES.2015.106","url":null,"abstract":"Some of the most rampant problems in software security originate from improper input validation. This is partly due to ad hoc approaches taken by software developers when dealing with user inputs. Therefore, it is a crucial research question in software security to ask how to effectively apply well-known input validation and sanitization techniques against security attacks exploiting the user input-related weaknesses found in software. This paper examines the current ways of how input validation is conducted in major open-source projects and attempts to confirm the main source of the problem as these ad hoc responses to the input validation-related attacks such as SQL injection and cross-site scripting (XSS) attacks through a case study. In addition, we propose a more systematic software security approach by promoting the adoption of proactive, architectural design-based solutions to move away from the current practice of chronic vulnerability-centric and reactive approaches.","PeriodicalId":331539,"journal":{"name":"2015 10th International Conference on Availability, Reliability and Security","volume":"96 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2015-08-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122554611","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 4
Modeling Fraud Prevention of Online Services Using Incident Response Trees and Value at Risk 利用事件响应树和风险值对在线服务的欺诈预防建模
D. Gorton
Authorities like the Federal Financial Institutions Examination Council in the US and the European Central Bank in Europe have stepped up their expected minimum security requirements for financial institutions, including the requirements for risk analysis. In a previous article, we introduced a visual tool and a systematic way to estimate the probability of a successful incident response process, which we called an incident response tree (IRT). In this article, we present several scenarios using the IRT which could be used in a risk analysis of online financial services concerning fraud prevention. By minimizing the problem of underreporting, we are able to calculate the conditional probabilities of prevention, detection, and response in the incident response process of a financial institution. We also introduce a quantitative model for estimating expected loss from fraud, and conditional fraud value at risk, which enables a direct comparison of risk among online banking channels in a multi-channel environment.
美国联邦金融机构审查委员会(Federal Financial Institutions Examination Council)和欧洲欧洲央行(European Central Bank)等监管机构已经提高了对金融机构的最低安全要求,包括风险分析要求。在前一篇文章中,我们介绍了一种可视化工具和一种系统的方法来估计成功的事件响应过程的概率,我们称之为事件响应树(IRT)。在本文中,我们介绍了使用IRT的几个场景,IRT可用于在线金融服务的风险分析,涉及欺诈预防。通过最小化漏报问题,我们能够在金融机构的事件响应过程中计算预防、检测和响应的条件概率。我们还引入了一个定量模型,用于估计欺诈的预期损失和风险中的条件欺诈价值,从而可以直接比较多渠道环境下网上银行渠道的风险。
{"title":"Modeling Fraud Prevention of Online Services Using Incident Response Trees and Value at Risk","authors":"D. Gorton","doi":"10.1109/ARES.2015.17","DOIUrl":"https://doi.org/10.1109/ARES.2015.17","url":null,"abstract":"Authorities like the Federal Financial Institutions Examination Council in the US and the European Central Bank in Europe have stepped up their expected minimum security requirements for financial institutions, including the requirements for risk analysis. In a previous article, we introduced a visual tool and a systematic way to estimate the probability of a successful incident response process, which we called an incident response tree (IRT). In this article, we present several scenarios using the IRT which could be used in a risk analysis of online financial services concerning fraud prevention. By minimizing the problem of underreporting, we are able to calculate the conditional probabilities of prevention, detection, and response in the incident response process of a financial institution. We also introduce a quantitative model for estimating expected loss from fraud, and conditional fraud value at risk, which enables a direct comparison of risk among online banking channels in a multi-channel environment.","PeriodicalId":331539,"journal":{"name":"2015 10th International Conference on Availability, Reliability and Security","volume":"170 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2015-08-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128646193","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 2
How Much Cloud Can You Handle? 你能处理多少云?
M. Jaatun, Inger Anne Tøndel
Outsourcing computing and storage to the cloud does not eliminate the need for handling of information security incidents. However, the long provider chains and unclear responsibilities in the cloud make incident response difficult. In this paper we present results from interviews in critical infrastructure organisations that highlight incident handling needs that would apply to cloud customers, and suggest mechanisms that facilitate inter-provider collaboration in handling of incidents in the cloud, improving the accountability of the cloud service providers.
将计算和存储外包给云并不能消除处理信息安全事件的需要。然而,长提供商链和云中不明确的责任使得事件响应变得困难。在本文中,我们展示了对关键基础设施组织的访谈结果,这些访谈强调了适用于云客户的事件处理需求,并提出了促进云服务提供商之间协作处理云事件的机制,提高了云服务提供商的问责制。
{"title":"How Much Cloud Can You Handle?","authors":"M. Jaatun, Inger Anne Tøndel","doi":"10.1109/ARES.2015.38","DOIUrl":"https://doi.org/10.1109/ARES.2015.38","url":null,"abstract":"Outsourcing computing and storage to the cloud does not eliminate the need for handling of information security incidents. However, the long provider chains and unclear responsibilities in the cloud make incident response difficult. In this paper we present results from interviews in critical infrastructure organisations that highlight incident handling needs that would apply to cloud customers, and suggest mechanisms that facilitate inter-provider collaboration in handling of incidents in the cloud, improving the accountability of the cloud service providers.","PeriodicalId":331539,"journal":{"name":"2015 10th International Conference on Availability, Reliability and Security","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2015-08-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130892700","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 6
Virtual Machine Introspection: Techniques and Applications 虚拟机自省:技术和应用
Yacine Hebbal, S. Laniepce, Jean-Marc Menaud
Virtual Machine Introspection (VMI) is a technique that enables monitoring virtual machines at the hypervisor layer. This monitoring concept has gained recently a considerable focus in computer security research due to its complete but semantic less visibility on virtual machines activities and isolation from them. VMI works range from addressing the semantic gap problem to leveraging explored VMI techniques in order to provide novel hypervisor-based services that belong to different fields. This paper aims to survey and classify existing VMI techniques and their applications.
虚拟机自省(VMI)是一种在管理程序层监视虚拟机的技术。这种监视概念最近在计算机安全研究中获得了相当大的关注,因为它对虚拟机活动的完整但语义上的可视性较低,并且与它们隔离。VMI的工作范围从解决语义差距问题到利用已探索的VMI技术,以提供属于不同领域的基于管理程序的新型服务。本文旨在对现有VMI技术及其应用进行综述和分类。
{"title":"Virtual Machine Introspection: Techniques and Applications","authors":"Yacine Hebbal, S. Laniepce, Jean-Marc Menaud","doi":"10.1109/ARES.2015.43","DOIUrl":"https://doi.org/10.1109/ARES.2015.43","url":null,"abstract":"Virtual Machine Introspection (VMI) is a technique that enables monitoring virtual machines at the hypervisor layer. This monitoring concept has gained recently a considerable focus in computer security research due to its complete but semantic less visibility on virtual machines activities and isolation from them. VMI works range from addressing the semantic gap problem to leveraging explored VMI techniques in order to provide novel hypervisor-based services that belong to different fields. This paper aims to survey and classify existing VMI techniques and their applications.","PeriodicalId":331539,"journal":{"name":"2015 10th International Conference on Availability, Reliability and Security","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2015-08-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128863768","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 47
Enabling Constraints and Dynamic Preventive Access Control Policy Enforcement in the Cloud 在云中启用约束和动态预防性访问控制策略实施
S. Fugkeaw, Hiroyuki Sato
Existing access control solutions applying Cipher text Policy Attribute based Encryption (CP-ABE) scheme usually rely on the static access enforcement based on the access control policy. In real-world scenario, the static pattern of access control policy may not be sufficient to effectively respond the security problems or advanced access control requirements. In this paper, we enhance our collaborative access control model: C-CP-ARBE, to be capable to support a more rigorous access control with security constraints and preventive access policy (PAP) enforcement feature. To this end, we design constraints specification model and PAP enforcement scheme in multi-authority cloud storage systems. We employ Multi-Agent System (MAS) to automate the authentication and authorization function as well as to increase the performance of overall cryptographic processes. As of MAS concept, the scalability and separation of security functions of our access control system are enhanced. Finally, we present the experiments to demonstrate the improved efficiency and practicality of our proposed scheme.
现有的基于密文策略属性加密(CP-ABE)的访问控制方案通常依赖于基于访问控制策略的静态访问强制。在实际场景中,访问控制策略的静态模式可能不足以有效地响应安全问题或高级访问控制需求。在本文中,我们增强了我们的协作访问控制模型:C-CP-ARBE,使其能够支持具有安全约束和预防性访问策略(PAP)实施功能的更严格的访问控制。为此,我们设计了多授权云存储系统中的约束规范模型和PAP实施方案。我们采用多代理系统(Multi-Agent System, MAS)来实现认证和授权功能的自动化,并提高整个加密过程的性能。采用MAS的概念,增强了门禁系统的可扩展性和安全功能的分离性。最后,通过实验验证了该方案的有效性和实用性。
{"title":"Enabling Constraints and Dynamic Preventive Access Control Policy Enforcement in the Cloud","authors":"S. Fugkeaw, Hiroyuki Sato","doi":"10.1109/ARES.2015.33","DOIUrl":"https://doi.org/10.1109/ARES.2015.33","url":null,"abstract":"Existing access control solutions applying Cipher text Policy Attribute based Encryption (CP-ABE) scheme usually rely on the static access enforcement based on the access control policy. In real-world scenario, the static pattern of access control policy may not be sufficient to effectively respond the security problems or advanced access control requirements. In this paper, we enhance our collaborative access control model: C-CP-ARBE, to be capable to support a more rigorous access control with security constraints and preventive access policy (PAP) enforcement feature. To this end, we design constraints specification model and PAP enforcement scheme in multi-authority cloud storage systems. We employ Multi-Agent System (MAS) to automate the authentication and authorization function as well as to increase the performance of overall cryptographic processes. As of MAS concept, the scalability and separation of security functions of our access control system are enhanced. Finally, we present the experiments to demonstrate the improved efficiency and practicality of our proposed scheme.","PeriodicalId":331539,"journal":{"name":"2015 10th International Conference on Availability, Reliability and Security","volume":"150 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2015-08-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116342348","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 1
期刊
2015 10th International Conference on Availability, Reliability and Security
全部 Acc. Chem. Res. ACS Applied Bio Materials ACS Appl. Electron. Mater. ACS Appl. Energy Mater. ACS Appl. Mater. Interfaces ACS Appl. Nano Mater. ACS Appl. Polym. Mater. ACS BIOMATER-SCI ENG ACS Catal. ACS Cent. Sci. ACS Chem. Biol. ACS Chemical Health & Safety ACS Chem. Neurosci. ACS Comb. Sci. ACS Earth Space Chem. ACS Energy Lett. ACS Infect. Dis. ACS Macro Lett. ACS Mater. Lett. ACS Med. Chem. Lett. ACS Nano ACS Omega ACS Photonics ACS Sens. ACS Sustainable Chem. Eng. ACS Synth. Biol. Anal. Chem. BIOCHEMISTRY-US Bioconjugate Chem. BIOMACROMOLECULES Chem. Res. Toxicol. Chem. Rev. Chem. Mater. CRYST GROWTH DES ENERG FUEL Environ. Sci. Technol. Environ. Sci. Technol. Lett. Eur. J. Inorg. Chem. IND ENG CHEM RES Inorg. Chem. J. Agric. Food. Chem. J. Chem. Eng. Data J. Chem. Educ. J. Chem. Inf. Model. J. Chem. Theory Comput. J. Med. Chem. J. Nat. Prod. J PROTEOME RES J. Am. Chem. Soc. LANGMUIR MACROMOLECULES Mol. Pharmaceutics Nano Lett. Org. Lett. ORG PROCESS RES DEV ORGANOMETALLICS J. Org. Chem. J. Phys. Chem. J. Phys. Chem. A J. Phys. Chem. B J. Phys. Chem. C J. Phys. Chem. Lett. Analyst Anal. Methods Biomater. Sci. Catal. Sci. Technol. Chem. Commun. Chem. Soc. Rev. CHEM EDUC RES PRACT CRYSTENGCOMM Dalton Trans. Energy Environ. Sci. ENVIRON SCI-NANO ENVIRON SCI-PROC IMP ENVIRON SCI-WAT RES Faraday Discuss. Food Funct. Green Chem. Inorg. Chem. Front. Integr. Biol. J. Anal. At. Spectrom. J. Mater. Chem. A J. Mater. Chem. B J. Mater. Chem. C Lab Chip Mater. Chem. Front. Mater. Horiz. MEDCHEMCOMM Metallomics Mol. Biosyst. Mol. Syst. Des. Eng. Nanoscale Nanoscale Horiz. Nat. Prod. Rep. New J. Chem. Org. Biomol. Chem. Org. Chem. Front. PHOTOCH PHOTOBIO SCI PCCP Polym. Chem.
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
0
微信
客服QQ
Book学术公众号 扫码关注我们
反馈
×
意见反馈
请填写您的意见或建议
请填写您的手机或邮箱
×
提示
您的信息不完整,为了账户安全,请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
现在去查看 取消
×
提示
确定
Book学术官方微信
Book学术文献互助
Book学术文献互助群
群 号:481959085
Book学术
文献互助 智能选刊 最新文献 互助须知 联系我们:info@booksci.cn
Book学术提供免费学术资源搜索服务,方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。
Copyright © 2023 Book学术 All rights reserved.
ghs 京公网安备 11010802042870号 京ICP备2023020795号-1