On information flow forensics in business application scenarios

Proceedings - International Computer Software and Applications Conference

Volumn 2, Issue , 2009, Pages 324-328

  Wonnemann, Claus ^a   Accorsi, Rafael ^a   Müller, Günter ^a  

^a UNIVERSITY OF FREIBURG   (Germany)

Author keywords

[No Author keywords available]

Indexed keywords

BUSINESS APPLICATIONS; BUSINESS SOFTWARE; COVERT CHANNELS; INFORMATION FLOW POLICIES; INFORMATION FLOWS; POSTERIORI; RESEARCH CHALLENGES; SECURITY ANALYSIS; SOFTWARE APPLICATIONS;

COMPUTER APPLICATIONS; WORD PROCESSING;

COMPUTER SOFTWARE;

EID: 70449659976     PISSN: 07303157     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/COMPSAC.2009.154     Document Type: Conference Paper

References (28)

1. B. W. Lampson, "A note on the confinement problem," Comm. the ACM, vol.16, no.10, pp. 613-615, 1973.
2. A. Sabelfeld and A. C. Myers, "Language-based information-flow security," IEEE J-SAC, vol.21, no.1, pp. 5-19, 2003.
3. H. Koshutanski and F. Massacci, "An access control framework for business processes for web services," in ACM workshop on XML security. 2003, pp. 15-24.
4. R. Sandhu and P. Samarati, "Access control: Principles and practice," IEEE Comm. Mag., vol.32, no.9, pp. 40-48, 1994.
5. E. G. Sirer and K. Wang, "An access control language for web services," in ACM SACMAT. 2002, pp. 23-30.
6. R. Accorsi and C. Wonnemann, "Detective information flow analysis for business processes," in Business Processes, Services Computing and Intelligent Service Management, ser. LNI, vol.147, 2009, pp .223-224.
7. A. Bortz, D. Boneh, and P. Nandy, "Exposing private information by timing web applications," in Conf. World Wide Web. 2007, pp. 621-628.
8. D. Brumley and D. Boneh, "Remote timing attacks are practical," Comp. Net., vol.48, no.5,pp.701-716, 2005.
9. L. Sweeney, "k-Anonymity: A Model for Protecting Privacy," J. of Uncertainty, Fuzziness and Knowledge-Based Systems, vol.10, no.5, pp. 557-570, 2002.
10. K. J. Biba, "Integrity considerations for secure computer systems," The Mitre Corp., Tech. Rep., Apr. 1977.
11. J. A. Goguen and J. Meseguer, "Security policies and security models," in IEEE SSP, 1982, pp. 11-20.
12. M. R. Clarkson and F. B. Schneider, "Hyperproperties," in IEEE CSF. 2008, pp. 51-65.
13. "HIPAA: Health Insurance Portability and Accountability Act," http://www.cms.hhs.gov/HIPAAGenInfo/.
14. R. Accorsi, Y. Sato, and S. Kai, "Compliance monitor for early warning risk determination," Wirtschaftsinfor-matik, vol.50, no.5, October 2008 pp. 375-382.
15. P. Zave, "FAQ Sheet on Feature Interaction," http://www.research.att.com/ pamela/faq.html, 2004.
16. T. Endo, I. Echizen, and H. Yoshiura, "Electronic voting scheme to maintain anonymity in small-scale election by hiding the number of votes," in ARES Conference. 2008, pp. 1287-1293.
17. F. Schneider, "Enforceable Security Policies," ACM TISSEC, vol.3, no.1, pp. 30-50, 2000.
18. J. Mclean, "Security models," in Encyclopedia of Soft-ware Engineering. Wiley and Sons, 1994.
19. P. Shroff, S. F. Smith, and M. Thober, "Dynamic dependency monitoring to secure information flow," in IEEE CSF, 2007, pp. 203-217.
20. Á. Darvas, R. Hähnle, and D. Sands, "A theorem proving approach to analysis of secure information flow," SPC, ser. LNCS, vol.3450. 2005, pp. 193-209.
21. T. Amtoft and A. Banerjee, "Verification condition generation for conditional information flow," in ACM FMSE. 2007, pp. 2-11.
22. D. Volpano, C. Irvine, and G. Smith, "A sound type system for secure flow analysis," JCS, vol.4, no.2-3, pp. 167-187, 1996.
23. C. Hammer, J. Krinke, and G. Snelting, "Information flow control for java based on path conditions in dependence graphs," in IEEE ISSSE. 2006, pp. 87-96.
24. F. Pottier and V. Simonet, "Information flow inference for ML," in ACM TOPLAS, vol.37. 2002, pp. 319-330.
25. A. Myers, N. Nystrom, L. Zheng, and S. Zdancewic, "Jif: Java + information flow," 2001.
26. S. Zdancewic, "Challenges for information-flow security," PLID, 2004.
27. A. Zakinthinos and E. S. Lee, "A general theory of security properties," in IEEE SSP, 1997, pp. 94-102.
28. H. Mantel, "Possibilistic Definitions of Security - An Assembly Kit," in IEEE CSFW. 2000, pp. 185-199.