The Experts below are selected from a list of 11277 Experts worldwide ranked by ideXlab platform
Reihaneh Safavi-naini - One of the best experts on this subject based on the ideXlab platform.
-
A multi-level view model for secure object-oriented databases
Data & Knowledge Engineering, 1997Co-Authors: Ahmad Baraani-dastjerdi, Josef Pieprzyk, Reihaneh Safavi-nainiAbstract:Abstract In this paper, we employ the view model given by Bertino to design a secure multi-level object-oriented database system. The central idea is to provide users with multi-level views derived from a single-level secure object-oriented database. The database operations performed on multi-level views are decomposed into a set of operations on single-level objects which can be implemented on any conventional Mandatory Security kernel. We show that this approach allows us to overcome the difficulties of handling content and context dependent classification, dynamic classification and aggregation and inference problems in multi-level object-oriented databases.
-
ACISP - Modeling a multi-level secure object-oriented database using views
Information Security and Privacy, 1996Co-Authors: Ahmad Baraani-dastjerdi, Josef Pieprzyk, Reihaneh Safavi-nainiAbstract:In this paper, we employ the view model given by Bertino to propose a new design approach for a secure multi-level object-oriented database system. The central idea is to provide the user with a multilevel view derived from a single-level secure object-oriented database. Hence the database operations performed on the multi-level views are decomposed into a set of operations on the single-level objects which can be implemented on any conventional Mandatory Security kernel.
Tzicker Chiueh - One of the best experts on this subject based on the ideXlab platform.
-
tracking payment card data flow using virtual machine state introspection
Annual Computer Security Applications Conference, 2011Co-Authors: Jennia Hizver, Tzicker ChiuehAbstract:Credit and debit card payment processing systems are key elements in financial transactions. Negligence in securing these systems makes them vulnerable to hacking attacks, which may lead to significant monetary losses for both merchants and the financial organizations. To reduce this risk, Mandatory Security compliance regulations, such as the Payment Card Industry Data Security Standard (PCI DSS), were developed and adopted by the industry. A key pre-requisite of the PCI DSS compliance process is the ability to identify the components of the payment systems directly involved with the card data (i.e. process, transmit, or store). However, existing data flow tracking tools cannot fully automate the process of identifying system components that touch card data, because they either can not examine encrypted communications or they use an instrumentation-based approach and thus require a priori detailed knowledge of the payment card processing systems. We describe the implementation and evaluation of a novel tool to identify the card data flow in commercial payment card processing systems running on virtualized servers. The tool performs realtime monitoring of network communications between virtual machines and inspects the memory of the communicating processes for unencrypted card data. Our implementation does not require instrumentation of application binaries and can accurately identify the system components involved in card data flow even when the communications among system components are encrypted. Effectiveness of this tool is demonstrated through its successful discovery of the card data flow of several open- and closed-source payment card processing applications.
-
ACSAC - Tracking payment card data flow using virtual machine state introspection
Proceedings of the 27th Annual Computer Security Applications Conference on - ACSAC '11, 2011Co-Authors: Jennia Hizver, Tzicker ChiuehAbstract:Credit and debit card payment processing systems are key elements in financial transactions. Negligence in securing these systems makes them vulnerable to hacking attacks, which may lead to significant monetary losses for both merchants and the financial organizations. To reduce this risk, Mandatory Security compliance regulations, such as the Payment Card Industry Data Security Standard (PCI DSS), were developed and adopted by the industry. A key pre-requisite of the PCI DSS compliance process is the ability to identify the components of the payment systems directly involved with the card data (i.e. process, transmit, or store). However, existing data flow tracking tools cannot fully automate the process of identifying system components that touch card data, because they either can not examine encrypted communications or they use an instrumentation-based approach and thus require a priori detailed knowledge of the payment card processing systems. We describe the implementation and evaluation of a novel tool to identify the card data flow in commercial payment card processing systems running on virtualized servers. The tool performs realtime monitoring of network communications between virtual machines and inspects the memory of the communicating processes for unencrypted card data. Our implementation does not require instrumentation of application binaries and can accurately identify the system components involved in card data flow even when the communications among system components are encrypted. Effectiveness of this tool is demonstrated through its successful discovery of the card data flow of several open- and closed-source payment card processing applications.
-
SRDS - Automated Discovery of Credit Card Data Flow for PCI DSS Compliance
2011 IEEE 30th International Symposium on Reliable Distributed Systems, 2011Co-Authors: Jennia Hizver, Tzicker ChiuehAbstract:Credit cards are key instruments in personal financial transactions. Credit card payment systems used in these transactions and operated by merchants are often targeted by hackers to steal the card data. To address this threat, the payment card industry establishes a Mandatory Security compliance standard for businesses that process credit cards. A central pre-requisite for this compliance procedure is to identify the credit card data flow, specifically, the stages of the card transaction processing and the server nodes that touch credit card data as they travel through the organization. In practice, this pre-requisite poses a challenge to merchants. As the payment infrastructure is implemented and later maintained, it often deviates from the original documented design. Without consistent tracking and auditing of changes, such deviations in many cases remain undocumented. Therefore building the credit card data flow for a given payment card processing infrastructure is considered a daunting task that at this point requires significant manual efforts. This paper describes a tool that is designed to automate the task of identifying the credit card data flow in commercial payment systems running on virtualized servers hosted in private cloud environments. This tool leverages virtual machine introspection technology to keep track of credit card data flows across multiple machines in real time without requiring intrusive instrumentation of the hyper visor, virtual machines, middleware or application source code. Effectiveness of this tool is demonstrated through its successful discovery of the credit card data flow of several open and closed source payment applications.
Ahmad Baraani-dastjerdi - One of the best experts on this subject based on the ideXlab platform.
-
A multi-level view model for secure object-oriented databases
Data & Knowledge Engineering, 1997Co-Authors: Ahmad Baraani-dastjerdi, Josef Pieprzyk, Reihaneh Safavi-nainiAbstract:Abstract In this paper, we employ the view model given by Bertino to design a secure multi-level object-oriented database system. The central idea is to provide users with multi-level views derived from a single-level secure object-oriented database. The database operations performed on multi-level views are decomposed into a set of operations on single-level objects which can be implemented on any conventional Mandatory Security kernel. We show that this approach allows us to overcome the difficulties of handling content and context dependent classification, dynamic classification and aggregation and inference problems in multi-level object-oriented databases.
-
ACISP - Modeling a multi-level secure object-oriented database using views
Information Security and Privacy, 1996Co-Authors: Ahmad Baraani-dastjerdi, Josef Pieprzyk, Reihaneh Safavi-nainiAbstract:In this paper, we employ the view model given by Bertino to propose a new design approach for a secure multi-level object-oriented database system. The central idea is to provide the user with a multilevel view derived from a single-level secure object-oriented database. Hence the database operations performed on the multi-level views are decomposed into a set of operations on the single-level objects which can be implemented on any conventional Mandatory Security kernel.
Teresa F. Lunt - One of the best experts on this subject based on the ideXlab platform.
-
IEEE Symposium on Security and Privacy - The SeaView Security model
Proceedings. 1988 IEEE Symposium on Security and Privacy, 1Co-Authors: Dorothy E. Denning, Teresa F. Lunt, Roger R. Schell, W.r. Shockley, Mark R. HeckmanAbstract:A formal Security policy model that uses basic view concepts for a secure multilevel relational database system is described. The model is formulated in two layers, one corresponding to a Security kernel of reference monitor that enforces Mandatory Security, and the other defining multilevel relations and formalizing policies for labeling new and derived data, data consistency, discretionary Security, and transaction consistency. This includes the policies for sanitization, aggregation, and downgrading. The model also defines application-independent properties for entity integrity, referential integrity, and polyinstantiation integrity. >
-
ACSAC - Multilevel Security for knowledge based systems
[1990] Proceedings of the Sixth Annual Computer Security Applications Conference, 1Co-Authors: T.d. Garvey, Teresa F. LuntAbstract:Work aimed at defining a multilevel, Mandatory Security policy for knowledge based systems. The authors address two distinct issues: an effective implementation formalism based on a multilevel, object oriented programming paradigm and requirements for ensuring the correctness of inferences computed on the basis of possibly contradictory information from different access classes. They define requirements for an object-oriented system capable of handling multilevel objects within a single access class. They then outline a method by which multilevel objects may be used to implement a simple knowledge based system built on production rules. The authors argue that the issues regarding correctness are similar to those of truth maintenance in standard knowledge based systems and may be addressed by similar methods. >
-
IEEE Symposium on Security and Privacy - Security for object-oriented database systems
Proceedings 1992 IEEE Computer Society Symposium on Research in Security and Privacy, 1Co-Authors: Jonathan K. Millen, Teresa F. LuntAbstract:A design approach for a secure multilevel object-oriented database system is proposed by which a multilevel object-oriented system can be implemented on a conventional Mandatory Security kernel. Each object is assigned a single Security level that applies to all its contents (variables and methods). The informal Security policy model includes properties such as compatibility of Security level assignments with the class hierarchy. After discussing the essential features of a general object system model, and then extending the object model to incorporate Mandatory label-based Security, it is shown how typical database Security and integrity policies can be supported by this model, with special attention to inference problems and integrity constraints. The representation of integrity constraints and classification constraints are illustrated. >
Jennia Hizver - One of the best experts on this subject based on the ideXlab platform.
-
tracking payment card data flow using virtual machine state introspection
Annual Computer Security Applications Conference, 2011Co-Authors: Jennia Hizver, Tzicker ChiuehAbstract:Credit and debit card payment processing systems are key elements in financial transactions. Negligence in securing these systems makes them vulnerable to hacking attacks, which may lead to significant monetary losses for both merchants and the financial organizations. To reduce this risk, Mandatory Security compliance regulations, such as the Payment Card Industry Data Security Standard (PCI DSS), were developed and adopted by the industry. A key pre-requisite of the PCI DSS compliance process is the ability to identify the components of the payment systems directly involved with the card data (i.e. process, transmit, or store). However, existing data flow tracking tools cannot fully automate the process of identifying system components that touch card data, because they either can not examine encrypted communications or they use an instrumentation-based approach and thus require a priori detailed knowledge of the payment card processing systems. We describe the implementation and evaluation of a novel tool to identify the card data flow in commercial payment card processing systems running on virtualized servers. The tool performs realtime monitoring of network communications between virtual machines and inspects the memory of the communicating processes for unencrypted card data. Our implementation does not require instrumentation of application binaries and can accurately identify the system components involved in card data flow even when the communications among system components are encrypted. Effectiveness of this tool is demonstrated through its successful discovery of the card data flow of several open- and closed-source payment card processing applications.
-
ACSAC - Tracking payment card data flow using virtual machine state introspection
Proceedings of the 27th Annual Computer Security Applications Conference on - ACSAC '11, 2011Co-Authors: Jennia Hizver, Tzicker ChiuehAbstract:Credit and debit card payment processing systems are key elements in financial transactions. Negligence in securing these systems makes them vulnerable to hacking attacks, which may lead to significant monetary losses for both merchants and the financial organizations. To reduce this risk, Mandatory Security compliance regulations, such as the Payment Card Industry Data Security Standard (PCI DSS), were developed and adopted by the industry. A key pre-requisite of the PCI DSS compliance process is the ability to identify the components of the payment systems directly involved with the card data (i.e. process, transmit, or store). However, existing data flow tracking tools cannot fully automate the process of identifying system components that touch card data, because they either can not examine encrypted communications or they use an instrumentation-based approach and thus require a priori detailed knowledge of the payment card processing systems. We describe the implementation and evaluation of a novel tool to identify the card data flow in commercial payment card processing systems running on virtualized servers. The tool performs realtime monitoring of network communications between virtual machines and inspects the memory of the communicating processes for unencrypted card data. Our implementation does not require instrumentation of application binaries and can accurately identify the system components involved in card data flow even when the communications among system components are encrypted. Effectiveness of this tool is demonstrated through its successful discovery of the card data flow of several open- and closed-source payment card processing applications.
-
SRDS - Automated Discovery of Credit Card Data Flow for PCI DSS Compliance
2011 IEEE 30th International Symposium on Reliable Distributed Systems, 2011Co-Authors: Jennia Hizver, Tzicker ChiuehAbstract:Credit cards are key instruments in personal financial transactions. Credit card payment systems used in these transactions and operated by merchants are often targeted by hackers to steal the card data. To address this threat, the payment card industry establishes a Mandatory Security compliance standard for businesses that process credit cards. A central pre-requisite for this compliance procedure is to identify the credit card data flow, specifically, the stages of the card transaction processing and the server nodes that touch credit card data as they travel through the organization. In practice, this pre-requisite poses a challenge to merchants. As the payment infrastructure is implemented and later maintained, it often deviates from the original documented design. Without consistent tracking and auditing of changes, such deviations in many cases remain undocumented. Therefore building the credit card data flow for a given payment card processing infrastructure is considered a daunting task that at this point requires significant manual efforts. This paper describes a tool that is designed to automate the task of identifying the credit card data flow in commercial payment systems running on virtualized servers hosted in private cloud environments. This tool leverages virtual machine introspection technology to keep track of credit card data flows across multiple machines in real time without requiring intrusive instrumentation of the hyper visor, virtual machines, middleware or application source code. Effectiveness of this tool is demonstrated through its successful discovery of the credit card data flow of several open and closed source payment applications.