This panel will address the following question. Does an increase in the granularity of access control systems produce a measurable reduction in risk and help meet the goals of the organization, or is the cost prohibitively high?

This paper presents a new concept for efficient access rights administration and access control. It focuses on the special requirements of application security and reflects experiences from the implementation of security for large industry application systems. Application security shows a considerable inherent complexity due to the large number of combinations of objects and processes for which access rights must be defined. Based on practical experiences, this paper introduces a new approach for the implementation of access control for application systems which reduces this complexity. After describing the challenges for such an approach, we introduce process spaces and object spaces as a basis for authorisations. We show how they make application security maintainable, controllable and offer sufficient flexibility for reaction to changing business needs. In addition, we discuss how a separation of administration and access layers allows for convenient administration as well as optimised access decision performance in business-critical applications. To facilitate the integration of this rule-based concept into enterprise-wide security administration, we show how application security can be integrated into role-based access control (RBAC) systems. In particular, this goal is achieved by enhancing Enterprise RBAC (ERBAC) with variable roles. These roles can contain variable process and object spaces referencing user and role attributes. Finally, we give a short overview over related work.

In this paper we describe the work devising a new technique for role-finding to implement Role-Based Security Administration. Our results stem from industrial projects, where large-scale customers wanted to migrate to Role-Based Access Control (RBAC) based on already existing access rights patterns in their production IT-systems.

Roles are a powerful and policy neutral concept for facilitating distributed systems management and enforcing access control. Models which are now subject to becoming a standard have been proposed and much work on extensions to these models has been done over the last years as documented in the recent RBAC/SACMAT workshops. When looking at these extensions we can often observe that they concentrate on a particular stage in the life of a role. We investigate how these extensions fit into a more general theoretical framework in order to give practitioners a starting point from which to develop role-based systems. We believe that the life-cycle of a role could be seen as the basis for such a framework and we provide an initial discussion on such a role life-cycle, based on our experiences and observations in enterprise security management. We propose a life-cycle model that is based on an iterative-incremental process similar to those found in the area of software development.

With the reducing distances between wires in deep submicrometer technologies, coupling capacitances are becoming significant as their magnitude becomes comparable to the area capacitance and fringing capacitance of a wire. This causes an increasing susceptibility to failure due to inadvertent noise and leads to a requirement for accurate noise estimation. An incorrect estimation of the noise could lead either to circuit malfunction in case of underestimation or to wasted design resources due to overestimation. This paper presents a new time-efficient method for the precise estimation of crosstalk noise. While existing fast noise estimation metrics may overestimate the coupling noise by several orders of magnitude, the proposed metric computes the coupling noise with a good accuracy as compared to SPICE.

The complex valued matched filter correlators consume maximum power in the DS/SS CDMA receivers. These correlators accumulate 1024 samples lying in the range -7 to +7. This accumulation needs 3 data bits, 1 sign bit and 10 extra bits for overflow. Hence, the correlator can be implemented as a cascade of 4-bit full adder and a 10-bit incrementer. As a ripple carry adder (RCA) consumes the least power among all the existing adder architectures, we have implemented the 4-bit adder as a RCA. Previous incrementers were implemented as ripple counters. In this paper we propose a novel incrementer which is faster than a ripple counter based incrementer. Hence, it can be operated at a reduced voltage resulting in considerable power reduction. The incrementer is implemented using multiplexers, AND gates and TSPC registers. The ripple-counter correlator and the proposed incrementer correlator were laid out in MAGIC using 0.5µ CMOS technology followed by power estimation using HSPICE. It is shown that the proposed architecture requires 50% less power than a ripple counter based design.

With the reducing distances between wires in deep sub-micron technologies, coupling capacitances are becoming significant as their magnitude becomes comparable to the area capacitance and fringing capacitance of a wire. This causes an increasing susceptibility to failure due to inadvertent noise, and leads to a requirement for accurate noise estimation. An incorrect estimation of the noise could lead either to circuit malfunction in the case of under-estimation, or to wasted design resources due to overestimation. This paper presents a new time-efficient method for the precise estimation of crosstalk noise. While existing fast noise estimation metrics may overestimate the coupling noise by several orders of magnitude, the proposed metric computes the coupling noise with a good accuracy as compared to SPICE.

This paper addresses a fast low-power implementation of a shared division and square-root architecture. Two approaches are considered in this paper; these include the SRT (Sweeney, Robertson and Tocher) approach which does not require prescaling and the GST (generalized Svoboda and Tung) approach which requires prescaling of the operands. This paper makes two important contributions. Although SRT division and square-root approaches and GST division approach have been known for long time, square-root architectures based on the GST approach have not been proposed so far. This paper for the first time, develops a GST square-root architecture without requiring an additional division by the scaling factor after the square-root operation. Although various divider and square-root architectures have been compared with respect to speed, no tradeoffs with respect to power consumption of these architectures have been studied so far quantitative comparison of speed and power consumption of GST and SRT division/square-root units is the second main contribution of the paper. Shared divider and square-root units are designed based on the SRT and the GST approaches, in both minimally and maximally redundant radix-4 representations. Simulations demonstrate that the worst-case overall latency of the minimally-redundant GST architecture is 35% smaller compared to the SRT. Alternatively, for a fixed latency, the minimally-redundant GST architecture based division and square-root operations consume 42% and 20% less power respectively, compared to the maximally-redundant SRT approach.