We present a distributed algorithm for a multiagent system in a collaborative setting including the cost of actions. We revise the distributed Max-Plus algorithm by presenting a new Cost Distributed Max-Plus (CD Max-Plus) algorithm by including the cost of actions in the interactions of agents, named Factored Value-MCTS-CD Max-Plus algorithm. The proposed Factored Value-MCTS-CD Max-Plus algorithm is online, anytime, distributed, and scalable in number of agents and their interactions. Our contribution is an alternative solution for solving cost Dec-POMDPs competing with the state of art methods and algorithms using MCTS and Max-Plus algorithms to exploit the locality of agent interactions for planning and acting.

Software-Defined Networking (SDN) provides a programmable framework for multi-tenant cloud network management and orchestration. The end-to-end packet processing induced by virtual network functions (VNFs) like stateless firewall, load balancer, intrusion detection, and prevention system (IDPS) in a network involves the processing of network traffic through security policies matching the traffic pattern defined in security rules of individual VNF. The conflicting rules in terms of traffic match and conflicting actions can lead to a) violation of security requirements (authentication and authorization bypass) b) mission requirements - the presence of redundant rules (increased latency, reduced throughput). We present a new object-oriented policy conflict detection and resolution framework (OOPC), which analyzes the rule dependency relationships between the rules of heterogeneous virtual network functions (VNFs) and creates a VNF-Graph. The rules are analyzed using object-oriented dependencies between the address space and actions of VNF rules. OOPC utilizes a compact VNF-Graph, which leads to a reduction in search complexity when analyzing new security policies. Our security policy composition in our framework OOPC achieves 37 percent lower latency in policy graph composition than previous work. The proposed solution performs 20 percent faster security policy conflict detection on a cloud network with 60k OpenFlow rules than prior frameworks that serve a similar purpose.

We describe ACR-SDN, a system to monitor, diagnose, and quickly respond to attacks or failures that may occur in software-defined networks (SDNs). An integral part of ACR-SDN is its use of RAE+UPOM, an automated acting and planning engine that uses hierarchical refinement. To advise ACR-SDN on how to recover a target system from faults and attacks, RAE+UPOM uses attack recovery procedures written as hierarchical operational models. Our experimental results show that the use of refinement planning in ACR-SDN is successful in recovering SDNs from attacks with respect to five performance metrics: estimated time for recovery, efficiency, retry ratio, success ratio, and costEffectiveness.

We focus on a real-time multiagent decision making problem in a collaborative setting including a cost factor for the planning and execution of actions. We present the centralized coordination of a multiagent system in which the team must make a collaborative decision to maximize the global payoff. We used the framework of Coordination Graphs, which exploit dependencies among agents to decompose the global payoff function value as the sum of local terms. We revise the centralized Max-Plus algorithm by presenting a new Cost Max-Plus algorithm for planning and acting by including the cost in the local interactions of agents. We propose a two-step planning and acting algorithm called Factored Value-MCTS-Cost-Max-Plus algorithm that is online, anytime, and scalable in terms of the number of agents and their local interactions.

Software Defined Networking (SDN) has emerged as a revolutionary paradigm to manage cloud infrastructure. SDN lacks scalable trust setup and verification mechanism between Data Plane-Control Plane elements, Control Plane elements, and Control Plane-Application Plane. Trust management schemes like Public Key Infrastructure (PKI) used currently in SDN are slow for trust establishment in a larger cloud environment. We propose a distributed trust mechanism - TRUFL to establish and verify trust in SDN. The distributed framework utilizes parallelism in trust management, in effect faster transfer rates and reduced latency compared to centralized trust management. The TRUFL framework scales well with the number of OpenFlow rules when compared to existing research works.

We focus on the detection of Low Rate Denial of Service Attacks (LR DoS) based on their spectral properties. We revised the Fisher g-statistic test and Siegel test for detection of LR DoS attacks such as Shrew and New Shrew attacks. Our results reveal that these attacks can be effectively identified by using Fisher g-statistic test for one dominant periodicity as in the case of Shrew attacks. When multiple (compound) dominant periodicities exist in the case of New Shrew attacks, Siegel test can identify the attack better than Fisher g-statistic test. Our contribution consists in developing a new methodology for rejecting the null hypothesis or identifying LR DoS attacks. Numerical examples for a confidence interval at significance level of α = 0.01 and α = 0.05 are given for Shrew and New Shrew attacks.

Separation kernels are the strongest known form of separation for virtual machines. We agree with NSA's Information Assurance Directorate that while separation kernels are stronger than any other alternative, their construction on modern commodity hardware is no longer justifiable. This is because of orthogonal feature creep in modern platform hardware. We introduce the separation VMM as a response to this situation and explain how we prototyped one.

The Naval Research Laboratory (NRL) Network Pump, or Pump, is a standard for mitigating covert channels that arise in a multilevel secure (MLS) system when a high user (HU) sends acknowledgements to a low user (LU). The issue here is that HU can encode information in the "timings" of the acknowledgements. The Pump aims at mitigating the covert timing channel by introducing buffering between HU and LU, as well as adding noise to the acknowledgment timings. We model the working of the Pump in certain situations, as a communication system with feedback and use then this perspective to derive an upper bound on the capacity of the covert channel between HU and LU in the Pump. This upper bound is presented in terms of a directed information flow over the dynamics of the system. We also present an achievable scheme that can transmit information over this channel. When the support of the noise added by Pump to acknowledgment timings is finite, the achievable rate is nonzero, i.e., infinite number of bits can be reliably communicated. If the support of the noise is infinite, the achievable rate is zero and hence a finite number of bits can be communicated.

The NRL Network Pump®, or Pump, is a standard for mitigating covert channels that arise in a multi-level secure (MLS) system when a high user (HU) sends acknowledgements to a low user (LU). The issue here is that HU can encode information in the “timings” of the acknowledgements. The Pump aims at mitigating the covert timing channel by introducing buffering between HU and LU, as well as adding noise to the acknowledgment timings. Here, for the first time, we model the workings of the Pump in certain situations, as a communication system with feedback and use then this novel perspective to derive a upper bound on the rate of the covert channel between HU and LU in the Pump, in specific situations. This upper bound is presented in terms of a directed information flow over the dynamics of the system.

Cloud computing allows the use of Internet-based services to support business processes and rental of IT-services on a utility-like basis. It offers a concentration of resources but also poses risks for data privacy. A single breach can cause significant loss. The heterogeneity of “users” represents a danger of multiple, collaborative threats. In cloud computing, entities may have multiple accounts associated with a single or multiple service providers (SPs). Sharing sensitive identity information (that is, Personally Identifiable information or PII) along with associated attributes of the same entity across services can lead to mapping of the identities to the entity, tantamount to privacy loss. Identity management (IDM) is one of the core components in cloud privacy and security and can help alleviate some of the problems associated with cloud computing. Available solutions use trusted third party (TTP) in identifying entities to SPs. The solution providers do not recommend the usage of their solutions on untrusted hosts. We propose an approach for IDM, which is independent of TTP and has the ability to use identity data on untrusted hosts. The approach is based on the use of predicates over encrypted data and multi-party computing for negotiating a use of a cloud service. It uses active bundle-which is a middleware agent that includes PII data, privacy policies, a virtual machine that enforces the policies, and has a set of protection mechanisms to protect itself. An active bundle interacts on behalf of a user to authenticate to cloud services using user's privacy policies.

Although universal description, discovery and integration (UDDI) is the de jure Web service registry standard, it is not suitable for handling semantic markups due to its flat data model and limited search capabilities. In this paper, we introduce an approach to support semantic service descriptions and queries using registries that conform to the UDDI version 3 specification. Specifically, we present a scheme that allows users to store OWL-S service descriptions in the UDDI data model and use that information to perform semantic query processing. Our approach does not require any modification to the existing UDDI registries. The add-on modules only reside on the client-side machines that wish to take advantage of the semantic capabilities. This approach is completely backward compatible and can integrate seamlessly into the existing service-oriented architecture (SOA) infrastructure

This paper traces the ten plus year history of the Naval Research Laboratory's Pump idea. The Pump was theorized, designed, and built at the Naval Research Laboratory's Center for High Assurance Computer Systems. The reason for the Pump is the need to send messages from a "low" enclave to a "high" enclave, in a secure and reliable manner. In particular, the Pump was designed to minimize the covert channel threat from the necessary message acknowledgements, without penalizing system performance and reliability. We review the need for the Pump, the design of the Pump, the variants of the Pump, and the current status of the Pump, along with manufacturing and certification difficulties.

As more businesses engage in globalization, inter-organizational collaborative computing grows in importance. Since we cannot expect homogeneous computing environments in participating organizations, heterogeneity and Internet-based technology are prevalent in inter-organizational collaborative computing environments. One technology that provides solutions for data sharing and work coordination at the global level is inter-organizational workflow. In this paper, we investigate the access control requirements for inter-organizational workflow. We then present access control solutions for inter-organizational workflow based on our implementation. Many of the requirements and solutions in this paper address the scalability of existing security solutions, the separation of inter-organizational workflow security from concrete organization level security enforcement, and the enforcement of fine-grained access control for inter-organizational workflow.

Secure enterprise programming is a difficult and tedious task. Programmers need tools that support different levels of abstraction and that track all the components that participate in distributed enterprises. Those components must cooperate in a distributed environment to achieve higher level goals. A special case of secure enterprise computing is multilevel secure (MLS) computing. Components that may reside in different security domains have to cooperate to achieve higher-level missions. To ease the programmer's burden, we are developing an MLS workflow management system (WFMS), called MLS METEOR. A programmer can specify a distributed programming logic through a GUI based workflow design tool. Based on the programming logic, MLS METEOR will generate a distributed runtime system that handles communication among different hosts, even those that reside in different classification domains, The multilevel security enforcement of MLS METEOR does not depend on the WFMS itself but rather on the underlying MLS infrastructure and a few security critical components. The paper concentrates on the system organization of MLS METEOR and the rationale for this structure. We explain which portions of the system can be used in generic enterprise computing and which portions are specific to MLS computing.

Distributed computing owes its success to the development of infrastructure, middleware, and standards (e.g., CORBA) to support interoperability. The computing community has slowly recognized the need to protect information and has begun to develop commercial security infrastructures and standards. The US Government must protect national security information against unauthorized information flow. To support MLS distributed computing, a MLS infrastructure must be built that enables information sharing among users at different classification levels. This infrastructure should provide MLS services for protection of classified information and use both the emerging distributed computing and commercial security infrastructures, when possible. The resulting infrastructure will enable users to integrate commercial information technology products into their systems. In this paper, we examine the philosophy that has led to successful distributed computing among heterogeneous, autonomous components and propose an analogous approach for MLS distributed computing. We identify some services that are required to support MLS distributed computing, argue that these services are needed regardless of the MLS architecture used, present an approach for designing these services, and provide design guidance for a critical building block of the MLS infrastructure.

Golomb analyzed the Z-channel, a memoryless channel with two input symbols and two output symbols, where one of the input symbols is transmitted with noise while the other is transmitted without noise, and the output symbol transmission times are equal. We generalize to the timed Z-channel, where the output symbol transmission times are not equal. The timed Z-channel appears as the basis for a large class of covert (communication) channels appearing in multilevel secure computer systems. We give a detailed mathematical analysis of the timed Z-channel and report a result expressing the capacity of the timed Z-channel as the log of the root of a characteristic equation. This generalizes Shannon's work on noiseless channels for this special case. We also report a new result bounding the timed Z-channel's capacity from below. We show how an interesting observation that Golomb reported for the Z-channel also holds for the timed Z-channel.

As computer systems become distributed and heterogeneous, there is strong movement in the commercial sector to ease the problems of interoperability and security. Many standards have been proposed for these problems. However, the commercial sector has not shown strong interest in providing cost effective high assurance multilevel security (MLS) solutions to the relatively small communities (e.g., intelligence, military) that require them. We introduce a practical, cost effective, and high assurance secure solution for multilevel distributed and heterogeneous environments using COTS components. The solution is based on an MLS architecture that consists of commercial single level hardware and software, and a few specialized security devices. We show how an MLS CORBA can be constructed from single level CORBAs and two security devices; the NRL Pump and the Starlight Interactive Link. We also introduce the concept of MLS cooperative computing which is a way to semi automate distributed computing among organizations at different security levels.

We examine a new way of looking at security violations, called insecurity flow.We express our new paradigm via a formal mathematical model that combines elements of graph theory and discrete probability.Prior work by Moore and Shannon on building reliable circuits out of unreliable components, and the physics community's interest in dynamical systems, especially percolation theory, motivates our work.

As computer systems become more open and interconnected, the need for reliable and secure communication also increases. The NRL (Naval Research Laboratory) Pump was introduced by Kang and Moskowitz (1993) to balance the requirements of reliability, congestion control, fairness and good performance against those of threats from covert channels and denial-of-service attacks. In this paper, we describe two prototype efforts. One (the event-driven Pump or E-Pump) implements the Pump at the process (top) layer in terms of a 4-layer network reference model, and the other (the DOS-Pump or D-Pump) implements the Pump at the transport layer. We then discuss lessons learned and how these lessons are to be used in deciding upon the final hardware implementation of the Pump.

Our timed Z-channel (a general case of the Z-channel) appears as the basis for a large class of covert channels. Golomb (1980) analyzed the Z-channel, a memoryless channel with two input symbols and two output symbols, where one of the input symbols is transmitted with noise while the other is transmitted without noise, and the output symbol transmission times are equal. We introduce the timed Z-channel, where the output symbol transmission times are different. Specifically, we show how the timed Z-channel applies to two examples of covert timing channel scenarios: a CPU scheduler and a token ring network. We then give a detailed analysis of our timed Z-channel. We report a new result expressing the capacity of the timed Z-channel as the log of the root of a trinomial equation. This changes the capacity calculation from an optimization problem into a simpler algebraic problem and illustrates the relationship between the noise and time factors. Further, it generalizes Shannon's (1948, 1949) work on noiseless channels for this special case. We also report a new result bounding the timed Z-channel's capacity from below. Finally, we show how an interesting observation that Golomb reported for the Z-channel also holds for the timed Z-channel.

A designer of reliable multi level secure (MLS) networks must consider covert channels and denial of service attacks in addition to traditional network performance measures such as throughput, fairness, and reliability. We show how to extend the NRL data Pump to a certain MLS network architecture in order to balance the requirements of congestion control, fairness, good performance, and reliability against those of minimal threats from covert channels and denial of service attacks. We back up our claims with simulation results.

A designer of reliable MLS networks must consider covert channels and denial of service attacks in addition to traditional network performance measures such as throughput, fairness, and reliability. We show how to extend the NRL data Pump to a certain MLS network architecture in order to balance the requirements of congestion control, fairness, good performance, and reliability against those of minimal threats from covert channels and denial of service attacks. We back up our claims with simulation results.>

Current projects aimed at providing MLS computing services rarely seem to exploit advances in related fields. Specifically, the concepts of data distribution, replication, and interoperation are currently receiving much attention in the commercial database system sector but have yet to be applied to the delivery of MLS computing services. This paper explains how these concepts might kelp deliver MLS computing services relatively, quickly and cheaply, and how they can ease integration of legacy systems and new technology into future MLS cooperative, distributed computing environments.>

Since protection and assurance are the primary concerns in multilevel secure (MLS) databases, performance has often been sacrificed in some known MLS database approaches. Motivated by performance concerns, a replicated architecture approach which uses a physically distinct back-end database management system for each security level is being investigated. This is a report on the behavior and performance issues for the replicated architecture approach. Especially, we compare the performance of the SINTRA (Secure INformation Through Replicated Architecture) MLS database system to that of a typical conventional (non-secure, single-level) database system. After observing the performance bottlenecks for SINTRA, we present solutions that can alleviate them.>

Communication from a low- to a high-level system without acknowledgements will be unreliable; with acknowledgements, it can be insecure. We propose to provide quantifiable security, acceptable reliability, and minimal performance penalties by interposing a device (called the Pump) to push messages to the high system and provide a controlled stream of acknowledgements to the low system.