76,171 research outputs found
Recommended from our members
Arguing satisfaction of security requirements
This chapter presents a process for security requirements elicitation and analysis,
based around the construction of a satisfaction argument for the security of a
system. The process starts with the enumeration of security goals based on assets
in the system, then uses these goals to derive security requirements in the form of
constraints. Next, a satisfaction argument for the system is constructed, using a
problem-centered representation, a formal proof to analyze properties that can be
demonstrated, and structured informal argumentation of the assumptions exposed
during construction of the argument. Constructing the satisfaction argument can
expose missing and inconsistent assumptions about system context and behavior
that effect security, and a completed argument provides assurances that a system
can respect its security requirements
Arguing security: validating security requirements using structured argumentation
This paper proposes using both formal and structured informal arguments to show that an eventual realized system can satisfy its security requirements. These arguments, called 'satisfaction arguments', consist of two parts: a formal argument based upon claims about domain properties, and a set of informal arguments that justify the claims. Building on our earlier work on trust assumptions and security requirements, we show how using satisfaction arguments assists in clarifying how a system satisfies its security requirements, in the process identifying those properties of domains that are critical to the requirements
Confidentiality-Preserving Publish/Subscribe: A Survey
Publish/subscribe (pub/sub) is an attractive communication paradigm for
large-scale distributed applications running across multiple administrative
domains. Pub/sub allows event-based information dissemination based on
constraints on the nature of the data rather than on pre-established
communication channels. It is a natural fit for deployment in untrusted
environments such as public clouds linking applications across multiple sites.
However, pub/sub in untrusted environments lead to major confidentiality
concerns stemming from the content-centric nature of the communications. This
survey classifies and analyzes different approaches to confidentiality
preservation for pub/sub, from applications of trust and access control models
to novel encryption techniques. It provides an overview of the current
challenges posed by confidentiality concerns and points to future research
directions in this promising field
Formal Analysis of V2X Revocation Protocols
Research on vehicular networking (V2X) security has produced a range of
security mechanisms and protocols tailored for this domain, addressing both
security and privacy. Typically, the security analysis of these proposals has
largely been informal. However, formal analysis can be used to expose flaws and
ultimately provide a higher level of assurance in the protocols.
This paper focusses on the formal analysis of a particular element of
security mechanisms for V2X found in many proposals: the revocation of
malicious or misbehaving vehicles from the V2X system by invalidating their
credentials. This revocation needs to be performed in an unlinkable way for
vehicle privacy even in the context of vehicles regularly changing their
pseudonyms. The REWIRE scheme by Forster et al. and its subschemes BASIC and
RTOKEN aim to solve this challenge by means of cryptographic solutions and
trusted hardware.
Formal analysis using the TAMARIN prover identifies two flaws with some of
the functional correctness and authentication properties in these schemes. We
then propose Obscure Token (OTOKEN), an extension of REWIRE to enable
revocation in a privacy preserving manner. Our approach addresses the
functional and authentication properties by introducing an additional key-pair,
which offers a stronger and verifiable guarantee of successful revocation of
vehicles without resolving the long-term identity. Moreover OTOKEN is the first
V2X revocation protocol to be co-designed with a formal model.Comment: 16 pages, 4 figure
Preparedness, Career Advancement, and the Glass Ceiling
Glass Ceiling ReportGlassCeilingBackground15Preparedness.pdf: 4582 downloads, before Oct. 1, 2020
Model for cryptography protection of confidential information
УДК 004.056
Борсуковський Ю.В., Борсуковська В.Ю. Модель криптографічного захисту конфіденційної інформації
В даній статті проведено детальний аналіз вимог щодо формування моделі криптографічного захисту конфіденційної інформації. Розглянуто використання засобів криптографічного захисту інформації з метою реалізації організаційних та технічних заходів по запобіганню витокам конфіденційної інформації на об’єктах критичної інфраструктури. Сформульовані базові вимоги та рекомендації щодо структури та функціональних складових моделі захисту конфіденційної інформації. Формалізовані вимоги щодо створення, впровадження та експлуатації превентивних процедур управління багатоступінчатим захистом конфіденційної інформації. Наведено приклад використання моделі криптографічного захисту інформації для створення захищеної і прозорої в використанні бази аутентифікаційних даних користувача. Запропонована модель захисту дозволяє мати кілька ступенів програмного та апаратного захисту, що із однієї сторони спрощує їх використання при виконанні чинних політик безпеки і зменшує ймовірність дискредитації аутентифікаційних даних, а із іншої сторони підвищує ймовірність виявлення зловмисних дій третьої сторони за рахунок багатоступінчатої системи захисту. Враховано практичний досвід створення типових моделей захисту конфіденційної інформації для розробки, впровадження та управління сучасними політиками інформаційної безпеки щодо питань використання засобів криптографічного захисту конфіденційної інформації на підприємствах різних форми власності.UDC 004.056
Borsukovskyi Y., Borsukovska V. Model for Cryptography Protection of Confidential Information
Current article provides the detailed analysis of requirements for creation of model for cryptography protection of confidential information. Article defines the use of information cryptography protection tools in order to ensure the application of organizational and technical actions to prevent leakage of confidential information at critical infrastructure assets. It provides the basic requirements for the structure and functional elements of model for protection of confidential information. Formalize requirements on creation, implementation and exploitation of preventive procedure in management of multi-level protection of confidential information. The article includes example of use of model for cryptography protection of information for creation of secure and transparent in use the authenticating data base of user. The presented model of protection ensures to have a few levels of firewalls, that, on one hand, simplifies its use in execution of acting security policies and decrease the probability of discrediting of authenticating data, and, on other hand, increase the probability to detect the criminal actions of third party by means of multi-level protection system. It considers the practical experience in creation of standard models for protection of confidential information for development, implementation and management of modern policies on information security in part of use of cryptography protection tools for confidential information at enterprises of different forms of incorporation
Student-Centered Learning: Functional Requirements for Integrated Systems to Optimize Learning
The realities of the 21st-century learner require that schools and educators fundamentally change their practice. "Educators must produce college- and career-ready graduates that reflect the future these students will face. And, they must facilitate learning through means that align with the defining attributes of this generation of learners."Today, we know more than ever about how students learn, acknowledging that the process isn't the same for every student and doesn't remain the same for each individual, depending upon maturation and the content being learned. We know that students want to progress at a pace that allows them to master new concepts and skills, to access a variety of resources, to receive timely feedback on their progress, to demonstrate their knowledge in multiple ways and to get direction, support and feedback from—as well as collaborate with—experts, teachers, tutors and other students.The result is a growing demand for student-centered, transformative digital learning using competency education as an underpinning.iNACOL released this paper to illustrate the technical requirements and functionalities that learning management systems need to shift toward student-centered instructional models. This comprehensive framework will help districts and schools determine what systems to use and integrate as they being their journey toward student-centered learning, as well as how systems integration aligns with their organizational vision, educational goals and strategic plans.Educators can use this report to optimize student learning and promote innovation in their own student-centered learning environments. The report will help school leaders understand the complex technologies needed to optimize personalized learning and how to use data and analytics to improve practices, and can assist technology leaders in re-engineering systems to support the key nuances of student-centered learning
The rise of the blended professional in higher education: a comparison between the United Kingdom, Australia and the United States
This paper builds on earlier work by the author to explore the international dimensions of a study of the changing roles and identities of professional staff in higher education (Whitchurch 2008a and b). It further develops the concept of the blended professional, characterising individuals with identities drawn from both professional and academic domains, and examines the institutional spaces, knowledges, relationships and legitimacies that they construct. Comparisons between the United Kingdom, Australia and the United States are used to provide indicators of possible futures for this group of staff, including their positioning in the university community, the challenges they face, and the potentials that they offer to their institutions
- …