2012, English, eng, Thesis edition: Functionality-based application confinement: A parameterised and hierarchical approach to policy abstraction for rule-based application-oriented access controls Schreuders, Z. Cliffe.

User activity

Send to:
 
Bookmark: http://trove.nla.gov.au/version/175398333
Physical Description
  • Thesis
  • xvi, 336 p. : ill. ; 31 cm.
Published
  • 2012.
Language
  • English
  • eng

Edition details

Title
  • Functionality-based application confinement : a parameterised and hierarchical approach to policy abstraction for rule-based application-oriented access controls /​ Z. Cliffe Schreuders.
Author
  • Schreuders, Z. Cliffe.
Other Authors
  • Murdoch University. Faculty of Law, Business and Information Technology.
Other Contributors
  • McGill, Tanya
  • Payne, Christian
Published
  • 2012.
Physical Description
  • Thesis
  • xvi, 336 p. : ill. ; 31 cm.
Series
Part Of
  • Schreuders, Z. Cliffe <http:/​/​researchrepository.murdoch.edu.au/​view/​author/​Schreuders, Cliffe.html> (2012) Functionality-based application confinement: A parameterised and hierarchical approach to policy abstraction for rule-based application-oriented access controls. PhD thesis, Murdoch University.
Subjects
Summary
  • Access controls are traditionally designed to protect resources from users, and consequently make access decisions based on the identity of the user, treating all processes as if they are acting on behalf of the user that runs them. However, this user-oriented approach is insufficient at protecting against contemporary threats, where security compromises are often due to applications running malicious code, either due to software vulnerabilities or malware. Application-oriented access controls can mitigate this threat by managing the authority of individual applications. Rule-based application-oriented access controls can restrict applications to only allow access to the specific finely-grained resources required for them to carry out their tasks, and thus can significantly limit the damage that can be caused by malicious code. Unfortunately existing application-oriented access controls have policy complexity and usability problems that have limited their use. This thesis proposes a new access control model, known as functionality-based application confinement (FBAC). The FBAC model has a number of unique features designed to overcome problems with previous approaches. Policy abstractions, known as functionalities, are used to assign authority to applications based on the features they provide. Functionalities authorise elaborate sets of finely grained privileges based on high-level security goals, and adapt to the needs of specific applications through parameterisation. FBAC is hierarchical, which enables it to provide layers of abstraction and encapsulation in policy. It also simultaneously enforces the security goals of both users and administrators by providing discretionary and mandatory controls. An LSM-based (Linux security module) prototype implementation, known as FBAC-LSM, was developed as a proof-of-concept and was used to evaluate the new model and associated techniques. The policy requirements of over one hundred applications were analysed, and policy abstractions and application policies were developed. Analysis showed that the FBAC model is capable of representing the privilege needs of applications. The model is also well suited to automaiii tion techniques that can in many cases create complete application policies a priori, that is, without first running the applications. This is an improvement over previous approaches that typically rely on learning modes to generate policies. A usability study was conducted, which showed that compared to two widely-deployed alternatives (SELinux and AppArmor), FBAC-LSM had significantly higher perceived usability and resulted in significantly more protective policies. Qualitative analysis was performed and gave further insight into the issues surrounding the usability of application-oriented access controls, and confirmed the success of the FBAC model.
Notes
  • Thesis submitted to the Faculty of Law, Business and Information Technology.
  • Thesis (Ph.D.)--Murdoch University, 2012.
  • Includes bibliographical references (p. 313-336)
Language
  • English
  • eng
Dewey Number
  • 005.8
Related Resource
Identifier
  • oai:researchrepository.murdoch.edu.au:6497
Libraries Australia ID
Contributed by
Libraries Australia

Get this edition

Other links

  • Set up My libraries

    How do I set up "My libraries"?

    In order to set up a list of libraries that you have access to, you must first login or sign up. Then set up a personal list of libraries from your profile page by clicking on your user name at the top right of any screen.

  • All (1)
  • WA (1)
None of your libraries hold this item.

This single location in All:

Library Access Call number(s) Formats held Language
Murdoch University. Murdoch University Library. Open to the public .b23047811; held Thesis English; eng
Show 0 more libraries...
None of your libraries hold this item.
None of your libraries hold this item.
None of your libraries hold this item.
None of your libraries hold this item.
None of your libraries hold this item.
None of your libraries hold this item.
None of your libraries hold this item.
None of your libraries hold this item.

User activity


e.g. test cricket, Perth (WA), "Parkes, Henry"

Separate different tags with a comma. To include a comma in your tag, surround the tag with double quotes.

Be the first to add a tag for this edition

Be the first to add this to a list

Comments and reviews

What are comments? Add a comment

No user comments or reviews for this version

Add a comment