Verifying that access-control systems maintain desired security properties is recognized as an important problem in security. Enterprise access-control systems have grown to protect tens of thousands of resources, and there is a need for verification to scale commensurately. We present techniques for abstraction-refinement and bound-estimation for bounded model checkers to automatically find errors in Administrative Role-Based Access Control (ARBAC) security policies. ARBAC is the first and most comprehensive administrative scheme for Role-Based Access Control (RBAC) systems. In the abstraction-refinement portion of our approach, we identify and discard roles that are unlikely to be relevant to the verification question (the abstraction step). We then restore such abstracted roles incrementally (the refinement steps). In the bound-estimation portion of our approach, we lower the estimate of the diameter of the reachability graph from the worst-case by recognizing relationships between roles and state-change rules. Our techniques complement one another, and are used with conventional bounded model checking. Our approach is sound and complete: an error is found if and only if it exists. We have implemented our technique in an access-control policy analysis tool called Mohawk . We show empirically that Mohawk scales well to realistic policies, and provide a comparison with prior tools.

Verifying that access-control systems maintain desired security properties is recognized as an important problem in security. Enterprise access-control systems have grown to protect tens of thousands of resources, and there is a need for verification to scale commensurately. We present a new abstraction-refinement technique for automatically finding errors in Administrative Role-Based Access Control (ARBAC) security policies. ARBAC is the first and most comprehensive administrative scheme for Role-Based Access Control (RBAC) systems. Underlying our approach is a change in mindset: we propose that error finding complements verification, can be more scalable, and allows for the use of a wider variety of techniques. In our approach, we use an abstraction-refinement technique to first identify and discard roles that are unlikely to be relevant to the verification question (the abstraction step), and then restore such abstracted roles incrementally (the refinement steps). Errors are one-sided: if there is an error in the abstracted policy, then there is an error in the original policy. If there is an error in a policy whose role-dependency graph diameter is smaller than a certain bound, then we find the error. Our abstraction-refinement technique complements conventional state-space exploration techniques such as model checking. We have implemented our technique in an access-control policy analysis tool. We show empirically that our tool scales well to realistic policies, and is orders of magnitude faster than prior tools.

As the Web has become more and more ubiquitous, the number of attacks on web applications have increased substantially. According to a recent report, over 80 percent of web applications have had at least one serious vulnerability. This percentage is alarmingly higher than traditional applications. Something must be fundamentally wrong in the web infrastructure.

Web applications are no longer simple hyperlinked documents. They have progressively evolved to become highly complex-web pages combine content from several sources (with varying levels of trustworthiness), and incorporate significant portions of client-side code. However, the prevailing web protection model, the same-origin policy, has not adequately evolved to manage the security consequences of this additional complexity. As a result, web applications have become attractive targets of exploitation. We argue that this disconnection between the protection needs of modern web applications and the protection models used by web browsers that manage those applications amounts to a failure of access control. In this paper, we present Escudo, a new web browser protection model designed based on established principles of mandatory access control. We describe our implementation of a prototype of Escudo in the Lobo web browser, and illustrate how web applications can use Escudo for securing their resources. Our evaluation results indicate that Escudo incurs low overhead. To support backwards compatibility, Escudo defaults to the same-origin policy for legacy applications.

Address-Space Layout Randomization (ASLR) techniques prevent intruders from locating target functions by randomizing the process layout. Prior ASLR techniques defended against single-target brute force attacks, which work by locating a single, omnipotent system library function such as execve(). Th ese techniques are not sufficient to defend against chained return-into-lib(c) attacks that call a sequence of system library functions. In this paper, we describe the Island Code Transformation (ICT) that addresses chained return-into-lib(c) attacks. A code island is a block of code that is isolated in the address space from other code blocks. Island code not only randomizes the base pointers used in memory mapping, but also maximizes the entropy in function layout (that is, knowing the location and extent of one function gains the attacker little knowledge as to the memory location of other functions). We also provide an efficacy analysis of randomization schemes based on combinations of available ASLR techniques. Our analysis shows that ICT is exponentially more effective than any prior ASLR technique in defending against brute-force searches for addresses of multiple target functions – a key component of chained return-into-lib(c) attacks. ICT uses a predefined rerandomization threshold, that determines how frequently (in terms of failed attacks) the process layout is re-randomized to balance security and availability. Our overhead measurement on some well-known GNU applications shows that it takes less than 0.05 second to load/rerandomize a process with the necessary C system library functions in code islands, and our technique introduces a 3–10% run-time overhead caused by inter-island control transfers. We, therefore, conclude that ICT is well-suited for dedicated servers.

Matching the resource requirements of a parallel application to the available resources of a large, heterogeneous cluster is a key requirement in effectively scheduling the application tasks on the nodes of the cluster. This paper describes the cost/benefit estimating service (CBES), a runtime scheduling system targeted at finding highly effective schedules (or mappings) of tasks on nodes. CBES relies on its own infrastructure to gather and maintain static and dynamic information profiles for the computing system and the applications of interest. At the core of CBES is a mapping evaluation module which evaluates candidate application mappings on the basis of shortest execution times. By default, CBES uses a simulated-annealing based scheduler to select mappings. The paper presents the design, initial implementation, and test results of CBES on the Centurion cluster at the University of Virginia and the Orange Grove cluster at Syracuse University. These tests demonstrated that the exploitation of internode communication speed differences due to network heterogeneity can yield speedups of over 10% between same architecture nodes. The maximum observed speedup across architectures for the best vs. worst mapping scenarios of the same application was over 36%, while the corresponding average case speedup was approximately 30%

In current extensible monolithic operating systems, loadable kernel modules (LKM) have unrestricted access to all portions of kernel memory and I/O space. As a result, kernel-module exploitation can jeopardize the integrity of the entire system. In this paper, we analyze the threat that comes from the implicit trust relationship between the operating system kernel and loadable kernel modules. We then present a specification-directed access monitoring tool - HECK, that detects kernel modules for malicious code execution. Inside the module, HECK prevents code execution on the kernel stack and the data sections; on the boundary, HECK restricts the module's access to only those kernel resources necessary for the module's operation. Our measurements show that our tool incurs 5-23% overhead on some I/O intensive applications using these modules.

In this paper, we assess the scalability and efficiency of a scalable bandwidth management point (BMP) for guaranteed quality-of-service in DiffServ networks. Our BMP uses centralized network state maintenance and pipe-based intra-domain resource management schemes that significantly reduce the admission control time and minimize the scalability problems present in prior research. We have designed, developed and implemented an enhanced Simple Inter-Domain Bandwidth Broker Signaling (SIBBS) protocol for inter-domain communication. The BMP uses dynamic inter-domain pipes to handle inter-domain provisioning and dynamic provisioning schemes to increase signaling scalability. To assess our BMP implementation in terms of signaling scalability and effective resource utilization, we conducted experiments on a test-bed demonstrating how a BMP substantially increases resource utilization and scalability while requiring minimum changes in the underlying infrastructure.

As the Internet evolves into global communication and commercial infrastructure, the need for quality-of-services (QoSs) in the Internet becomes more and more important. With a bandwidth broker (BB) support in each administrative domain, differentiated services (Diffserv) is seen as a key technology for achieving QoS guarantees in a scalable, efficient, and deployable manner in the Internet. In this paper, we present a scalable model for inter-BB resource reservation and provisioning. Our BB uses centralized network state maintenance and pipe-based intradomain resource management schemes that significantly reduce admission control time and minimize scalability problems present in prior research. For inter-BB communication, we design and implement a BB resource reservation and provisioning protocol (BBRP). BBRP performs destination-based aggregated resource reservation based on bilateral service level agreements (SLAs) between peer-BBs. BBRP significantly reduces the BB and border routers state scalability problem by maintaining reservation state based only on destination region. It minimizes inter-BB signaling scalability by using aggregated type resource reservation and provisioning. Both analytical and experimental results verify the BBRP achievements.

In this paper we present a scalability study on inter-domain tunnels using bandwidth brokers. Our approach is based on collections of autonomous systems called regions. We analyzed our architecture through simulation. Our analysis results show that scalability of the approach depends on the size of the regions, and as the size of the region decreases, scalability of the approach increases. We show that our architecture increases state scalability as well as signaling scalability for Diffserv networks.

Abstract Buffer overflow vulnerabilities are among the most widespread of security problems. Numerous incidents of buffer overflow attacks have been reported and many solutions have been proposed, but a solution that is both complete and highly practical is yet to be found. Another kind of vulnerability called format string overflow has recently been found and although not as widespread as buffer overflow, format string overflow attacks are no less dangerous. This article surveys representative techniques of exploiting buffer overflow and format string overflow vulnerabilities and their currently available defensive measures. We also describe our buffer overflow detection technique that range checks the referenced buffers at run‐time. We augment executable files with the type information of automatic buffers (local variables and parameters of functions) and static buffers (global variables in the data / bss section) and maintain the sizes of allocated heap buffers in order to detect an actual occurrence of buffer overflow. We describe a simple implementation with which we currently protect vulnerable copy functions in the C library. Copyright © 2003 John Wiley & Sons, Ltd.

This paper explores the notion of computational resiliency to provide reliability in heterogeneous distributed applications. This notion provides both software fault-tolerance and the ability to tolerate information-warfare attacks. This technology seeks to strengthen a military mission, rather than to protect its network infrastructure using static defense measures such as network security, intrusion sensors, and firewalls. Even if a failure or attack is successful and never detected, it should be possible to continue information operations and achieve mission objectives. Computational resiliency involves the dynamic use of replicated software structures, guided by mission policy, to achieve reliable operation. However, it goes further to regenerate, automatically, replication in response to a failure or attack, allowing the level of system reliability to be restored and maintained. This paper examines a prototype concurrent programming technology to support computational resiliency in a heterogeneous distributed computing environment. The performance of the technology is explored through two example applications.

Heterogeneous or federated clusters are a significant special case of grid computing. An important factor in efficiently executing applications on such clusters is the mapping (or scheduling) of application tasks onto cluster nodes. The cost/benefit estimating service aims at facilitating the search for efficient mappings both initially and during the evolution of a computation. This service dynamically evaluates alternative mappings using system and application information. Building the necessary database for use with this service involves profiling applications and running benchmark suites on cluster nodes. Recent data obtained at Sandia National Laboratories, NM, demonstrate the existence of differences in computation and communication speeds between the nodes of even simple homogeneous clusters, as well as the feasibility of using such data for predicting the efficiency of application mappings.

Bandwidth management points (BMP) are a necessity to manage the intra and inter-domain resources in the Internet. We propose a way to setup inter-domain label switched path (LSP) with the help of a BMP in a multiprotocol label switching (MPLS) over the Diffserv network. We use extended simple inter-domain bandwidth broker signalling protocol (SIBBS) to distribute the labels inter-domain. We also use a BMP to interact with the MPLS to setup the intra-domain LSP and to provision the intra-domain traffic. With the help of a BMP, we show how end-to-end quality of service (QoS) can be achieved.

To support a vast set of user requirements, flexibility and extensibility are essential features of a metasystem architecture. We present an execution model, the Reflective Graph and Event Model, and demonstrate its use in Legion, an object oriented metasystem project. Reflective features of the model are key in meeting our design goals of flexibility and extensibility.