Organizations derive policies from a wide variety of sources, such business plans, laws, regulations, and contracts. However, an efficient process does not yet exist for quickly finding or automatically deriving policies from uncontrolled natural language sources. The goal of our research is to assure compliance with established policies by ensuring policies in existing natural language texts are discovered, appropriately represented, and implemented. We propose a tool-based process to parse natural language documents, learn which statements signify policy, and then generate appropriate policy representations. To evaluate the initial work on our process, we analyze four data use agreements for a particular project and classify sentences as to whether or not they pertain to policy, requirements, or neither. Our k-nearest neighbor classifier with a unique distance metric had a precision of 0.82 and a recall of 0.81, outperforming weighted random guess, which had a precision of 0.44 and a recall of 0.46. The initial results demonstrate the feasibility of classifying sentences for policy and we plan to continue this work to derive policy elements from the natural language text.
Web browsers are a common platform for delivering cross-platform applications. However, they currently fail to provide consistent access control for security and privacy sensitive JavaScript APIs, such as geolocation and local storage. This problem is exacerbated by new HTML5 APIs and the increasing number of personal devices people own and use. In this paper we present the webinos platform which aims to provide a single, cross-device policy system for web applications on a wide range of web-enabled devices including TVs, smartphones, in-car systems and PCs. webinos solves the existing deficiencies in web authorisation by introducing the concept of a personal zone, the set of all devices and services owned by a particular user. All devices in this zone can synchronize their access control policies through interoperable middleware and can create flexible rules which may refer to an individual user, device or the entire zone. We provide details of the architecture and explain how our experience during design highlighted several conceptual challenges.
There is growing awareness of the need to protect digital resources and services in both corporate and home ICT scenarios. Meanwhile, communication tools tailored for corporations are blurring the line between communication mechanisms and (near) real-time resource sharing. The resulting requirement for near real-time policy-based access control is technically challenging. In a corporate domain, such access control mechanisms must be unobtrusive and comply with strict security objectives. Thus policy evaluation performance needs to be considered while addressing traditional security concerns. This paper discusses policy system design principles that motivate a novel Policy Decision Point (PDP) implementation and associated policy language. These principles are consistent with recent web development techniques designed to improve performance and scalability. Given a modern web development stack comprising a language (Javascript), a framework (Node.js) and a database management system (Redis), the proposition is that significant performance gains can be made. Our performance experiments suggest this is the case when, through various design iterations, our prototype PDP implementation is compared with an established, Java/XACML-based access control PDP implementation. The experiments presented in this paper suggest that newer technologies offer better performance. The analysis suggests that this is because they offer a more efficient data representation and make better use of computing resources.
Contemporary wireless sensor network deployments are long-lived, large scale and resource constrained. Longevity demands mechanisms that support reconfiguration to meet changing application requirements, large scale demands high-level abstractions to support network management and stringent resource constraints necessitate a high degree of efficiency in middleware to support application development and management. This paper presents the Component and Policy Infrastructure (CaPI), a middleware providing two complementary abstractions for contemporary sensor network development and management. A reconfigurable component model supports embedded developers during initial application development and enables management of evolving functional requirements, while an expressive policy language supports the specification and management of behavioural concerns by administrators or domain experts. CaPI provides a clear decoupling between application logic and behaviour, enabling efficient customization and dynamic reconfiguration of application functionality and behaviour.
Home networks are becoming increasingly complex but existing management solutions are not simple to use since they are not tailored to the needs of typical home-users. In this paper we present a new approach to home network management that allows users to formulate quite sophisticated "comic-strip" policies using an attractive iPad application. The policies are based on the management wishes of home users elicited in a user study. Comic-strip policies are passed to a Policy engine running on a new Home Network Router designed to facilitate a variety of management tasks. We illustrate our approach via a number end-to-end experiments in an actual home deployment, using our prototype implementation.
The success of a software system depends critically on how well it reflects and adapts to stakeholder requirements. Traditional development methods often frustrate stakeholders by creating long latencies between requirement articulation and system deployment, especially in large scale systems. One source of latency is the maintenance of policy decisions encoded directly into system workflows at development time, including those involving access control and feature set selection. We created the Policy Driven Development (PDD) methodology to address these development latencies by enabling the flexible injection of decision points into existing workflows at runtime, thus enabling policy composition that integrates requirements furnished by multiple, oblivious stakeholder groups. Using PDD, we designed and implemented a production cyberinfrastructure that demonstrates policy and workflow injection that quickly implements stakeholder requirements, including features not contemplated in the original system design. PDD provides a path to quickly and cost effectively evolve such applications over a long lifetime.
I/O intensive jobs such as stage-in, stage-out or data clean-up jobs account for significant time in execution of scientific workflows. Workflow managers typically add these data management operations as supporting jobs to computational tasks with scheduling emphasis on compute jobs only. We present the integration of the Pegasus Workflow Management System with a Policy Based Data Placement Service (PDPS) to reduce overall workflow execution time. Pegasus delegates all data staging jobs to PDPS, which schedules and executes stage-in jobs based on selected data placement policies and simply executes stage-out and clean-up jobs independent of the workflow execution state. We measure the impact of using PDPS with Pegasus first with the Montage workflow, and then with a synthetic workflow. We enforce two policies and demonstrate the advantage of using PDPS for asynchronous data placement for scientific workflows. Our results show that the influence of PDPS on the overall workflow runtimes is dependent on the data characteristics of the executable workflow and the data placement policy being enforced.
The Web is an important resource for health information. Pew's Internet and American Life Project found 62% of adult Web users looking for health-related information on health social networks. However, the National Survey on Identity and Privacy in Social Media by The Ponemon Institute reported that about 56% of adult users were anxious about the privacy of their personal information on social networks. This paper examines the privacy policies of 35 online health social networks selected based on the U.S. users' traffic. The objectives of this research are to determine the extent to which privacy policies of online health social networks comply with the principles of Fair Information Practice (FIP) and to evaluate the readability and accessibility of policies. To measure the readability of the policy statements, the Flesch Reading Ease Score and Flesch Kincaid Grade Level score metrics are used. The findings indicate that 9% of the websites in the sample had no privacy policy posted, and only about 26% of the websites in the sample fully complied with the FIP. Our findings show that compliance with the FIP principles is poor, and confirm that most policies require a reading skill higher than the Internet population's average literacy level.
We introduce and discuss two case studies where a complex network is modeled as a set of zones interconnected by routers or firewalls. To address the problem in full abstraction, we defined PDLz, an extension of the PDL event-condition-action language that supports the specification of firewall routing policies. PDLz allows the modelling of computer networks based on the concept of zone, i.e., a TCP/IP subnet where internal traffic remains unconstrained. PDLz policies are enforceable thanks to a direct translation to the IPtables firewall configuration language. At the same time, PDLz has a declarative semantics thanks to translation to logic programs. The logic programming translation also supports, by adding extra rules, the formal verification of properties of the network, viz. off-line reachability testing across firewalls. We describe the application of PDLz to the case studies.
The monitoring of modern large scale infrastructure systems often relies on complex event processing (CEP) rules to detect security and performance problems. For example, the continuous monitoring of compliance to regulatory requirements such as PCI-DSS and NERC CIP requires analyzing events to identify if specific conditions over the configurations of devices occur. In multi-organization systems, detecting these problems often requires integrating events generated by different organizations. As events provide information about the infrastructure' internal structure, organizations are interested in reducing the amount of information shared with external entities. This paper analyses the problem of detecting policy violations in network infrastructure systems managed by two organizations (e.g., a cloud user and a cloud provider). We focus on CEP monitoring systems and we introduce two protocols for selecting the events to share between the two organizations to ensure the detection of all possible policy violations. Our experimental evaluation shows that reciprocal information sharing between the two organizations significantly reduces the amount of information to transfer. In our SNMP monitoring test case, we obtain a 80% reduction in the information shared by any single organization.
One of the main goals of all online social communities is to promote a stable, or perhaps, growing membership built around topics of like interest. Yet, communities are not impermeable to the potentially damaging effects resulting from those few participants that choose to behave in a manner that is counter to established norms of behavior. Typical moderators in online social communities are the ones tasked to reduce the risks associated with unhealthy user behavior by rapidly identifying and removing damaging posts and consequently taking action against the perpetrating user. Yet, the sheer volume of posts relative to the number of moderators available for review suggests a need for modern tools aimed at prioritizing posts based on the assessed risk each user poses to the community. To accomplish this, we propose a threat analysis model. Our model, referred to as TrICO (Threat requires Intent Capability and Opportunity) is implemented using Bayesian Networks, and achieves early detection of damaging behavior in online social communities. To the best of our knowledge, this is the first user-centered model for usage policy enforcement in online sites. We apply our model to a comprehensive data set characterizing the entirety of a popular discussion forum. Our results show that the TrICO model provides accurate results.
Static analysis of access-control policies is becoming increasingly important. Such analysis can reveal errors and vulnerabilities in the policies, as well as logical inconsistencies, unintended effects, and discrepancies between different policies or different versions of the same policy. In the process, it helps policy developers to better understand the effects of their policies. Policy analysis has typically been done by hand. For instance, when a bug is discovered and corrected, the resulting policy is manually inspected to ensure that the fix works and that it does not introduce any new problems. But when the policies are large or their logical structure non-trivial, performing such analysis manually is tedious and error-prone. In this paper we show how to automate a wide array of useful policy analyses. This is accomplished by representing policies as logical formulas in the SMT (satisfiability-modulo-theory) subset of first-order logic, and couching analysis questions as SMT problems, which are then solved by efficient off-the-shelf SMT solvers. Because SMT solvers can reason about arithmetic and inductive data types, in addition to Boolean constraints, our system can handle many policies that cannot be analyzed by existing policy engines. We describe the formulation of a number of useful analyses (consistency, completeness, and observational equivalence), and report experimental results on the efficiency of our implementation for analyzing policies of various sizes and kinds of logical structure.
The notion of patient's consent plays a major role in granting access to medical data. In typical healthcare systems, consent is captured by a form that the patient has to fill in and sign. In e-Health systems, the paper-form consent is being replaced by the integration of the notion of consent in the mechanisms that regulate the access to the medical data. This helps in empowering the patient with the capability of granting and revoking consent in a more effective manner. However, the process of granting and revoking consent greatly varies according to the situation in which the patient is. Our main argument is that such a level of detail is very difficult and error-prone to capture as a set of authorisation policies. In this paper, we present ACTORS, a goal-driven approach to manage consent. The main idea behind ACTORS is to leverage the goal-driven approach of Teleo-Reactive (TR) programming for managing consent that takes into account changes regarding the domains and contexts in which the patient is providing her consent.
Many modern scientific applications, which are designed to utilize high performance parallel computers, occupy hundreds of thousands of computational cores running for days or even weeks. Since many scientists compete for resources, most supercomputing centers practice strict scheduling policies and perform meticulous accounting on their usage. Thus computing resources and time assigned to a user is considered invaluable. However, most applications are not well prepared for unforeseeable faults, still relying on primitive fault tolerance techniques. Considering that ever-plunging mean time to interrupt (MTTI) is making scientific applications more vulnerable to faults, it is increasingly important to provide users not only an improved fault tolerant environment, but also a framework to support their own fault tolerance policies so that their allocation times can be best utilized. This paper addresses a user level fault tolerance policy management based on a holistic approach to digest and correlate fault related information. It introduces simple semantics with which users express their policies on faults, and illustrates how event correlation techniques can be applied to manage and determine the most preferable user policies. The paper also discusses an implementation of the framework using open source software, and demonstrates, as an example, how a molecular dynamics simulation application running on the institutional cluster at Oak Ridge National Laboratory benefits from it.
This paper proposes a new framework for future policy-based adaptive vertical handover (VHO) in heterogeneous wireless networks. In contrast to existing, statically configured, schemes that lack the ability to quickly adapt to changing network loads, the proposed framework continuously derives optimal configuration policies with respect to handover initiation and network selection. To achieve this goal, the proposed work relies on the interactions between two components: a policy-based real-time simulator and a VHO manager. Triggered by indications of VHO performance degradation, the former enacts a set of VHO scenarios, selected based on a predefined set of simulation policies, to evaluate possible new VHO configurations before actually applying them to the real network. Based on the outcome of the simulation and the monitored network performance, a set of VHO configuration policies is communicated to the VHO manager to reconfigure and/or fine-tune the running VHO scheme. Preliminary performance evaluation results demonstrate the significant enhancement of the outcome of the proposed VHO framework in terms of reducing the ping-pong phenomenon and the handover delay.
The use of the Unified Modeling Language (UML)for specifying security policies is attractive because it is expressive and has a wide user base in the software industry. However, there are very few mature tools that support rigorous analysis of UML models. Alloy is a formal specification language that has been used to rigorously analyze security policies, but few practitioners have the background needed to develop good Alloy models. We propose a new approach to policy analysis in which designers use UML at the front-end to describe their security policies and the Alloy Analyzer is used at the backend to analyze the modeled properties. The UML-to-Alloy and Alloy-to-UML transformations obviate the need for security designers to understand the Alloy specification language. The proposed approach supports the analysis of both functional and structural aspects of security policies.
In the context of the automated technical management of distributed ambient-assisted-living healthcare systems, we employ high-level policies which describe the abstract requirements of the system from the use cases point of view. At runtime, an efficient low-footprint management system is used which executes low-level management rules of the event-condition-action type. The rules represent the low-level management policies. They monitor the status variables of the software components and change the settings of their configuration variables in order to enforce the high-level requirements. We report on the automated, tool-supported refinement of these policies which is based on a three-layered system model. The top layer reflects the use cases, the middle layer the service infrastructure, and the bottom layer the actual software and hardware components. The automated refinement exploits the model and its refinement relations which associate system elements with all those elements representing them on the next lower model layer. Moreover, the automated refinement is controlled by refinement, evaluation, and control pattern instances introduced by the model designer in order to supply the policy refinement and the policy enforcement with "ideas'' to be applied. The paper outlines our management approach and the graphical modeling tool MoBaSeC. The focus is set on the policy refinement functions and on the utilization of refinement, evaluation, and control patterns.
Cloud computing has the advantage that it offers companies (virtually) unlimited data storage at attractive costs. However, it also introduces new challenges for protecting the confidentiality of the data, and the access to the data. Sensitive data like medical records, business or governmental data cannot be stored unencrypted on the cloud. Moreover, they can be of interest to many users and different policies could apply to each. Companies need new mechanisms to query the encrypted data without revealing anything to the cloud server, and to enforce access policies to the data. Current security schemes do not allow complex encrypted queries over encrypted data in a multi-user setting. Instead, they are limited to keyword searches. Moreover, current solutions assume that all users have the same access rights to the data. This demo shows the implementation of a scheme that allows making SQL-like queries on encrypted databases in a multi-user setting, while at the same time allowing the database owner to assign different access rights to users.
Runtime adaptation of business processes and their IT system implementations to changes can usually be done in several ways. MiniZnMASC middleware makes adaptation decisions that maximize business value while satisfying all given constraints. All necessary information about alternative adaptations and their business metrics are specified as policies in WS-Policy4MASC. Using an example loan application business process, we demonstrate how MiniZnMASC supports 4 different autonomic business-driven decision making algorithms for adaptation.
Inter-domain path computations under the responsibility of cooperative Path Computation Elements (PCEs) guarantee effective network resource utilization and provide a basic level of information confidentiality. However, malicious PCEs belonging to different domains might misbehave by sending sequences of bogus requests and taking advantage of their interdependence to discover confidential information. In this work, we propose the use of XACML policies in order to avoid malicious utilizations of PCEP procedures and preserve confidentiality across domains. Policies are based on the analysis of the behavior of PCEP peers and the possible correlations among requests from which they might get access to private information.
