This paper presents the design of a new middleware which provides trust and accountability to distributed data sharing communities.  The main application for the project is within the context of scientific collaborations where many researchers share directly collected data, thus allowing them to create new data sets by performing transformations on existing shared data sets.  In data sharing communities one cannot always trust the data obtained from others in the community.  However the field of data provenance does not consider malicious or untrustworthy users.  By adding accountability to the provenance of each data set, this middlware ensures data integrity insofar as any errors can be identified and corrected.  The user is further protected from faulty data by a trust view created from past experiences and second-hand recommendations.  A trust view is based on real world social interactions and reflects each user’s own experiences within the community.  By identifying providers of faulty data and removing them from a trust view, the integrity of all data is increased.

Steganography is an ancient art. With the advent of computers, we have vast accessible bodies of data in which to hide information, and increasingly sophisticated techniques with which to analyze and recover that information. While much of the recent research in steganography has been centered on hiding data in images, many of the solutions that work for images are more complicated when applied to natural language text as a cover medium. Many approaches to steganalysis attempt to detect statistical anomalies in cover data which predict the presence of hidden information. Natural language cover texts must not only pass the statistical muster of automatic analysis, but also the minds of human readers. Linguistically na

Protection and secure exchange of Web documents is becoming a crucial need for many internetbased applications. Securing Web documents entail addressing two main issues: confidentiality and integrity. Ensuring document confidentiality means that document contents can only be disclosed to subjects authorized according to specified security policies, whereas by document integrity we mean that the document contents are correct with respect to a given application domain and that the document contents are modified only by authorized subjects. Whereas the problem of document confidentiality has been widely investigated in the literature, the problem of how to ensure that a document, when moving among different parties, is modified only according to the stated policies still lacks comprehensive solutions. In this paper we present a solution to this problem by proposing a model for specifying update policies, and an infrastructure supporting the specification and enforcement of these policies in a distributed and cooperative environment, in which subjects in different organizational roles can modify possibly different portions of the same document. The key aspect of our proposal is that, by using a combination of hash functions and digital signature techniques, we create a distributed environment that enable subjects, in most cases, to verify, upon receiving a document, whether the update operations performed on the document till that point are correct with respect to the update policies, without interacting with the document server. Our approach is particularly suited for environments, such as mobile systems, pervasive systems, decentralized workflows, and peer-to-peer systems.

A key challenge in Web services security is the design of effective access control schemes that can adequately meet the unique security challenges posed by the Web services paradigm. Despite the recent advances in Web based access control approaches applicable to Web services, there remain issues that impede the development of effective access control models for Web services environment. Amongst them are the lack of context-aware models for access control, and reliance on identity or capability-based access control schemes. In this paper, we motivate the design of an access control scheme that addresses these issues, and propose an extended, trust-enhanced version of our XML-based Role Based Access Control (X-RBAC) framework that incorporates context-based access control. We outline the configuration mechanism needed to apply our model to the Web services environment, and also describe the implementation architecture for the system.

SUPERCEDED BY CERIAS TR 2005-26

We propose Oblivious Attribute Certificates (OACerts), an attribute certificate scheme in which a certificate holder can select which attributes to use and how to use them.  In particular, a user can use attribute values stored in an OACert obliviously, \ie, the user obtains a service if and only if the attribute values satisfy the policy of the service provider, yet the service provider learns nothing about these attribute values.

To build OACerts, we propose a new cryptographic primitive called Oblivious Commitment Based Envelope (OCBE).  In an OCBE scheme, Bob has an attribute value committed to Alice and Alice runs a protocol with Bob to send an envelope (encrypted message) to Bob such that: (1) Bob can open the envelope if and only if his committed attribute value satisfies a predicate chosen by Alice. (2) Alice learns nothing about Bob’s attribute value. We develop provably secure and efficient OCBE protocols for the Pedersen commitment scheme and predicates such as $=,\ge,\le,>,<,\ne$ as well as logical combinations of them.

Comparing the expressive power of access control models is recognized as a fundamental problem in computer security.  Such comparisons are generally based on simulations between different access control schemes.  However, the definitions for simulations that are used in the literature make it impossible to put results and claims about the expressive power of access control models into a single context.  Furthermore, some definitions for simulations used in the literature such as those used for comparing RBAC (Role-Based Access Control)  with other models, are too weak to distinguish access control models from one another in a meaningful way.

We propose a theory for comparing the expressive power of access control models. We perceive access control systems as state-transition systems and require simulations to preserve security properties.  We discuss the rationale behind such a theory,  apply the theory to reexamine some existing work on the expressive power of access control models in the literature and present three results. We show that: (1) RBAC with a particular administrative model from the literature (ARBAC97) is limited in its expressive power; (2) ATAM (Augmented Typed Access Matrix) is more expressive than TAM (Typed Access Matrix), thereby solving an open problem posed in the literature;  and (3) a trust-management language is at least as expressive as RBAC with a particular administrative model (the URA97 component of ARBAC97).

While Open Source software is routinely described as “more secure” than commercial off the shelf software, all available evidence suggests that there is little difference in the level of trust that should be accorded either type of system. The paper also relies on an analysis using risk perception theory to explain why Open Source is widely believed to be “more secure” than other types of software.

BGP is essential to the operation of the Internet, but is vulnerable to both accidental failures and malicious attacks. We propose a new protocol that works in concert with BGP, which Autonomous Systems will use to help detect and mitigate accidentally or maliciously introduced faulty routing information. The protocol differs from previous efforts at securing BGP in that it is receiver-driven, meaning that there is a mechanism for recipients of BGP UPDATE messages to corroborate the information ...