With the widely application of cloud, a series of privacy challenges arise. Generally, encryption methods are used to ensure privacy, which may result in high computation and communication overheads. Access control is another fundamental and important measure to protect resources. Usually cloud computing systems are managed through RESTful web services and users can conduct access control measures like role-based access control (RBAC) to manage the permissions to RESTful resources. By running integration test, test cases and the corresponding RESTful permissions can be parsed out automatically. We are the first to define the role engineering problem based on integration test and summarize three metrics for role engineering. Then we propose a novel role engineering method based on spectral clustering analysis which supporting more feature set such as permission weight, role hierarchy and customized number of roles. Finally, we conduct experiments using real integration test on three cloud computing systems to demonstrate the effectiveness and performance, outperforming prior works.

The healthcare system is a distributed collaborative system and the sensitivity of the medical data is one of the most important requirements. Preventing unauthorized access to healthcare information and data sharing security in the healthcare environment are critical processes that affect the credibility of the system. To achieve this goal and to meet the requirements of the healthcare system, access control is an important measure to realize the safe sharing of resources. The attribute-based access control (ABAC) model meets the complex security requirements of large and complex systems and provides a dynamic, flexible and scalable solution. The main obstacle to deploying ABAC is the precise development of ABAC policies. Manually developing access control policies is tedious, time-consuming and error prone. Most systems have high-level requirement specifications, which are written in natural language. These natural language (NL) documents have the intended access control policies for the systems. In this paper, we propose a new approach towards extracting policies from natural language documents. By fully taking advantage of Bidirectional Encoder Representations from Transformers (BERT) and Semantic role labeling (SRL), we are able to correctly identify access control policy (ACP) sentences with an average F1 score of 85% and correctly extract rules with an average F1 score of 72%, which outperforms the state-of-the-art and leads to a performance improvement of 7% and 2% respectively over the previously reported results.

In recent years, data security incidents caused by insider threats in distributed file systems have attracted the attention of academia and industry. The most common way to detect insider threats is based on user profiles. Through analysis, we realize that based on existing user profiles are not efficient enough, and there are many false positives when a stable user profile has not yet been formed. In this work, we propose personalized user profiles and design an insider threat detection framework, which can intelligently detect insider threats for securing distributed file systems in real-time. To generate personalized user profiles, we come up with a time window-based clustering algorithm and a weighted kernel density estimation algorithm. Compared with non-personalized user profiles, both the Recall and Precision of insider threat detection based on personalized user profiles have been improved, resulting in their harmonic mean F1 increased to 96.52%. Meanwhile, to reduce the false positives of insider threat detection, we put forward operation recommendations based on user similarity to predict new operations that users will produce in the future, which can reduce the false positive rate (FPR). The FPR is reduced to 1.54% and the false positive identification rate (FPIR) is as high as 92.62%. Furthermore, to mitigate the risks caused by inaccurate authorization for users, we present user tags based on operation content and permission. The experimental results show that our proposed framework can detect insider threats more effectively and precisely, with lower FPR and high FPIR.

随着云计算和移动计算的普及,浏览器应用呈现多样化和规模化的特点,浏览器的安全问题也日益突出.为了保证Web应用资源的安全性,浏览器同源策略被提出.目前,RFC6454、W3C和HTML5标准都对同源策略进行了描述与定义,诸如Chrome、Fire fox、Safari、Edge等主流浏览器均将其作为基本的访问控制策略.然而,浏览器同源策略在实际应用中面临着无法处理第三方脚本引入的安全威胁、无法限制同源不同frame的权限、与其他浏览器机制协作时还会为不同源的frame赋予过多权限等问题,并且无法保证跨域/跨源通信机制的安全性以及内存攻击下的同源策略安全.对浏览器同源策略安全研究进行综述,介绍了同源策略的规则,并概括了同源策略的威胁模型与研究方向,主要包括同源策略规则不足及应对、跨域与跨源通信机制安全威胁及应对以及内存攻击下的同源策略安全,并且展望了同源策略安全研究的未来发展方向.

Container-based virtualization has been widely utilized and brought unprecedented influence on traditional IT architecture. How to build trust for containers has become an important security issue as well. Despite the fact that substantial efforts have been made to solve this issue, there are still some challenges to be handled, i.e. how to prevent from exposing information of the underlying host and other users' containers to a remote verifier, how to measure the integrity status of a designated container along with its reliant services in the underlying host and generate a hardware-based integrity evidence. None of the current solutions can counter these challenges and guarantee efficiency simultaneously.In this paper, we present Container-IMA, a novel solution to cope with these challenges. We firstly analyze the essential evidence to validate the integrity of a designated container. Afterwards we make a division of the traditional Measurement Log (ML), which ensures privacy and decreases the latency of attestation. A container-based Platform Configuration Register (cPCR) mechanism is introduced to protect each ML partition with a hardware-based Root of Trust. The attestation mechanism is proposed as well. We implement a prototype based on Docker. The experiment results demonstrate the effectiveness and efficiency of our solution.