In this dissertation, previous work on access control for both collaborate and non-collaborative systems is surveyed.  New access control requirements for general collaborative environments are identified, and it is shown that existing models do not completely meet these requirements.  A new access control model is developed for meeting the requirements.  In particular, a set of collaboration rights are identified based on a general collaboration model; exception-based, multiple inheritance mechanisms are used to support both flexible and high-level access specification; and dynamic, multiple ownership rules are developed to support flexible access administration.  The model can emulate a variety of existing systems and meets the new access requirements.  It has been implemented in a generic, extensible collaborative system, which relieves individual applications from implementing the model.

A widely-used class of real-time, reactive, embedded systems is called interrupt-driven systems (8).  Programming of interrupt-driven systems is notoriously difficult and error-prone.  This is because such systems are usually equipped with a small amount of memory while being asked to handle as many external interrupts as possible.  Furthermore, such systems demand responsive handling of interrupts.  Due to the fact that an interrupt may happen at any time, a handler can be interrupted by another interrupt, making the stack grow in order to store the context information for the current handler.  The problem with such a scenario is that it may lead to stack overflow.  Traditionally, this problem has been avoided by forbidding other interrupts during the execution of the handler.  However, doing this puts tremendous limit on the number of interrupts which can be handled.  Moreover, it greatly increases the response time for interrupts, resulting in an inefficient system and causing a potential predictability problem:  the handling of an interrupt can be so long that the next interrupt occurrence is missed.  In this thesis, we lay a formal framework, which, to the best of our knowledge, is the first in the field, to ensure stack boundedness, to give the tightest possible upper bound of the stack usage for interrupt-driven programs, and to guarantee predictability.  Specifically, we develop two formal languages, interrupt calculus and periodic interrupt calculus, to capture the characteristics of interrupt-driven systems.  We advocate intersection types and union types from the field of programming languages as a convenient vehicle to solve these problems.  We base our analysis on two type systems which are designed for the two calculi.  Our results show that the calculi demonstrate the desired capability for characterizing interrupt-driven programs.  We show that once an interrupt calculus program type checks, there can be no stack overflow; we prove that the type inference problem for interrupt calculus is in PSPACE.  For type-checked periodic interrupt calculus programs, we show that not only can the stack not overflow, but that it is also guaranteed that no single interrupt can be missed.  In addition, our building of the types and type derivations of the periodic interrupt calculus programs unveils an equivalence relation between model checking and type systems, which may be of interest in its own right.

Sensor networks are designed with the assumption that nodes are willing to collaborate.  However, the open collaboration of nodes introduces privacy and security issues.  Therefore, ensuring privacy in wireless sensor networks is a challenging task.  Based on a multilevel security paradigm, in this paper we present a hierarchical key generation and distribution protocol for wireless sensor networks.  We show by simulation results that our key generation scheme outperforms the existing hierarchical key generation schemes thus it is suitable for sensor networks with limited computation and energy capabilities.  Furthermore, we present an energy efficient key diffusion protocol.  We also discuss the possible security threats involved with the proposed protocol and provide suitable solutions to such threats.

Access control is the key security service used for information and system security. The access control mechanisms can be used to enforce various security policies, but the desired access control objectives can only be achieved if the underlying software implementation is correct. It therefore becomes essential to not only verify that the implementation conforms to the given policy but also to confirm the absence of any violations in it. We propose a model-based strategy for testing implementations of access control systems that employ the RBAC policy specification. Our approach is based on the construction of a structural and behavioral model of the corresponding RBAC specification. The model is then used to generate static and dynamic test suites for the corresponding implementation. The code coverage and mutation score were used as metrics to determine the efficacy of the proposed approach in a case study. The results of the case study show that the tests generated using the proposed approach not only provide good control flow coverage of the implementation but are also effective in detecting faults induced via mutation operators.

Cross Domain Controlled Interface and Labeling (CDCIL) is intended to provide a capability that will allow web services in separate security policy domains to exchange eXtended Markup Language (XML) objects (messages, documents, web-based content) securely across domain boundaries, while preventing the flow of content not authorized to cross those boundaries. In this way, CDCIL will provide a framework for enabling the creation of a single service oriented architecture (SOA) composed of multiple security policy domains, each with its own security requirements and attributes.
The CDCIL services have been conceived as standards based web services that will provide mechanisms to (1) persistently bind a label (metadata header) containing flexibly-derived set of security attributes to XML objects exchanged by web services in different domains, and (2) enforce security policies that govern those exchanges. The CDCIL services go beyond other cross domain solutions being used to control XML exchanges in their ability to (1) accommodate a broader definition of

If we limit the contact rate of worm traffic, can we alleviate and ultimately contain Internet worms? This paper sets out to answer this question. Specifically, we are interested in analyzing different deployment strategies of rate control mechanisms and the effect thereof on suppressing the spread of worm code. We use both analytical models and simulation experiments. We find that rate control at individual hosts or edge routers yields a slowdown that is linear in the number of hosts (or routers) with the rate limiting filters. Limiting contact rate at the backbone routers, however, is substantially more effective - it renders a slowdown comparable to deploying rate-limiting filters at every individual host that is covered. This result holds true even when susceptible and infected hosts are patched and immunized dynamically. To provide context for our analysis, we examine real traffic traces obtained from a campus-computing network. We observe that rate throttling could be enforced with minimal impact on legitimate communications. Two worms observed in the traces, however, would be significantly slowed down.

A mix is a communication proxy that attempts to hide the correspondence between its incoming and outgoing messages. Timing attacks are a significant challenge for mix-based systems that wish to support interactive, low-latency applications. However, the potency of these attacks has not been studied carefully. In this paper, we investigate timing analysis attacks on low-latency mix systems and clarify the threat they pose. We propose a novel technique, defensive dropping, to thwart timing attacks. Through simulations and analysis, we show that defensive dropping can be effective against attackers who employ timing analysis.