We think you have liked this presentation. If you wish to download it, please recommend it to your friends in any social system. Share buttons are a little bit lower. Thank you!
Presentation is loading. Please wait.
Published byKevin Lowe
Modified over 2 years ago
© 2006 Ravi Sandhu Secure Information Sharing Enabled by Trusted Computing and PEI * Models Ravi Sandhu (George Mason University and TriCipher) Kumar Ranganathan (Intel System Research Center, Bangalore) Xinwen Zhang (George Mason University) * PEI: Policy, Enforcement, Implementation
© 2005 Ravi Sandhu 2 Three Megatrends Fundamental changes in Cyber-security goals Cyber-security threats Cyber-security technology
© 2005 Ravi Sandhu 3 Cyber-security goals have changedCyber-security goals electronic commerce information sharing etcetera multi-party security objectives fuzzy objectives INTEGRITY modification AVAILABILITY access CONFIDENTIALITY disclosure USAGE purpose USAGE
© 2005 Ravi Sandhu 4 Cyber-security attacks have changed The professionals have moved in Hacking for fun and fame Hacking for cash, espionage and sabotage
© 2005 Ravi Sandhu 5 Basic premise Software alone cannot provide an adequate foundation for trust Old style Trusted Computing (1970 – 1990s) Multics system Capability-based computers –Intel 432 vis a vis Intel 8086 Trust with security kernel based on military-style security labels –Orange Book, eliminate trust from applications Whats new (2000s) Hardware and cryptography-based root of trust –Ubiquitous availability –Trust within a platform –Trust across platforms Rely on trust in applications –No Trojan Horses or –Mitigate Trojan Horses and bugs by legal and reputational recourse Cyber-security technology has changed Massive paradigm shift Prevent information leakage by binding information to Trusted Viewers on the client
© 2005 Ravi Sandhu 6 PEI Models Framework Cannot do security without analyzing the application space in business terms Cannot do security without understanding the target platform and its limitations Divide and conquer AND confront and deal with issues at the correct layer }
© 2005 Ravi Sandhu 7 What is Information Sharing The mother of all security problems Share but protect Requires controls on the client Server-side controls do not scale to high assurance Different from Retail DRM (Digital Rights Management) Enterprise DRM Integrity of information on the client can be crypto- guaranteed to very high assurance by digital signatures. Guarantee of confidentiality on the client needs mechanisms beyond crypto alone.
© 2005 Ravi Sandhu 8 Classic Approaches to Information Sharing Discretionary Access Control (DAC), Lampson 1971 Fundamentally broken Controls access to the original but not to copies (or extracts) Mandatory Access Control (MAC), Bell-LaPadula 1971 Solves the problem for coarse-grained sharing –Thorny issues of covert channels, inference, aggregation remain but can be confronted Does not scale to fine-grained sharing –Super-exponential explosion of security labels is impractical –Fallback to DAC for fine-grained control (as per the Orange Book) is pointless Originator Control (ORCON), Graubart 1989 Propagated access control lists: let copying happen but propagate ACLs to copies (or extracts) Park and Sandhu 2002 discuss an approach based on Trusted Viewers
© 2005 Ravi Sandhu 9 PEI Models Framework
© 2005 Ravi Sandhu 10 Scoping Information Sharing: Big Issues Secure information sharing rather than Digital Rights Management (DRM) Sensitivity of information content is the issue not revenue potential of retail entertainment content Open system as opposed to closed Enterprise DRM Read-only versus read-write secure information sharing Read-only is a useful subset Avoids some of the complexities of read-write such as –Extraction of pieces of information –Aggregation of several sources –Version control –Ability to overwrite versus annotate Content-independent authorization versus content-dependent authorization Content-independent is a useful subset Content-dependent is more complex since it requires Trusted Viewers to parse and understand the content
© 2005 Ravi Sandhu 11 PEI Models Framework
© 2005 Ravi Sandhu 12 Scoping Information Sharing One Decomposition at the Policy Layer Password based Device based Credential based Just one possibility Determined by business objectives
© 2005 Ravi Sandhu 13 Scoping Information Sharing: Detailed Issues Detailed issues include Revocation Policy Usage Policy Re-dissemination Policy Distribution Policy Accessibility Policy
© 2005 Ravi Sandhu 14 PEI Models Framework
© 2005 Ravi Sandhu 15 Password-based encryption: traditional approach Insecure due to off-line dictionary attacks GuessVerify
© 2005 Ravi Sandhu 16 Trusted Viewer Seal with Password Authentication
© 2005 Ravi Sandhu 17 Trusted Viewer Seal with Password Authentication and Encryption
© 2005 Ravi Sandhu 18 Trusted Viewer Seal with Device Encryption
© 2005 Ravi Sandhu 19 Trusted Viewer Seal with Credential Authentication
© 2005 Ravi Sandhu 20 Trusted Viewer Seal with Credential Encryption
© 2005 Ravi Sandhu 21 PEI Models Framework
© 2005 Ravi Sandhu 22 Trusted Viewer Seal with Password Authentication On-line password guessing Need a throttling mechanism Many possibilities
© 2006 Ravi Sandhu Secure Information Sharing Enabled by Trusted Computing and PEI * Models Ravi Sandhu (George Mason University and TriCipher) Kumar Ranganathan (Intel System Research Center, Bangalore) Xinwen Zhang (George Mason University) * PEI: Policy, Enforcement, Implementation Questions ??
Information Assurance: A Personal Perspective Ravi Sandhu
© Ravi Sandhu The Secure Information Sharing Problem and Solution Approaches Ravi Sandhu Professor of Information Security and Assurance.
© 2006 Ravi Sandhu Cyber-Identity, Authority and Trust Systems Prof. Ravi Sandhu Professor of Information Security and Assurance Director,
1 PEI Models towards Scalable, Usable and High-assurance Information Sharing Ram Krishnan Laboratory for Information Security Technology George Mason University.
© Ravi Sandhu Cyber-Identity, Authority and Trust in an Uncertain World Prof. Ravi Sandhu Laboratory for Information Security Technology.
SECURING CYBERSPACE: THE OM-AM, RBAC AND PKI ROADMAP Prof. Ravi Sandhu Laboratory for Information Security Technology George Mason University
© 2004 Ravi Sandhu Cyber-Identity, Authority and Trust in an Uncertain World Prof. Ravi Sandhu Laboratory for Information Security Technology.
Cyber-Identity, Authority and Trust in an Uncertain World Prof. Ravi Sandhu Laboratory for Information Security Technology George Mason University
© Ravi Sandhu Introduction to Information Security Ravi Sandhu.
Peer-to-Peer Access Control Architecture Using Trusted Computing Technology Ravi Sandhu and Xinwen Zhang George Mason University SACMAT05, June 1--3, 2005,
© Ravi Sandhu Security Issues in P2P Systems Prof. Ravi Sandhu Laboratory for Information Security Technology George Mason University.
1 The Challenge of Data and Application Security and Privacy (DASPY): Are We Up to It? Ravi Sandhu Executive Director and Endowed Professor February 21,
INSTITUTE FOR CYBER SECURITY 1 Trusted Computing Models Prof. Ravi Sandhu Executive Director and Endowed Chair Institute for Cyber Security University.
1 LECTURE 1 ACCESS CONTROL Ravi Sandhu. 2 OUTLINE Access matrix model Access control lists versus Capabilities Content and context-based controls Discretionary.
Engineering Authority and Trust in Cyberspace: The OM-AM and RBAC Way Prof. Ravi Sandhu George Mason University
INSTITUTE FOR CYBER SECURITY 1 The ASCAA * Principles Applied to Usage Control Prof. Ravi Sandhu Executive Director and Endowed Chair Institute for Cyber.
ACCESS CONTROL: THE NEGLECTED FRONTIER Ravi Sandhu George Mason University.
© 2004 Ravi Sandhu Role-Based Access Control Prof. Ravi Sandhu Laboratory for Information Security Technology George Mason University.
INSTITUTE FOR CYBER SECURITY 1 The PEI Framework for Application-Centric Security Prof. Ravi Sandhu Executive Director and Endowed Chair Institute for.
ISA 662 Internet Security Protocols Kerberos Prof. Ravi Sandhu.
Introduction to Network Security INFSCI 1075: Network Security Amir Masoumzadeh.
Computer Science 1 CSC 405 Introduction to Computer Security Topic 5. Trusted Operating Systems -- Part I.
1 Computer Security CIS326 Dr Rachel Shipsey. 2 This course will cover the following topics: passwords access controls symmetric and asymmetric encryption.
INFS 767 Fall 2003 The RBAC96 Model Prof. Ravi Sandhu George Mason University.
Towards Usage Control Models: Beyond Traditional Access Control 7 th SACMAT, June 3, 2002 Jaehong Park and Ravi Sandhu Laboratory for Information Security.
Logical Model and Specification of Usage Control Xinwen Zhang, Jaehong Park Francesco Parisi-Presicce, Ravi Sandhu George Mason University.
© 2004 Ravi Sandhu A Perspective on Graphs and Access Control Models Ravi Sandhu Laboratory for Information Security Technology George.
SecureBus: Towards Application- Transparent Trusted Computing with Mandatory Access Control Xinwen Zhang 1, Songqing Chen 2 Michael J. Covington 3, and.
© 2016 SlidePlayer.com Inc. All rights reserved.