Resilient authentication using path independence

Reiter, Mike; Stubblebine, Stuart G.

doi:10.1109/12.737682

Cited by 60 publications

(49 citation statements)

References 17 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Crowdsourcing has long been explored by the security community, e.g., for spam detection where email recipients can flag emails as 'spam' [10,62], validating certificates [42,58], 'peer patching' where collaborating nodes can attain better security by sharing information [7,14], and improved security and privacy through a focus on communities [15,21]. Other examples of crowdsourcingbased systems are the Crowdroid malware-detection framework that dynamically analyzes apps' behaviors [6], and the Super-Ego framework that resides between the smartphone OS and apps and leverages crowdsourcing to decide whether to grant apps access to location [55].…”

Section: Related Work Crowdsourcingmentioning

confidence: 99%

To Permit or Not to Permit, That is the Usability Question: Crowdsourcing Mobile Apps’ Privacy Permission Settings

Ismail

Ahmed

Caine

et al. 2017

Proceedings on Privacy Enhancing Technologies

View full text Add to dashboard Cite

Abstract:Millions of apps available to smartphone owners request various permissions to resources on the devices including sensitive data such as location and contact information. Disabling permissions for sensitive resources could improve privacy but can also impact the usability of apps in ways users may not be able to predict. We study an efficient approach that ascertains the impact of disabling permissions on the usability of apps through large-scale, crowdsourced user testing with the ultimate goal of making recommendations to users about which permissions can be disabled for improved privacy without sacrificing usability. We replicate and significantly extend previous analysis that showed the promise of a crowdsourcing approach where crowd workers test and report back on various configurations of an app. Through a large, between-subjects user experiment, our work provides insight into the impact of removing permissions within and across different apps (our participants tested three apps: Facebook Messenger (N=218), Instagram (N=227), and Twitter (N=110)). We study the impact of removing various permissions within and across apps, and we discover that it is possible to increase user privacy by disabling app permissions while also maintaining app usability.

show abstract

Section: Related Work Crowdsourcingmentioning

confidence: 99%

To Permit or Not to Permit, That is the Usability Question: Crowdsourcing Mobile Apps’ Privacy Permission Settings

Ismail

Ahmed

Caine

et al. 2017

Proceedings on Privacy Enhancing Technologies

View full text Add to dashboard Cite

show abstract

“…They suggest using multiple paths to increase assurance on authentication. It is important to notice here that a Session Authority or SA in our system differs significantly from the security authority in [30]. A security authority is used to enforce security policies and processes for a security realm so as to prevent attacks from accessing the applications and resources within that realm.…”

Section: Related Workmentioning

confidence: 99%

“…The solution proposed in the paper adopts bridge CAs to connect the CAs in different security realms so that a certificate can be validated through a path which may cross multiple security realms. Reiter and Stubblebine in [30] argue that an authentication process in a large-scale distributed system often needs the assistance of a path of security authorities as it is difficult to locate a single authority to authenticate all the principals in the system. They suggest using multiple paths to increase assurance on authentication.…”

Section: Related Workmentioning

confidence: 99%

Dynamic Authentication for Cross-Realm SOA-Based Business Processes

Zhang

Liu

et al. 2012

IEEE Trans. Serv. Comput.

View full text Add to dashboard Cite

Abstract-Modern distributed applications are embedding an increasing degree of dynamism, from dynamic supply-chain management, enterprise federations, and virtual collaborations to dynamic resource acquisitions and service interactions across organizations. Such dynamism leads to new challenges in security and dependability. Collaborating services in a system with a Service-Oriented Architecture (SOA) may belong to different security realms but often need to be engaged dynamically at runtime. If their security realms do not have a direct cross-realm authentication relationship, it is technically difficult to enable any secure collaboration between the services. A potential solution to this would be to locate intermediate realms at runtime, which serve as an authentication-path between the two separate realms. However, the process of generating an authentication path for two distributed services can be highly complicated. It could involve a large number of extra operations for credential conversion and require a long chain of invocations to intermediate services. In this paper, we address this problem by designing and implementing a new cross-realm authentication protocol for dynamic service interactions, based on the notion of serviceoriented multi-party business sessions. Our protocol requires neither credential conversion nor establishment of any authentication path between the participating services in a business session. The correctness of the protocol is formally analyzed and proven, and an empirical study is performed using two production quality Grid systems, Globus 4 and CROWN. The experimental results indicate that the proposed protocol and its implementation have a sound level of scalability and impose only a limited degree of performance overhead, which is for example comparable with those security-related overheads in Globus 4.

show abstract

“…The present paper uses their calculation method as an underlying technique to further develop algorithms for solving the above problem. Reiter and Stubblebine [10] proposed resilient authentication by using redundant multiple independent trust paths constructed from a trusted certificate authority (CA) to gain increased assurance in the authentication for public key infrastructure (PKI). The drawback is that they did not quantitatively evaluate trust for certificates by implicitly assuming that each certificate has the same level of risk.…”

Section: Related Workmentioning

confidence: 99%

Authentication Trust Metric and Assessment for Federated Identity Management Systems

Gomi

2012

IEICE Trans. Inf. & Syst.

View full text Add to dashboard Cite

Resilient authentication using path independence

Cited by 60 publications

References 17 publications

To Permit or Not to Permit, That is the Usability Question: Crowdsourcing Mobile Apps’ Privacy Permission Settings

To Permit or Not to Permit, That is the Usability Question: Crowdsourcing Mobile Apps’ Privacy Permission Settings

Dynamic Authentication for Cross-Realm SOA-Based Business Processes

Authentication Trust Metric and Assessment for Federated Identity Management Systems

Contact Info

Product

Resources

About