Usage Control Enforcement: Present and Future

Pretschner, Alexander; Hilty, Manuel; Schütz, F.; Schaefer, Christian; Walter, Thomas

doi:10.1109/msp.2008.101

Cited by 55 publications

(44 citation statements)

References 4 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Enforcement of usage control requirements has been done at the OS level [26,27,3], at the X11 level [4], for Java [11,12,28], the .NET CIL [13] and machine languages [14,15,29]; at the level of an enterprise service bus [16]; for dedicated applications such as the Internet Explorer [17] and in the context of digital rights management [18][19][20]. These solutions focus on one of the two aspects of the problem: either data flow tracking or event-driven usage control.…”

Section: Related Workmentioning

confidence: 99%

“…opened, (lines 12-15) at most 4 further times and within 30 seconds (1 timestep = 1 second) after the first use (lines [8][9][10][11][12][13][14][15][16][17][18][19][20][21][22][23][24][25][26][27]; further attempts of opening the file will result in opening a predefined error message (lines 28-34).…”

Section: B1 Operating Systemmentioning

confidence: 99%

“…We do not discuss performance nor policy management either. Contribution Data flow tracking at specific layers of abstraction has been done in a multitude of ways [3,4,[11][12][13][14][15][16][17][18][19][20], also in the form of information flow analyses where implicit flows are also taken into account [21,22]. As far as we are aware, this work ends where sensitive (or tainted) data is moved to illegal sinks, e.g., when a file is written or an http post request is sent.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Representation-Independent Data Usage Control

Pretschner

Lovat

Büchler

2012

Data Privacy Management and Autonomous Spontaneus Security

Self Cite

View full text Add to dashboard Cite

Abstract. Usage control is concerned with what happens to data after access has been granted. In the literature, usage control models have been defined on the grounds of events that, somehow, are related to data. In order to better cater to the dimension of data, we extend a usage control model by the explicit distinction between data and representation of data. A data flow model is used to track the flow of data in-between different representations. The usage control model is then extended so that usage control policies can address not just one single representation (e.g., delete file1.txt after thirty days) but rather all representations of the data (e.g., if file1.txt is a copy of file2.txt, also delete file2.txt). We present three proof-of-concept implementations of the model, at the operating system level, at the browser level, and at the X11 level, and also provide an ad-hoc implementation for cross-layer enforcement.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: B1 Operating Systemmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Representation-Independent Data Usage Control

Pretschner

Lovat

Büchler

2012

Data Privacy Management and Autonomous Spontaneus Security

Self Cite

View full text Add to dashboard Cite

show abstract

“…Statebased contexts define conditions on the state which have to be true for a context to be true (hold). They are expressions of the following form 1 .…”

Section: B Obligation Specificationmentioning

confidence: 99%

“…The use of a policy-based approach to specify system requirements is getting more and more popular [1], [2], [3], [4], [5], [6]. This is because policies enable the uniform expression and the dynamic update of requirements as well as their formal analysis.…”

Section: Introductionmentioning

confidence: 99%

Testing Obligation Policy Enforcement Using Mutation Analysis

Elrakaiby

Mouelhi

Traon

2012

2012 IEEE Fifth International Conference on Software Testing, Verification and Validation

View full text Add to dashboard Cite

Abstract-The support of obligations with access control policies allows the expression of more sophisticated requirements such as usage control, availability and privacy. In order to enable the use of these policies, it is crucial to ensure their correct enforcement and management in the system. For this reason, this paper introduces a set of mutation operators for obligation policies. The paper first identifies key elements in obligation policy management, then presents mutation operators which injects minimal errors which affect these aspects. Test cases are qualified w.r.t. their ability in detecting problems, simulated by mutation, in the interactions between policy management and the application code. The use of policy mutants as substitutes for real flaws enables a first investigation of testing obligation policies in a system. We validate our work by providing an implementation of the mutation process: the experiments conducted on a Java program provide insights for improving test selection.

show abstract