Quantitative Evaluation of Enforcement Strategies

Abstract

In Security, monitors and enforcement mechanisms run in parallel with programs to check, and modify their run-time behaviour, respectively, in order to guarantee the satisfaction of a security policy. For the same policy, several enforcement strategies are possible. We provide a framework for quantitative monitoring and enforcement. Enforcement strategies are analysed according to user-defined parameters. This is done by extending the notion controller processes, that mimics the well-known edit automata, with weights on transitions, valued in a C-semiring. C-semirings permit one to be flexible and general in the quantitative criteria. Furthermore, we provide some examples of orders on controllers that are evaluated under incomparable criteria. * The research leading to these results has received funding from the European Union Seventh Framework Programme (FP7/2007-2013) under grants no 256980 (NESSoS) and no 295354 (SESAMO).

Automated Synthesis and Ranking of Secure BPMN Orchestrators

“…The workflow we adopt is described in Figure 1. For the first time, we transfer the related know-how from the abstract realm of process calculi, and Crypto-CCS in particular, to a real-world specification language, namely The research leading to these results has received funding from the European Union Seventh Framework Programme (FP7/2007-2013 and under grant no 257930 (Aniketos).…”

A multi-criteria ranking of security countermeasures

“…A countermeasure (or controlling strategy) [3] is a runtime execution trace of a controller E that follows the behaviour of a target F step by step acting according to control rules in Tab. 1.…”

“…Definition 3.2. [3] Given an agent F , and a semiring K, a controller E2 is better than a controller E1 w.r.…”

Automated Synthesis and Ranking of Secure BPMN Orchestrators

“…Clearly, non-functional requirements, such as QoS, could be used to evaluate quantitative aspects on orchestrators. Non functional aspects, including the degree of security, can be formalised using semirings, as done in [10]. Therein, security is a boolean value, determined by the violation of a policy.…”

“…Non-functional requirements, such as QoS, could be used to evaluate quantitative aspects on both orchestrators and attackers. Non functional aspects, including the degree of security, can be formalised using semirings, as done in Ciancia, Martinelli, Matteucci, and Morisset (2013).…”