Reaching Agreement in Security Policy Negotiation

Modern SoC designs incorporate several security policies to protect sensitive assets from unauthorized access. The policies affect multiple design blocks, and may involve subtle interactions between hardware, firmware, and software. This makes it difficult for SoC designers to implement these policies, and system validators to ensure adherence. Associated problems include complexity in upgrading these policies, IP reuse for systems targeted for markets with differing security requirement, and consequent increase in design time and time-to-market. In this paper, we address this important problem by developing a generic, flexible architectural framework for implementing arbitrary security policies in SoC designs. Our architecture has several distinctive features: (1) it relies on a dedicated, centralized, firmware-upgradable plug-and-play IP block that can implement diverse security policies; (2) it interfaces with individual IP blocks through their “security wrapper”, which exploits and extends test/debug wrappers; (3) it implements a security policy as firmware code following existing security policy languages; (4) it can implement any security policy as long as relevant observable and controllable signals from the constituent IPs are accessible through the security wrappers; and (5) it realizes a low-overhead communication link between security wrappers of IP blocks and the centralized, dedicated controller. The approach builds on and extends the recent work on developing a centralized infrastructure IP for SoC security, referred to as IIPS, that interface with IP blocks using their boundary scan based wrappers. While this architecture is generic and independent of security policy types, we provide case studies with several common policies to show the flexibility and extendibility of the architecture. We also evaluate its viability in terms of overhead in area and power.

PurposeThe purpose of this paper is to provide a framework for enhancing security policy management in the Grid.Design/methodology/approachThe Grid security policy reconciliation problem is presented. A generic view on the security policy notion is adopted and the security policy ontology notion is introduced and used.FindingsIn the course of this work it was found that, in order to enhance security policy management in the Grid, Grid entities should have the ability to negotiate their security policies. It was also found that, in order to achieve security policy negotiation, effective security policy semantics manipulation towards security policy reconciliation is needed. Finally, it was established, through the use of an example, that if appropriate means are used for security policy reconciliation then incompatible security policy representations can be transformed into compatible ones.Research limitations/implicationsResearch limitations stem from the adoption of a generic view on the security policy notion and the selection of identification and authentication security policies as the focal point of the proposed framework. Research implications include the possibility of examining how existing security policy reconciliation models can be incorporated in this generic framework. The possibility of investigating how such a framework can lead to a security policy knowledge management tool for Grid administrators is also demonstrated.Practical implicationsPractical implications of this work include the establishment of a common framework for security information exchange between Grid entities.Originality/valueThis paper proposes a framework for enhancing security policy management in the Grid. The proposed framework can be used by researchers as a reference and by security experts in order to reduce ambiguity concerning the interpretation of security policies expressed in different forms, by negotiating Grid entities.

Monitoring is a powerful security policy enforcement paradigm that allows the execution of a potentially malicious software by observing and transforming it, thus ensuring its compliance with a user-defined security policy. Yet some restrictions must be imposed on the monitor's ability to transform sequences for the enforcement to be meaningful. The intuition behind our model is that the monitor should be bounded to output a sequence that both respects the desired security property and preserves key elements of the execution's semantics. An approximation of the sequence is executed rather than an equivalent one. This approximation must preserve the essential behavior of the sequence as intended by the user. In this paper, we propose a framework to express and study such a restriction based on partial orders. We give several examples of real-life security policies and propose monitors capable of enforcing these properties. We then turn to the question of comparing several monitors enforcing the same security property.

Present data sharing and integration among collaborating organizations requires a central and trusted authority to check the users' requests before allowing the request to pass to the centralized repository to collect data from all data sources and integrate the collected data. Heterogeneity and dynamic nature of ubiquitous computing environments makes critical to generate an integrated security policy set to govern the interactions among the collaborating organizations. Each organization manages its own resources and can function autonomously and a group of collaborating organizations can be formed and changed at runtime. As organizations are peers to each other. Normally, there is no organization to serve as an authority to manage the interactions among various collaborating organizations. Due to these characteristics, we have the three major challenges for providing security in such environments: ambiguous security policy specifications, dynamic set of users and conflicting security policies. To address the given challenges and specify the access control policies a Security Policy Integration and Conflict Reconciliation (SPICR) layer is introduced between the user application and the repository for security policy negotiation and conflict reconciliation in policy-based ubiquitous environment. With our proposed layer, data sharing services can control the access, limit the usage of their shared data, and improves data sharing and efficiency of the data-centralized repository making the system scalable with little human intervention. The proposed layer performs security policy integration based on similarity policy adaptation algorithm and negotiation policy.

International cooperation for purposes of infectious and tropical disease control goes back to at least the 14th century, when early concepts of quarantine were introduced in Dubrovnik on the Adriatic Coast of Croatia [1], [2], and to the later date of 1851, when Europe held its first International Sanitary Conference for multilateral cooperation to prevent the spread of cholera and, subsequently, plague and yellow fever [3]. Such efforts led to a series of international sanitary treaties and conventions and ultimately to the formation of the Pan American Health Organization and the later establishment of the World Health Organization (WHO) [3], [4]. Some scholars trace our current framework for global health diplomacy to the writings of Dr. Peter G. Bourne in his role as special assistant for health issues to US President Jimmy Carter [5] and later (during the first years of the 21st century) to the launch of the Millennium Development Goals (MDGs) and the release of the “Report of the Commission for Macroeconomics and Health”, when global health was placed squarely in the international diplomacy arena [6]. Among the driving forces for these activities was an urgent need for diplomatic collaboration to combat pandemics caused by HIV/AIDS and seasonal and avian influenza, which came with the revelation that such diseases are threats to economic development and both national security and foreign policy interests [7]. There were also practical considerations concerning potential bioterrorist threats and situations that required international diplomacy, such as when Indonesia balked at sharing its time-sensitive avian influenza data or when Nigeria and Pakistan halted polio and other immunization initiatives because of religious tensions [7]–[11]. In 2007, foreign ministers from seven countries—Brazil, France, Indonesia, Norway, Senegal, South Africa, and Thailand—issued the landmark “Oslo Ministerial Declaration” that formally linked global health to foreign policy [12]. At that time, Kickbusch et al. defined global health diplomacy in terms of processes by which governments and civil societies both “position health in foreign policy negotiations” and create new types of “global health governance” [13], [14]. More recently, Kickbusch and Lokeny defined it as a “system of organization and communications and negotiation processes that shape global policy environment in the sphere of health and its determinants” [15]. A key element of modern global health diplomacy is that “no longer do diplomats just talk to other diplomats”, but instead a variety of experts in different areas and disciplines are now brought in to solve timely global health issues [13]. Katz et al. [9] have since categorized different aspects of global health diplomacy to include the following: (1) core diplomacy, referring to “classical Westphalian negotiations” between nations leading to bilateral and multilateral treaties, such as the recent WHO Framework Convention on Tobacco Control and International Health Regulations (IHR) 2005; (2) multistakeholder diplomacy, i.e., negotiations between or among nations and international agencies such as WHO, the GAVI Alliance, United States Agency for International Development (USAID), and nongovernmental organizations (NGOs); and (3) informal diplomacy, which includes peer-to-peer scientific partnerships, private funders such as the Bill & Melinda Gates Foundation, and even some government employees from USAID or the US military working more or less independently in the field due to unique circumstances [9]. Michaud and Kates have identified similar forms of global health diplomacy [16]. Kickbusch and Lokeny have also noted recently that the WHO director-general made frequent mention of health diplomacy in her remarks at the January 2013 executive session [15]. Among the factors responsible for this emphasis are globalization associated with the renewed emphasis on “soft power”, security policy, trade agreements, and policies concerning the environment and international development, as well as the inclusion of health issues as part of the United Nations and summits held by various government organizations and agencies, such as the Group of Eight (G8) and Group of Twenty (G20) nations, the European Union (EU), the Organization of the Islamic Conference (OIC), and the BRICS (Brazil, Russia, India, China, and South Africa) countries [15]. Still another factor is the increasing use of health attaches embedded in foreign delegations and agencies and increasing dialogue with low- and middle-income countries [15]. With regards to the G20 (and their BRICS-country components), I introduced the term “blue marble health” to refer to the unexpectedly high neglected disease burden among the poor living in emerging economies and even some G20 countries, circumstances such that these nations could drastically reduce global burdens of neglected diseases by taking greater responsibility for their own health concerns [17], [18].

Software systems are becoming heterogeneous: instead of a small number of large programs from well-established sources, a user's desktop may now consist of many smaller components that interact in intricate ways. Some components will be downloaded from the network from sources that are only partially trusted. A user would like to know that a number of security properties hold, e.g., that personal data is not leaked to the net, but it is typically infeasible to verify that such components are well-behaved. Instead, they must be executed in a secure environment that provides fine-grain control of the allowable interactions between them, and between components and other system resources.In this paper, we consider the problem of assembling concurrent software systems from untrusted or partially trusted off-the-shelf components, using wrapper programs to encapsulate components and enforce security policies. We introduce a model programming language, the box-π calculus, that supports composition of software components and the enforcement of information flow security policies. Several example wrappers are expressed using the calculus; we explore the delicate security properties they guarantee. We present a novel causal type system that statically captures the allowed flows between wrapped possibly-badly-typed components; we use it to prove that an example ordered pipeline wrapper enforces a causal flow property.

Nowadays, security policies are the key point of every modern infrastructure. The specification and testing of such policies are the fundamental steps in the development of a secure system. To address both challenges, we propose a framework that automatically generates test sequences to validate the conformance of a security policy. The functional behavior of the system is specified using a formal description technique based on Extended Finite-State Machines (EFSMs), while security requirements are specified using XACML. We develop specific algorithms to integrate the security rules into the functional system specification. In this way, we obtain a complete specification of the secured system. Then, automatic test generation is performed using a dedicated tool called TestGen-IF which was developed in our laboratory. This generation is based on the security properties as test objectives. Finally, a case study is presented to demonstrate the reliability of our framework.

Trust is a critical issue for communication protocols in open systems that operate in dynamic and highly uncertain environments. It influences not only the specification of security policies but also the techniques needed to manage and implement security policies. A formal system for the specification of trust for such systems requires the ability to reason about agent beliefs as well as the evolution of the system through time. In this paper, we use a fibred logic called FL which is obtained by combining a belief logic with a temporal logic for specifying agent beliefs and establishing trust theories for communication protocols. A theory of trust for a given system is captured by a set of rules in FL that describes the trust of agents in the system. This enables automated reasoning about theories of trust using the decision procedures of FL such as axiom systems and tableaux. Theories of trust are generally established based on the initial trust of agents in the security mechanisms of the system in which they are deployed. Such theories provide a foundation for reasoning about agent beliefs as well as security properties that systems may satisfy.KeywordsTemporal LogicMultiagent SystemCommunication ProtocolSecurity PolicyAuthentication ProtocolThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

Analyzing and administrating system security policies is difficult as policies become larger and more complex every day. The paper present work toward analyzing security policies and sessions in terms of security properties. Our intuition was that combining both visualization tools that could benefit from the expert’s eyes, and software analysis abilities, should lead to a new interesting way to study and manage security policies as well as users’ sessions. Rather than trying to mine large and complex policies to find possible flaws within, work may concentrate on which potential flaws are really exploited by attackers.Actually, the paper presents some methods and tools to visualize and manipulate large SELinux policies, with algorithms allowing to search for paths, such as information flows within policies.The paper also introduces a complementary original approach to analyze and visualize real attack logs as session graphs or information flow graphs, or even aggregated multiple-sessions graphs.Our wishes is that in the future, when those tools will be mature enough, security administrator can then confront the statical security view given by the security policy analysis and the dynamical and real-world view given by the parts of attacks that most often occurred.

Many companies are interested in using IoT devices, either to optimize their business processes and reduce costs or for lack of alternatives. The situation is similar to a few years ago, when cameras were banned on company premises for security reasons, but all cell phones on the market had cameras. Observations have shown that the security properties of IoT devices with similar functionality can differ significantly. This makes it difficult for management to identify IoT devices that comply with security policies. To enable management to evaluate the security levels of IoT devices before purchase, we introduce INFINITE, our 3-dimensional INternet oF thINgs maturITy modEl. INFINITE can be used at the time of procurement to determine the extent to which an IoT device’s security practices are implemented and whether it meets the company’s security policies. This simplifies the procurement process, prevents the procurement of IoT devices that do not integrate with an enterprise-wide security strategy, and ultimately saves costs. To this end, INFINITE allows us to look at both the software and hardware lifecycle of an IoT device.

Software engineers inadvertently introduce bugs into software during the development process and these bugs can potentially be exploited once the software is deployed. As the size and complexity of software systems increase, it is important that we are able to verify and validate not only that the software behaves as it is expected to, but also that it does not violate any security policies or properties. One of the approaches to reduce software vulnerabilities is to use a bug detection tool during the development process. Many bug detection techniques are limited by the burdensome and error prone process of manually writing a bug specification. Other techniques are able to learn specifications from examples, but are limited in the types of bugs that they are able to discover. This work presents a novel, general approach for synthesizing security rules for C code. The approach combines human knowledge with an interactive logic programming synthesis system to learn Datalog rules for various security properties. The approach has been successfully used to synthesize rules for three intraprocedural security properties: (1) out of bounds array accesses, (2) return value validation, and (3) double freed pointers. These rules have been evaluated on randomly generated C code and yield a 0% false positive rate and a 0%, 20%, and 0% false negative rate, respectively for each rule.--Author's abstract

Central Asia, being an important zone in the Silk Road Economic Belt of the China Road «One Belt-One Way», is an important economic channel for China, connecting European countries by land. Transport communication is the basis of the work of the initiative «One belt-one path», therefore it is important and priority. Although the development of land connections (railways, highways) between China and Central Asia has made significant progress, passenger services, especially air passenger services, are still underdeveloped. The paper explains the state of development and existing problems of the bilateral air passenger transport market between China and Central Asia through the data analysis and policy studies of the «Bilateral Air Agreement». Three policy recommendations are put forward within the framework of the «One Belt-One Way» initiative. First, China and five Central Asian countries should use the platform created by the initiative «One Belt-One Way» to actively negotiate new bilateral air agreement between governments in the field of law, airports of general aviation, capacity and airline access to further ease regulations. Considering concerns that five Central Asian countries may have regarding the protection of their national airlines, the negotiation of an aviation agreement between China and Central Asia may use a model of negotiations between US and Canada on bilateral aviation agreement. Second, given the capacity of airports and rapid economic development of China’s second and third level cities, Governments’ preferential airport policies in China’s second- and third-tier cities could be extended to attract Chinese and Central Asian airlines to operate direct flights between these cities and Central Asia. Third, to allow and encourage private and budget airlines to enter China-Central Asia airline market. These airlines can use their own price advantages to open up new markets that are not sufficiently attractive to traditional airlines.

This article addresses a particular aspect of EU external governance: rule selection. Drawing on institutionalist and power-based explanations we put forward an account for the choice of the specific rules that guide policy convergence between the EU and third countries. The proposed analytical framework broadens the scope of the studies examining the externalization of EU rules beyond its borders, in that we claim that the EU can promote policy convergence using rules other than the EU's. More specifically, the EU also promotes policy convergence on the basis of international and bilaterally developed rules. These analytical claims for explaining rule selection are checked against empirical data. We compare policy convergence between the EU and four neighbouring countries (Morocco, Ukraine, Georgia, and Russia) in three subfields within foreign and security policy: foreign policy dialogue, control of export of dual-use goods in the context of non-proliferation of weapons of mass destruction, and crisis management.

EU Foreign Policy Elites and Fundamental Norms - Implications for Governance

In Encumbered Cuba, Susan Fernandez shows how, in the competition for capital, Spain lost Cuba before a shot was even fired in the 1895 war for independence. She argues that economic forces after the Ten Years' War both ensured American intervention and reduced Cuban opposition to the U.S. political direction of the Cuban economy. No comparable study, in either English or Spanish, addresses the financial links among these three countries and the developmental implications of those relations for Cuba in its late-colonial economic and financial history. Fernandez shows that the unsupportive fiscal and monetary policies of Spain limited diversification, industrialization, and food security while deepening Cuban-U.S. ties. Extensive primary research on merchant capital and on Cuban banks, particularly the Banco Espanol de la Isla de Cuba and the Banco Hispano-Colonial, is the basis for Fernandez's argument. Her provocative conclusion is that Cuba's rejection of colonial rule in 1895 was primarily a revolt against Spanish economic direction that cut across classes.