Predictability of enforcement

Authors:
Nataliia Bielova;Fabio Massacci
Affiliations:
University of Trento, Italy;University of Trento, Italy
Venue:
ESSoS'11 Proceedings of the Third international conference on Engineering secure software and systems
Year:
2011

Citing 14
Cited 3

Enforceable security policies

ACM Transactions on Information and System Security (TISSEC)
The UCONABC usage control model

ACM Transactions on Information and System Security (TISSEC)
The inlined reference monitor approach to security policy enforcement

The inlined reference monitor approach to security policy enforcement
JavaScript instrumentation for browser security

Proceedings of the 34th annual ACM SIGPLAN-SIGACT symposium on Principles of programming languages
Execution monitoring enforcement under memory-limitation constraints

Information and Computation
Mechanisms for usage control

Proceedings of the 2008 ACM symposium on Information, computer and communications security
Security-by-contract on the .NET platform

Information Security Tech. Report
Run-Time Enforcement of Nonsafety Policies

ACM Transactions on Information and System Security (TISSEC)
Enforcement monitoring wrt. the safety-progress classification of properties: NOTE: ACM has found that the authors of this paper failed to cite a work they previously published with much identical content entitled Synthesizing Enforcement Monitors wrt. the Safety-Progress Classification of Properties. Published in December 2008 in the Springer LNCS series for the ICISS 2008 conference DOI= http://dx.doi.org/10.1007/978-3-540-89862-7_3

Proceedings of the 2009 ACM symposium on Applied Computing
Lightweight self-protecting JavaScript

Proceedings of the 4th International Symposium on Information, Computer, and Communications Security
Towards Practical Enforcement Theories

NordSec '09 Proceedings of the 14th Nordic Conference on Secure IT Systems: Identity and Privacy in the Internet Age
Synthesising monitors from high-level policies for the safe execution of untrusted software

ISPEC'08 Proceedings of the 4th international conference on Information security practice and experience
Using equivalence relations for corrective enforcement of security policies

MMM-ACNS'10 Proceedings of the 5th international conference on Mathematical methods, models and architectures for computer network security
A theory of runtime enforcement, with results

ESORICS'10 Proceedings of the 15th European conference on Research in computer security

Corrective Enforcement: A New Paradigm of Security Policy Enforcement by Monitors

ACM Transactions on Information and System Security (TISSEC)
A quantitative approach for inexact enforcement of security policies

ISC'12 Proceedings of the 15th international conference on Information Security
From qualitative to quantitative enforcement of security policy

MMM-ACNS'12 Proceedings of the 6th international conference on Mathematical Methods, Models and Architectures for Computer Network Security: computer network security

Quantified Score

Hi-index	0.00

Visualization

Abstract

The current theory of runtime enforcement is based on two properties for evaluating an enforcement mechanism: soundness and transparency. Soundness defines that the output is always good ("no bad traces slip out") and transparency defines that good input is not changed ("no surprises on good traces"). However, in practical applications it is also important to specify how bad traces are fixed so that the system exhibits a reasonable behavior. We propose a new notion of predictability which can be defined in the same spirit of continuity in real-functions calculus. It defines that there are "no surprises on bad input". We discuss this idea based on the feedback of an industrial case study on e-Health.