The Experts below are selected from a list of 210456 Experts worldwide ranked by ideXlab platform

Quirion Pierre-olivier - One of the best experts on this subject based on the ideXlab platform.

  • Software architectures to integrate workflow engines in science gateways
    2017
    Co-Authors: Glatard Tristan, Rousseau Marc-etienne, Camarasu-pop Sorina, Adalat Reza, Beck Natacha, Das Samir, Da Silva, Rafael Ferreira, Khalili-mahani Najmeh, Korkhov Vladimir, Quirion Pierre-olivier
    Abstract:

    Science gateways often rely on workflow engines to execute applications on distributed infrastructures. We investigate six software architectures commonly used to integrate workflow engines into science gateways. In tight integration, the workflow engine shares software components with the science gateway. In service invocation, the engine is isolated and invoked through a specific software interface. In task encapsulation, the engine is wrapped as a computing task executed on the infrastructure. In the pool model, the engine is bundled in an agent that connects to a central pool to fetch and execute workflows. In nested workflows, the engine is integrated as a Child Process of another engine. In workflow conversion, the engine is integrated through workflow language conversion. We describe and evaluate these architectures with metrics for assessment of integration complexity, robustness, extensibility, scalability and functionality. Tight integration and task encapsulation are the easiest to integrate and the most robust. Extensibility is equivalent in most architectures. The pool model is the most scalable one and meta-workflows are only available in nested workflows and workflow conversion. These results provide insights for science gateway architects and developers. (C) 2017 The Author(s). Published by Elsevier B.

  • Software architectures to integrate workflow engines in science gateways
    'Elsevier BV', 2017
    Co-Authors: Glatard Tristan, Rousseau Marc-etienne, Camarasu-pop Sorina, Adalat Reza, Beck Natacha, Das Samir, Khalili-mahani Najmeh, Korkhov Vladimir, Ferreira Da Silva, Rafael, Quirion Pierre-olivier
    Abstract:

    International audienceScience gateways often rely on workflow engines to execute applications on distributed infrastructures. We investigate six software architectures commonly used to integrate workflow engines into science gateways. In tight integration, the workflow engine shares software components with the science gateway. In service invocation, the engine is isolated and invoked through a specific software interface. In task encapsulation, the engine is wrapped as a computing task executed on the infrastructure. In the pool model, the engine is bundled in an agent that connects to a central pool to fetch and execute workflows. In nested workflows, the engine is integrated as a Child Process of another engine. In workflow conversion, the engine is integrated through workflow language conversion. We describe and evaluate these architectures with metrics for assessment of integration complexity, robustness, extensibility, scalability and functionality. Tight integration and task encapsulation are the easiest to integrate and the most robust. Extensibility is equivalent in most architectures. The pool model is the most scalable one and meta-workflows are only available in nested workflows and workflow conversion. These results provide insights for science gateway architects and developers

Jeon Yuseok - One of the best experts on this subject based on the ideXlab platform.

  • PoLPer: Process-Aware Restriction of Over-Privileged Setuid Calls in Legacy Applications
    'Association for Computing Machinery (ACM)', 2019
    Co-Authors: Jeon Yuseok, Li Zhichun, Rhee Junghwan, Kim, Chung Hwan, Payer Mathias, Lee Byoungyoung, Wu Zhenyu
    Abstract:

    setuid system calls enable critical functions such as user authentications and modular privileged components. Such operations must only be executed after careful validation. However, current systems do not perform rigorous checks, allowing exploitation of privileges through memory corruption vulnerabilities in privileged programs. As a solution, understanding which setuid system calls can be invoked in what context of a Process allows precise enforcement of least privileges. We propose a novel comprehensive method to systematically extract and enforce least privilege of setuid system calls to prevent misuse. Our approach learns the required Process contexts of setuid system calls along multiple dimensions: Process hierarchy, call stack, and parameter in a Process-aware way. Every setuid system call is then restricted to the per-Process context by our kernel-level context enforcer. Previous approaches without Process-awareness are too coarse-grained to control setuid system calls, resulting in over-privilege. Our method reduces available privileges even for identical code depending on whether it is run by a parent or a Child Process. We present our prototype called PoLPer which systematically discovers only required setuid system calls and effectively prevents real-world exploits targeting vulnerabilities of the setuid family of system calls in popular desktop and server software at near zero overhead

  • Polper: Process-aware restriction of over-privileged setuid calls in legacy applications
    'Association for Computing Machinery (ACM)', 2019
    Co-Authors: Jeon Yuseok, Rhee J., Kim C.h., Li Z., Payer M., Lee B., Wu Z.
    Abstract:

    setuid system calls enable critical functions such as user authentications and modular privileged components. Such operations must only be executed after careful validation. However, current systems do not perform rigorous checks, allowing exploitation of privileges through memory corruption vulnerabilities in privileged programs. As a solution, understanding which setuid system calls can be invoked in what context of a Process allows precise enforcement of least privileges. We propose a novel comprehensive method to systematically extract and enforce least privilege of setuid system calls to prevent misuse. Our approach learns the required Process contexts of setuid system calls along multiple dimensions: Process hierarchy, call stack, and parameter in a Process-aware way. Every setuid system call is then restricted to the per-Process context by our kernel-level context enforcer. Previous approaches without Process-awareness are too coarse-grained to control setuid system calls, resulting in over-privilege. Our method reduces available privileges even for identical code depending on whether it is run by a parent or a Child Process. We present our prototype called PoLPer which systematically discovers only required setuid system calls and effectively prevents real-world exploits targeting vulnerabilities of the setuid family of system calls in popular desktop and server software at near zero overhead. ?? 2019 Copyright held by the owner/author(s)

Glatard Tristan - One of the best experts on this subject based on the ideXlab platform.

  • Software architectures to integrate workflow engines in science gateways
    2017
    Co-Authors: Glatard Tristan, Rousseau Marc-etienne, Camarasu-pop Sorina, Adalat Reza, Beck Natacha, Das Samir, Da Silva, Rafael Ferreira, Khalili-mahani Najmeh, Korkhov Vladimir, Quirion Pierre-olivier
    Abstract:

    Science gateways often rely on workflow engines to execute applications on distributed infrastructures. We investigate six software architectures commonly used to integrate workflow engines into science gateways. In tight integration, the workflow engine shares software components with the science gateway. In service invocation, the engine is isolated and invoked through a specific software interface. In task encapsulation, the engine is wrapped as a computing task executed on the infrastructure. In the pool model, the engine is bundled in an agent that connects to a central pool to fetch and execute workflows. In nested workflows, the engine is integrated as a Child Process of another engine. In workflow conversion, the engine is integrated through workflow language conversion. We describe and evaluate these architectures with metrics for assessment of integration complexity, robustness, extensibility, scalability and functionality. Tight integration and task encapsulation are the easiest to integrate and the most robust. Extensibility is equivalent in most architectures. The pool model is the most scalable one and meta-workflows are only available in nested workflows and workflow conversion. These results provide insights for science gateway architects and developers. (C) 2017 The Author(s). Published by Elsevier B.

  • Software architectures to integrate workflow engines in science gateways
    'Elsevier BV', 2017
    Co-Authors: Glatard Tristan, Rousseau Marc-etienne, Camarasu-pop Sorina, Adalat Reza, Beck Natacha, Das Samir, Khalili-mahani Najmeh, Korkhov Vladimir, Ferreira Da Silva, Rafael, Quirion Pierre-olivier
    Abstract:

    International audienceScience gateways often rely on workflow engines to execute applications on distributed infrastructures. We investigate six software architectures commonly used to integrate workflow engines into science gateways. In tight integration, the workflow engine shares software components with the science gateway. In service invocation, the engine is isolated and invoked through a specific software interface. In task encapsulation, the engine is wrapped as a computing task executed on the infrastructure. In the pool model, the engine is bundled in an agent that connects to a central pool to fetch and execute workflows. In nested workflows, the engine is integrated as a Child Process of another engine. In workflow conversion, the engine is integrated through workflow language conversion. We describe and evaluate these architectures with metrics for assessment of integration complexity, robustness, extensibility, scalability and functionality. Tight integration and task encapsulation are the easiest to integrate and the most robust. Extensibility is equivalent in most architectures. The pool model is the most scalable one and meta-workflows are only available in nested workflows and workflow conversion. These results provide insights for science gateway architects and developers

Wu Zhenyu - One of the best experts on this subject based on the ideXlab platform.

  • PoLPer: Process-Aware Restriction of Over-Privileged Setuid Calls in Legacy Applications
    'Association for Computing Machinery (ACM)', 2019
    Co-Authors: Jeon Yuseok, Li Zhichun, Rhee Junghwan, Kim, Chung Hwan, Payer Mathias, Lee Byoungyoung, Wu Zhenyu
    Abstract:

    setuid system calls enable critical functions such as user authentications and modular privileged components. Such operations must only be executed after careful validation. However, current systems do not perform rigorous checks, allowing exploitation of privileges through memory corruption vulnerabilities in privileged programs. As a solution, understanding which setuid system calls can be invoked in what context of a Process allows precise enforcement of least privileges. We propose a novel comprehensive method to systematically extract and enforce least privilege of setuid system calls to prevent misuse. Our approach learns the required Process contexts of setuid system calls along multiple dimensions: Process hierarchy, call stack, and parameter in a Process-aware way. Every setuid system call is then restricted to the per-Process context by our kernel-level context enforcer. Previous approaches without Process-awareness are too coarse-grained to control setuid system calls, resulting in over-privilege. Our method reduces available privileges even for identical code depending on whether it is run by a parent or a Child Process. We present our prototype called PoLPer which systematically discovers only required setuid system calls and effectively prevents real-world exploits targeting vulnerabilities of the setuid family of system calls in popular desktop and server software at near zero overhead

Wu Z. - One of the best experts on this subject based on the ideXlab platform.

  • Polper: Process-aware restriction of over-privileged setuid calls in legacy applications
    'Association for Computing Machinery (ACM)', 2019
    Co-Authors: Jeon Yuseok, Rhee J., Kim C.h., Li Z., Payer M., Lee B., Wu Z.
    Abstract:

    setuid system calls enable critical functions such as user authentications and modular privileged components. Such operations must only be executed after careful validation. However, current systems do not perform rigorous checks, allowing exploitation of privileges through memory corruption vulnerabilities in privileged programs. As a solution, understanding which setuid system calls can be invoked in what context of a Process allows precise enforcement of least privileges. We propose a novel comprehensive method to systematically extract and enforce least privilege of setuid system calls to prevent misuse. Our approach learns the required Process contexts of setuid system calls along multiple dimensions: Process hierarchy, call stack, and parameter in a Process-aware way. Every setuid system call is then restricted to the per-Process context by our kernel-level context enforcer. Previous approaches without Process-awareness are too coarse-grained to control setuid system calls, resulting in over-privilege. Our method reduces available privileges even for identical code depending on whether it is run by a parent or a Child Process. We present our prototype called PoLPer which systematically discovers only required setuid system calls and effectively prevents real-world exploits targeting vulnerabilities of the setuid family of system calls in popular desktop and server software at near zero overhead. ?? 2019 Copyright held by the owner/author(s)