User authentication and authorization in the Java/sup TM/ platform

Lai, Charlie; Gong, Li; Koved, Larry; Nadalin, Anthony; Schemers, Roland

doi:10.1109/csac.1999.816038

Cited by 49 publications

(44 citation statements)

References 16 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Generally, there are two distinct areas in mobile code security: (1) protection of the host from malicious mobile code and (2) protection of the mobile code from malicious hosts or users. Researchers have presented several models and mechanisms to deal with malicious code [20,29], such as Sandbox [19,10,15], code signing/code access [16], proof carrying code [17], etc. Protection of mobile code, however, is still an open problem.…”

Section: Related Workmentioning

confidence: 99%

“…The two mainstream runtime environments currently adopted in industry are Common Language Runtime (CLR) in .Net and Java Runtime Environment (JRE) in Java. In Java, the security in JDK1.0 and JDK1.1 uses a sandbox model to restrict the access of Java Applets based on code source and digital signature, while in JDK1.2, a user-based access control model is introduced [10,15]. Similar to Java, .Net enforces a code access security model based on code source and location, as well as a role-based security model [16].…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Towards Remote Policy Enforcement for Runtime Protection of Mobile Code Using Trusted Computing

Zhang

Parisi-Presicce

Sandhu

2006

Advances in Information and Computer Security

View full text Add to dashboard Cite

Abstract. We present an approach to protect mobile code and agents at runtime using Trusted Computing (TC) technologies. For this purpose, a "mobile policy" is defined by the mobile code originator, and is enforced by the runtime environment in a remote host to control which users can run the mobile code and what kind of results a user can observe, depending on the security properties of the user. The separation of policy specification and implementation mechanism in existing mobile computing platform such as Java Runtime Environment (JRE) enables the implementation of our approach by leveraging current security technologies. The main difference between our approach and existing runtime security models is that the policies enforced in our model are intended to protect the resources of the mobile applications instead of the local system resources. This requires the remote runtime environment to be trusted by the application originator to authenticate the remote user and enforce the policy. Emerging TC technologies such as specified by the Trusted Computing Group (TCG) provide assurance of the runtime environment of a remote host.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Towards Remote Policy Enforcement for Runtime Protection of Mobile Code Using Trusted Computing

Zhang

Parisi-Presicce

Sandhu

2006

Advances in Information and Computer Security

View full text Add to dashboard Cite

show abstract

“…It also provides a uniform interface for authentication that is compatible with many authentication provisions, and thus provides complementary functionality to the GSS API. The Java Authentication and Authorization System API (JAAS API) bases its authentication on the PAM API in the Java language environment [14].…”

Section: Pluggable Authentication Module Api (Pam Api)mentioning

confidence: 99%

Building a Dynamic Interoperable Security Architecture for Active Networks

Campbell¹,

Mickunas²

2002

View full text Add to dashboard Cite

Public reporting burden for this collection of information is estimated to average 1 hour per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing this collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing this burden to Washington Headquarters Services, Directorate for Information Operations and Reports, 1215 Jefferson Davis Highway, Suite 1204, Arlington, VA 22202-4302, and to the Office of Management and Budget, Paperwork Reduction Project (0704-0188), Washington, DC 20503 AGENCY USE ONLY (Leave blank)2. REPORT DATE October 2002 REPORT TYPE AND DATES COVEREDFinal May 98 -Jun 02 TITLE AND SUBTITLE BUILDING A DYNAMIC INTEROPERABLE SECURITY ARCHITECTURE FOR ACTIVE NETWORKS AUTHOR(S)Roy H. Campbell and M. Dennis Mickunas FUNDING NUMBERSC -F30602-98-1-0192 PE -62301E PR -G378 TA -00 WU -01 PERFORMING ORGANIZATION NAME(S) AND ADDRESS(ES)University of Illinois Grants and Contracts Office 109 Coble Hall -801 South Wright Street Champaign Illinois 61820-6242 PERFORMING ORGANIZATION REPORT NUMBER SPONSORING / MONITORING AGENCY NAME(S) AND ADDRESS(ES)Defense 12b. DISTRIBUTION CODE ABSTRACT (Maximum 200 Words)Security is viewed as one of the major obstacles to the widespread deployment active networks. A significant challenge is to develop mechanisms to change software state on routers dynamically, without sacrificing protection guarantees. The Seraphim projects leverages the inherent dynamism in the paradigm to build dynamic security mechanisms for active networks. Seraphim's security architecture is component based, dynamically extensible, and reflective, and supports a variety of policy strategies and enforcement mechanisms. This enabled the development of customizable, interoperable, domain-specific, or task-specific security policies and mechanisms, to meet the security requirements of active network entities. Administrators were able to develop security policies as active network capsules, called dynamic policies, and enforce these policies by executing them in a suitable software context on active network routers. A suite of confidentiality, integrity, authentication and access-control mechanisms was developed to secure the node of an active network. This suite was based on standardized APIs and provided support for customized Quality of Protection guarantees. Customized dynamic policies were created and installed at run-time, trading functionality for performance, to implement low-overhead solutions that were able to successfully counter threats and attack, without sacrificing protection guarantees. SUMMARYIn an active network, new protocols and services can be injected into the network using smart packets to carry customized software components. This technology increases the degree and sophistication of the network architecture and enables fast deployment of new protocols and services. However, a...

show abstract

“…For example, CORBA Security [7] has replaceable AccessDecision and other interfaces. Java authentication and authorization service (JAAS) [8,9], which recently became a part of J2SE v1.4, has replaceable interface Policy that serves authorization decisions. Although appearing to be versatile, the ADME schema comes with two major drawbacks.…”

Section: Mdme --Everything Is Done By Middlewarementioning

confidence: 99%

Object Security Attributes: Enabling Application-Specific Access Control in Middleware

Beznosov¹

2002

On the Move to Meaningful Internet Systems 2002: CoopIS, DOA, and ODBASE

View full text Add to dashboard Cite

Abstract. This paper makes two primary contributions toward establishing support for application-specific factors in middleware security mechanisms. First, it develops a simple classification framework for reasoning about the architecture of the security mechanisms in distributed applications that follow the decision-enforcement paradigm of the reference monitor. It uses the framework to demonstrate that the existing solutions lack satisfying tradeoffs for a wide range of those applications that require application-specific factors to be used in security decisions while mediating access requests.Second, by introducing attribute function in addition to decision and enforcement functions, it proposes a novel scheme for clean separation among suppliers of middleware security, security decision logic, and application-logic, while supporting application-specific protection policies. To illustrate the scheme on a concrete example, we describe its mapping into CORBA Security.

show abstract

User authentication and authorization in the Java/sup TM/ platform

Cited by 49 publications

References 16 publications

Towards Remote Policy Enforcement for Runtime Protection of Mobile Code Using Trusted Computing

Towards Remote Policy Enforcement for Runtime Protection of Mobile Code Using Trusted Computing

Building a Dynamic Interoperable Security Architecture for Active Networks

Object Security Attributes: Enabling Application-Specific Access Control in Middleware

Contact Info

Product

Resources

About