Affiliation:
1. University of Pittsburgh, Pittsburgh, PA
2. University of Illinois at Urbana-Champaign
Abstract
Previous work has shown that distributed authorization systems that fail to sample a consistent snapshot of the underlying system during policy evaluation are vulnerable to a number of attacks. Unfortuantely, the consistency enforcement solutions presented in previous work were designed for systems in which only CA-certified evidence is used during the decision-making process, all of which is available to the decision-making node at runtime. In this article, we generalize previous results and present light-weight mechanisms through which consistency constraints can be enforced in proof systems in which the full details of a proof may be unavailable to the querier due to information release policies, and the existence of certificate authorities for certifying evidence is unlikely; these types of distributed proof systems are likely candidates for use in pervasive computing and sensor network environments. We present modifications to one such distributed proof system that enable three types of consistency constraints to be enforced while still respecting the same confidentiality and integrity policies as the original proof system. We then discuss how these techniques can be adapted and applied to other, less restrictive, distributed proof systems. Further, we detail a performance analysis that illustrates the modest overheads of our consistency enforcement schemes.
Funder
Sandia National Laboratories, National Nuclear Security Administration
Division of Computer and Network Systems
Division of Information and Intelligent Systems
Publisher
Association for Computing Machinery (ACM)
Subject
Safety, Risk, Reliability and Quality,General Computer Science
Reference26 articles.
1. Adve S. V. and Gharachorloo K. 1996. Shared memory consistency models: A tutorial. IEEE Comput. 66--76. 10.1109/2.546611 Adve S. V. and Gharachorloo K. 1996. Shared memory consistency models: A tutorial. IEEE Comput. 66--76. 10.1109/2.546611
2. Babaoğlu O. and Marzullo K. 1993. Consistent global states of distributed systems: fundamental concepts and mechanisms. In Distributed Systems S. J. Mullender Ed. Addison-Wesley Upper Saddle River NJ. 55--96. Babaoğlu O. and Marzullo K. 1993. Consistent global states of distributed systems: fundamental concepts and mechanisms. In Distributed Systems S. J. Mullender Ed. Addison-Wesley Upper Saddle River NJ. 55--96.
3. A model of OASIS role-based access control and its support for active security
4. Distributed Proving in Access-Control Systems
Cited by
1 articles.
订阅此论文施引文献
订阅此论文施引文献,注册后可以免费订阅5篇论文的施引文献,订阅后可以查看论文全部施引文献