Corrective enforcement: A new paradigm of security policy enforcement by monitors

ACM Transactions on Information and System Security

Volumn 15, Issue 2, 2012, Pages

  Khoury, Raphaël ^a   Tawbi, Nadia ^a  

^a UNIVERSITÉ LAVAL   (Canada)

Author keywords

Dynamic analysis; Monitoring; Program transformation; Runtime monitors; Security policies enforcement

Indexed keywords

ENFORCEMENT MECHANISMS; PROGRAM TRANSFORMATIONS; RUNTIME MONITORING; RUNTIME MONITORS; SECURITY POLICY; SECURITY POLICY ENFORCEMENT; SECURITY PROPERTIES; UNTRUSTED CODE;

DYNAMIC ANALYSIS; MONITORING; SECURITY SYSTEMS;

ACCESS CONTROL;

EID: 84878587195     PISSN: 10949224     EISSN: 15577406     Source Type: Journal    
DOI: 10.1145/2240276.2240281     Document Type: Article

References (35)

1. ALPERN, B. AND SCHNEIDER, F. 1985. Defining liveness. Inform. Process Lett. 21, 4, 181-185.
2. BAUER, L., LIGATTI, J., AND WALKER, D. 2002. More enforceable security policies. In Proceedings of the Workshop on Foundations of Computer Security (FCS).
3. BEAUQUIER, D., COHEN, J., AND LANOTTE, R. 2009. Security policies enforcement using finite edit automata. Electron. Notes Theoret. Comput. Sci. 229, 3, 19-35.
4. BIELOVA, N. AND MASSACCI, F. 2011a. Do you really mean what you actually enforced? Intern. J. Inform. Secur. 10, 4, 1-16.
5. BIELOVA, N. AND MASSACCI, F. 2011b. Iterative enforcement by suppression: Towards practical enforcement theories. J. Comput. Secur. To appear.
6. BIELOVA, N. AND MASSACCI, F. 2011c. Predictability of enforcement. In Proceedings of the International Symposium on Engineering Secure Software and Systems. 73-86.
7. BIELOVA, N., MASSACCI, F., AND MICHELETTI, A. 2009. Towards practical enforcement theories. In Proceedings of the 14th Nordic Conference on Secure IT Systems (NordSec). 239-254.
8. BOEBERT, W. E. AND KAIN, R. Y. 1985. A practical alternative to hierarchical integrity policies. In Proceedings of the 8th National Computer Security Conference.
9. BREWER, D. F. C. AND NASH, M. J. 1989. The Chinese Wall security policy. In Proceedings of the IEEE Symposium on Security and Privacy. 206-214.
10. CHABOT, H., KHOURY, R., AND TAWBI, N. 2009. Generating in-line monitors for Rabin automata. In Proceedings of the 14th Nordic Conference on Secure IT Systems (NordSec). 287-301.
11. CHANG, E., MANNA, Z., AND PNUELI, A. 1991. The safety-progress classification. In Logic and Algebra of Specifications, F. Bauer, W. Brauer, and H. Schwichtenberg Eds., Springer-Verlag, 143-202.
12. D'AMORIM, M. AND ROŞU, G. 2005. Efficient monitoring of omega-languages. In Proceedings of the 17th International Conference on Computer Aided Verification (CAV). 364-378.
13. ERLINGSSON, U. AND SCHNEIDER, F. 2000. IRM enforcement of java stack inspection. In Proceedings of the IEEE Symposium on Security and Privacy. 246-255.
14. FALCONE, Y., FERNANDEZ, J.-C., AND MOUNIER, L. 2008. Synthesizing enforcement monitors wrt. The safety-progress classification of properties. In Proceedings of the 4th International Conference Information Systems Security (ICISS). 41-55.
15. FONG, P. 2004. Access control by tracking shallow execution history. In Proceedings of the IEEE Symposium on Security and Privacy.
16. HAMLEN, K.W.,MORRISETT, G., AND SCHNEIDER, F. 2006. Computability classes for enforcement mechanisms. ACM Trans. Prog. Lang. Syst. 28, 1, 175-205.
17. HAMLEN, M. S. K. W. 2011. Flexible in-lined reference monitor certification: Challenges and future directions. In Proceedings of the 5th ACM Workshop on Programming Languages Meets Program Verification (PLPV). 55-60.
18. JUN, P., XINGYUAN, C., BEI, W., XIANGDONG, D., AND YONGLIANG, W. 2008. Policy monitoring and a finite state automata model. In Proceedings of the International Conference on Computer Science and Software Engineering (CSSE). 646-649.
19. KHOURY, R. AND TAWBI, N. 2010a. Corrective enforcement of security policies. In Proceedings of the 7th International Workshop on Formal Aspects of Security & Trust (FAST).
20. KHOURY, R. AND TAWBI, N. 2010b. Using equivalence relations for corrective enforcement of security policies. In Proceedings of the 5th International Conference Mathematical Methods, Models, and Architectures for Computer Networks Security.
21. KIM, M., KANNAN, S., LEE, I., SOKOLSKY, O., AND VISWANATHAN, M. 2002. Computational analysis of run-time monitoring-fundamentals of java-mac. Electr. Notes Theor. Comput. Sci. 70, 4.
22. KUPFERMAN, O., LUSTIG, Y., AND VARDI, M. 2006. On locally checkable properties. In Proccedings of the 13th International Conference on Logic for Programming Artificial Intelligence and Reasoning.
23. LIGATTI, J., BAUER, L., AND WALKER, D. 2004. Edit automata: Enforcement mechanisms for run-time security policies. Intern. J. Inform. Secur. 4, 1-2, 2-16.
24. LIGATTI, J., BAUER, L., AND WALKER, D. 2005. Enforcing non-safety security policies with program monitors. In Proceedings of the 10th European Symposium on Research in Computer Security (ESORICS).
25. LIGATTI, J., BAUER, L., AND WALKER, D. 2009. Run-time enforcement of nonsafety policies. ACM Trans. Inf. Syst. Secur. 12, 3, 1-41.
26. LIGATTI, J. AND REDDY, S. 2010. A theory of runtime enforcement, with results. In Proceedings of the European Symposium on Research in Computer Security (ESORICS).
27. MEALY, G. H. 1955. A method for synthesizing sequential circuits. Bell System Tech. J. 34, 5, 1045-1079.
28. OULD-SLIMANE, H., MEJRI, M., AND ADI, K. 2009. Using edit automata for rewriting-based security enforcement. In Proceedings of 23rd Annual Conference on Data and Applications Security (IFIP). 175-190.
29. SCHNEIDER, F. 2000. Enforceable security policies. Inf. Syst. Secur. 3, 1, 30-50.
30. SOBEL, A. E. K. AND ALVES-FOSS, J. 1999. A trace-based model of the chinese wall security policy. In Proceedings of the 22nd National Information Systems Security Conference.
31. SYROPOULOS, A. 2001. Mathematics of multisets. In Proceedings of the Workshop on Multiset Processing. 347-358.
32. TALHI, C., TAWBI, N., AND DEBBABI, M. 2008. Execution monitoring enforcement under memorylimitations constraints. Inf. Comput. 206, 1, 158-184.
33. VISWANATHAN, M. 2000. Foundations for the run-time analysis of software systems. Ph.D. thesis, University of Pennsylvania.
34. YOUNG, W., TELEGA, P., AND BOEBERT,W. 1986. A verified labeler for the secure ada target. In Proceedings of the 9th National Computer Security Conference.
35. ZHU, G., TYAGI, A., AND ROOP, P. 2006. Stream automata as run-time monitors for open system security policies. Tech. rep. 06-101, Department of Electrical and Computer Engineering, Iowa State University, Ames, Iowa.