Detecting and resolving policy misconfigurations in access-control systems

ACM Transactions on Information and System Security

Volumn 14, Issue 1, 2011, Pages

  Bauer, Lujo ^a   Garriss, Scott ^b   Reiter, Michael K ^c  

^a CARNEGIE MELLON UNIVERSITY   (United States)

^b GOOGLE INC   (United States)

^c Brooks Computer Science Building   (United States)

Author keywords

Access control; Machine learning; Policy inference

Indexed keywords

ASSOCIATION RULE MINING; MACHINE-LEARNING; MISCONFIGURATIONS; PRIMARY CONTRIBUTION;

CONTROL SYSTEMS; HEALTH CARE;

ACCESS CONTROL;

EID: 79959832940     PISSN: 10949224     EISSN: 15577406     Source Type: Journal    
DOI: 10.1145/1952982.1952984     Document Type: Conference Paper

References (29)

1. AGRAWAL, R. AND SRIKANT, R. 1994. Fast algorithms for mining association rules. In Proceedings of the 20th International Conference on Very Large Data Bases (VLDB).
2. AL-SHAER, E. S. AND HAMED, H. H. 2004. Discovery of policy anomalies in distributed firewalls. In Proceedings of the 23rd Annual Joint Conference of the IEEE Computer and Communications Societies.
3. APPEL, A. W. AND FELTEN, E.W. 1999. Proof-carrying authentication. In Proceedings of the 6th ACMConference on Computer and Communications Security.
4. BARTAL, Y., MAYER, A. J., NISSIM, K., AND WOOL, A. 1999. Firmato: A novel firewall management toolkit. In Proceedings of the IEEE Symposium on Security and Privacy.
5. BAUER, L., CRANOR, L. F., REITER, M. K., AND VANIEA, K. 2007a. Lessons learned from the deployment of a smartphone-based access-control system. In Proceedings of the 3rd Symposium on Usable Privacy and Security.
6. BAUER, L., GARRISS, S.,MCCUNE, J. M., REITER, M. K., ROUSE, J., AND RUTENBAR, P. 2005. Device-enabled authorization in the Grey system. In Information Security: Proceedings of the 8th International Conference,Lecture Notes in Computer Science, vol. 3650. Springer, Berlin, Germany, 63-81.
7. BAUER, L., GARRISS, S., AND REITER, M. K. 2007b. Efficient proving for practical distributed access-control systems. In Proceedings of the 12th European Symposium on Research in Computer Security (ESORICS).
8. BECKER, M. AND SEWELL, P. 2004. Cassandra: Flexible trust management, applied to electronic health records. In Proceedings of the 17th IEEE Computer Security Foundations Workshop.
9. BHATTI, R. AND GRANDISON, T. 2007. Towards improved privacy policy coverage in healthcare using policy refinement. In Proceedings of the 4th VLDB Workshop on Secure Data Management.
10. BLAZE, M., FEIGENBAUM, J., AND LACY, J. 1996. Decentralized trust management. In Proceedings of the IEEE Symposium on Security and Privacy.
11. EL-ARINI, K. AND KILLOURHY, K. 2005. Bayesian detection of router configuration anomalies. In Proceedings of the ACM SIGCOMM Workshop on Mining Network Data.
12. GOFFEE, N. C., KIM, S. H., SMITH, S., TAYLOR, P., ZHAO, M., AND MARCHESINI, J. 2004. Greenpass: Decentralized, PKI-based authorization for wireless LANs. In Proceedings of the 3rd Annual PKI Research and Development Workshop.
13. HAZELHURST, S., ATTAR, A., AND SINNAPPAN, R. 2000. Algorithms for improving the dependability of firewall and filter rule lists. In Proceedings of the International Conference on Dependable Systems and Networks.
14. JAEGER, T., EDWARDS, A., AND ZHANG, X. 2003. Policy management using access control spaces. ACM Trans. Inform. Syst. Sec. 6, 3, 327-364.
15. JIM, T. 2001. SD3: A trust management system with certified evaluation. In Proceedings of the IEEE Symposium on Security and Privacy.
16. KEROMYTIS, A. D., IOANNIDIS, S., GREENWALD, M. B., AND SMITH, J. M. 2003. The STRONGMAN architecture. In Proceedings of the 3rd DARPA Information Survivability Conference and Exposition.
17. KUHLMANN, M., SHOHAT, D., AND SCHIMPF, G. 2003. Role mining-revealing business roles for security administration using data mining technology. In Proceedings of the 8th ACM Symposium on Access Control Models and Technologies (SACMAT).
18. LE, F., LEE, S., WONG, T., KIM, H. S., AND NEWCOMB, D. 2006. Minerals: Using data mining to detect router misconfigurations. In Proceedings of the SIGCOMM Workshop on Mining Network Data (Mine Net). 293-298. (Pubitemid 46740692)
19. LI, N. AND MITCHELL, J. C. 2003. Rt: A role-based trust-management framework. In Proceedings of the 3rd DARPA Information Survivability Conference and Exposition. MAYER, A., WOOL, A., AND ZISKIND, E. 2000. Fang: A firewall analysis engine. In Proceedings of the IEEE Symposium on Security and Privacy.
20. MOLLOY, I.,CHEN, H.,LI, T.,WANG, Q.,LI, N.,BERTINO, E.,CALO, S., AND LOBO, J. 2008. Mining roleswith semantic meanings. In Proceedings of the 13th ACM Symposium on Access Control Models and Technologies (SACMAT). 21-30.
21. MOLLOY, I., LI, N., LI, T., MAO, Z., WANG, Q., AND LOBO, J. 2009. Evaluating role mining algorithms. In Proceedings of the 14th ACM Symposium on Access Control Models and Technologies (SACMAT). 95-104.
22. RIVEST, R. L. AND LAMPSON, B. 1996. SDSI-A simple distributed security infrastructure. Presented at the International Cryptology Conference. Rump session.
23. SANDHU, R.,COYNE, E.,FEINSTEIN,H., AND YOUMAN, C. 1996. Role-based access controlmodels. IEEE Comp. 29, 2.
24. SCHLEGELMILCH, J. AND STEFFENS,U. 2005. Role mining with ORCA. In Proceedings of the 10th ACMSymposium on Access Control Models and Technologies (SACMAT).
25. VAIDYA, J., ATLURI, V., AND GUO, Q. 2007. The role mining problem: Finding a minimal descriptive set of roles. In Proceedings of the 12th ACM Symposium on Access Control Models and Technologies (SACMAT).
26. WINSLETT, M., ZHANG, C. C., AND BONATTI, P. A. 2005. PeerAccess: A logic for distributed authorization. In Proceedings of the 12th ACM Conference on Computer and Communications Security.
27. WOOL, A. 2001. Architecting the Lumeta firewall analyzer. In Proceedings of the 10th USENIX Security Symposium.
28. YUAN, L.,MAI, J., SU, Z., CHEN, H., CHUAH, C.-N., AND MOHAPATRA, P. 2006. FIREMAN: A toolkit for FIREwall modeling and ANalysis. In Proceedings of the IEEE Symposium on Security and Privacy.
29. YUAN, Y. AND HUANG, T. 2005. A matrix algorithm for mining association rules. In Proceedings of the International Conference on Intelligent Computing (ICIC). Lecture Notes in Computer Science, vol. 3644, Springer, Berlin, Germany.