DOCSLIB.ORG

Stony Brook University

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Stony Brook University SSStttooonnnyyy BBBrrrooooookkk UUUnnniiivvveeerrrsssiiitttyyy The official electronic file of this thesis or dissertation is maintained by the University Libraries on behalf of The Graduate School at Stony Brook University. ©©© AAAllllll RRRiiiggghhhtttsss RRReeessseeerrrvvveeeddd bbbyyy AAAuuuttthhhooorrr... Content-based Access Control A Dissertation Presented by Michael Andrew Hart to The Graduate School in Partial Fulfillment of the Requirements for the Degree of Doctor of Philosophy in Computer Science Stony Brook University May 2011 Stony Brook University The Graduate School Michael Andrew Hart We, the dissertation committee for the above candidate for the Doctor of Philosophy degree, hereby recommend acceptance of this dissertation. Rob Johnson – Dissertation Advisor Assistant Professor, Computer Science Yejin Choi - Chairperson of Defense Assistant Professor, Computer Science Scott Stoller Professor, Computer Science Mónica F. Fernandez-Bugallo Professor, Electrical and Computer Engineering, Stony Brook University This dissertation is accepted by the Graduate School Lawrence Martin Dean of the Graduate School ii Abstract of the Dissertation Content-based Access Control by Michael Andrew Hart Doctor of Philosophy in Computer Science Stony Brook University 2011 In many contexts, users are either unable or unwilling to specify their access control policies. In Data Loss Prevention, for example, users cannot fully express what is secret in rule-based formats. Many users are unwilling to use access controls, particularly in the Web 2.0, because they are too draconian, leading to disastrous consequences in terms of privacy. To address both of these issues, we have introduced the concept of Content-Based Access Control (CBAC). CBAC combines content recognition with policy acquisition and enforcement. A CBAC-enabled system can be trained to recognize policy violations by learning what is secret from examples. This defense will discuss how CBAC can be successfully applied to Data Loss Prevention, Wikipedia Vandalism and the Web 2.0. Usability is integral to providing better CBAC systems and privacy interfaces, and this defense demonstrates improvements in the usability of these systems. iii Table of Contents List of Tables..................................................................................................................................ix List of Figures.................................................................................................................................xi Chapter 1 Introduction....................................................................................................................1 1.1 The Web 2.0..............................................................................................................................3 1.2 Consequences of the Web 2.0...................................................................................................6 Chapter 2 Current Access Controls...............................................................................................11 2.1 Introduction.............................................................................................................................11 2.2 Other privacy and access control schemes..............................................................................16 2.2.1 eXtensible Access Control Markup Language (XACML)..................................................18 2.2.2 Platform for Privacy Preferences (P3P)...............................................................................20 2.2.3 Social Contract Core............................................................................................................23 2.2.4 Policy-Aware Web...............................................................................................................25 2.2.5 EUFORBIA..........................................................................................................................30 2.2.6 The Accountability Perspective...........................................................................................34 2.3 Situations where policy enforcement is minimally useful......................................................36 2.4 Synthesis.................................................................................................................................38 Chapter 3 Content-based Access Control (CBAC).......................................................................40 3.1 Definition of a CBAC system.................................................................................................41 3.2 Implementation.......................................................................................................................42 3.3 CBAC applications.................................................................................................................44 Chapter 4 Privacy/Policy-aware Blogging....................................................................................46 iv 4.1 Privacy schemes in blogs and social-networks.......................................................................47 4.2 The Plog policy language........................................................................................................48 4.2.1 Tag usage on existing private posts.....................................................................................51 4.3 Plog WordPress plugin...........................................................................................................55 4.3.1 Tag rule authoring interface.................................................................................................55 4.3.2 Per-post policy editing interface..........................................................................................55 4.4 Evaluation...............................................................................................................................58 4.4.1 Participants...........................................................................................................................58 4.4.2 Experimental design.............................................................................................................58 4.4.3 Training................................................................................................................................59 4.4.4 Tasks....................................................................................................................................60 4.4.5 Procedure.............................................................................................................................61 4.5 Results.....................................................................................................................................62 4.5.1 Tag rule usage......................................................................................................................62 4.5.2 Accuracy on privacy tasks...................................................................................................62 4.5.3 Accuracy on distractor tasks................................................................................................63 4.5.4 Time to completion of privacy tasks....................................................................................64 4.5.5 Time to completion of distractor tasks.................................................................................64 4.5.6 Subjective evaluation results................................................................................................65 4.5.7 Size of tag rule policies........................................................................................................66 4.6 Discussion...............................................................................................................................66 4.7 Related work...........................................................................................................................68 4.8 Conclusion..............................................................................................................................70 v Chapter 5 Policy Inference for PLOG..........................................................................................72 5.1 Tag suggesters for blogs.........................................................................................................72 5.2 Tag usage on individual blogs................................................................................................74 5.3 iTag description......................................................................................................................77 5.3.1 TagAssist..............................................................................................................................77 5.3.2 iTag .....................................................................................................................................78 5.4 Evaluations and results...........................................................................................................80 5.5 Discussion...............................................................................................................................82 5.6 Future work.............................................................................................................................83 5.7 Conclusions.............................................................................................................................84
Load more

Recommended publications
  • Untangling the World Wide Weblog: a Proposal for Blogging, Employment-At-Will, and Lifestyle Discrimination Statutes
    Valparaiso University Law Review Volume 42 Number 1 Fall 2007 pp.245-290 Fall 2007 Untangling the World Wide Weblog: A Proposal for Blogging, Employment-at-Will, and Lifestyle Discrimination Statutes Shelbie J. Byers Follow this and additional works at: https://scholar.valpo.edu/vulr Part of the Law Commons Recommended Citation Shelbie J. Byers, Untangling the World Wide Weblog: A Proposal for Blogging, Employment-at-Will, and Lifestyle Discrimination Statutes , 42 Val. U. L. Rev. 245 (2007). Available at: https://scholar.valpo.edu/vulr/vol42/iss1/8 This Notes is brought to you for free and open access by the Valparaiso University Law School at ValpoScholar. It has been accepted for inclusion in Valparaiso University Law Review by an authorized administrator of ValpoScholar. For more information, please contact a ValpoScholar staff member at [email protected]. Byers: Untangling the World Wide Weblog: A Proposal for Blogging, Employ UNTANGLING THE WORLD WIDE WEBLOG: A PROPOSAL FOR BLOGGING, EMPLOYMENT-AT-WILL, AND LIFESTYLE DISCRIMINATION STATUTES I. INTRODUCTION Laws are like spider’s webs: if some poor weak creature come[s] up against them, it is caught; but a bigger one can break through and get away.1 Imagine landing your dream job. All of your hard work and education has finally paid off. You accept the job offer, give two weeks’ notice at your current place of employment, and move to another state to start your dream job. Being far from home, and wanting to keep in touch with family and friends scattered around the country, you start up a blog.
    [Show full text]
  • 2005 Campus Chronicle Fall
    In A&E: Summer brings blockbusters to the screen HIGH POINT UNIVERSITY Camgus Chronicle :VOL. 13, NO. 1 UESD/...Y , August 23 , .2005 HIGH POINT. H.C. Celebration ends in tragedy - Well-known sophomore Terrence McCann died after school ended last May---- Donations at By Justin Spinks house on Circle Drive . He apparently just passed out somewhere and not to Staff Writer tripped and fell into the ditch while at­ worry about it." Lamb didn't want to PU are now at tempting to cross it, drowning in the shal­ believe that something happened to his Behind the Eastchester Village apart­ low creek. Toxicology results later friend, but when Mccann 's family arrived n all-time high ment complex in a small showed that his that same morning to take him back to wooded area lies a creek blood alcohol con­ Pennsylvania and he was still missing , he The funds keep mounting. Eigh no deeper than six inches tent was .2, more knew deep down that "somethmg's not onths into his first year as president nestled in a steep trench. than twice the legal right." ido Qubein has raised $31 millio This is where the body of limit for driving in During his short stay at HPU, or High Point University, includin Terrence Patrick the state of North McCann was widely known and respected 11 million since most of you left fo McCann was found by a Carolina. among both students and faculty. Enca woman walking her dog Brandon Hansen, his girlfriend, attended his fu­ um.mer vacation. two days after be was re­ Wright, a 21-year­ neral service m Glenside and says that On Aug.
    [Show full text]
  • The Corporate Blog As an Emerging Genre of Computer-Mediated Communication: Features, Constraints, Discourse Situation
    GÖTTINGER SCHRIFTEN ZUR INTERNETFORSCHUNG Hg.: S. Hagenhoff, D. Hogrefe, E. Mittler, M. Schumann, G. Spindler, V. Wittke igital technology is increasingly impacting how we keep informed, how we communicate professionally and privately, and how we initiate and maintainD relationships with others. The function and meaning of new forms of computer-mediated communication (CMC) is not always clear to users on The corporate blog as an the onset and must be negotiated by communities, institutions and individuals alike. Are chatrooms and virtual environments suitable for business communi- emerging genre of cation? Is email increasingly a channel for work-related, formal communication and thus „for old people“, as especially young Internet users flock to Social computer-mediated Networking Sites (SNSs)? communication: ornelius Puschmann examines the linguistic and rhetorical properties of the features, constraints, weblog, another relatively young genre of CMC, to determine its function C communication computer-mediated in private and professional (business) communication. He approaches the que- discourse situation stion of what functions blogs realize for authors and readers and argues that corporate blogs, which, like blogs by private individuals, are a highly diverse The corporate blog as an emerging genre of genre emerging an as blog corporate The in terms of their form, function and intended audience, essentially mimic key characteristics of private blogs in order to appear open, non-persuasive and Cornelius Puschmann personal, all essential
    [Show full text]
  • Security in Context-Aware Mobile Business Applications
    Security in Context-aware Mobile Business Applications Inauguraldissertation zur Erlangung des akademischen Grades eines Doktors der Naturwissenschaften der Universit¨at Mannheim vorgelegt von M.Sc. Emin Islam Tatlı aus Istanbul (T¨urkei) Mannheim, 2008 Dekan: Professor Dr. Felix Freiling, Universit¨at Mannheim Referent: Professor Dr. Stefan Lucks, Bauhaus-Universit¨at Weimar Korreferent: Professor Dr. Matthias Krause, Universit¨at Mannheim Tag der m¨undlichen Pr¨ufung: 06. M¨arz 2009 Abstract The support of location computation on mobile devices (e.g. mobile phones, PDAs) has enabled the development of context-aware and especially location- aware applications (e.g. Restaurant Finder, Friend Finder) which are becom- ing the new trend for future software applications. However, fears regarding security and privacy are the biggest barriers against their success. Espe- cially, mobile users are afraid of the possible threats against their private identity and personal data. Within the M-Business research group at the University of Mannheim, various security and privacy aspects of context-aware mobile business appli- cations are examined in this thesis. After providing a detailed introduction to context-aware applications, the security challenges of context-aware ap- plications from the perspectives of different principals (i.e. mobile users, the broker, service providers) are analyzed. The privacy aspects, the chal- lenges, the threats and legal directives regarding user privacy are explained and illustrated by real-life examples. The user-centric security architectures integrated within context-aware applications are introduced as anonymity and mobile identity management solutions. The M-Business security archi- tecture providing security components for communication security, dynamic policy-based anonymity, secure storage on mobile devices, identity manage- ment for mobile users and cryptography libraries is explained in detail.
    [Show full text]
  • Fired for Blogging: Are There Legal Protections for Employees Who Blog?
    FIRED FOR BLOGGING: ARE THERE LEGAL PROTECTIONS FOR EMPLOYEES WHO BLOG? Robert Sprague* I. INTRODUCTION One of the Internet-related phenomena of the early twenty-first century has been the exponential rise in the number of Web logs (referred to generally and hereinafter as "blogs"). Millions of people have begun chronicling their lives through online diaries and social networks. Sometimes they disclose too much information: describing past drug use, allowing pictures of themselves drunk at parties to be displayed, and griping about work. More and more of these "bloggers" are being fired because of what they publish online. This article reviews current employment law in light of the rising popularity of blogs.1 In particular, the application of the employment-at- will doctrine and its evolving exceptions is examined in the context of employees who blog. While individuals may believe that they have the right to say what they want to on their own time while using their own resources, the employment-at-will doctrine remains a powerful tool for employers to discharge their employees without legal backlash. However, the employment-at-will doctrine is not an absolute shield for employers and this article discusses those few circumstances in which an employer faces some potential liability. * J.D., M.B.A., Assistant Professor, Department of Management and Marketing, University of Wyoming College of Business. The author wishes to thank Michael Thatcher, J.D., 2006, University of Wyoming College of Law, for his excellent research assistance. 1. This article addresses employment laws related to private employers; it does not address the gamut of laws which may apply to public employers.
    [Show full text]
  • Workplace Privacy Policies
    NATIONAL EMPLOYMENT LAW INSTITUTE 28th Annual Public Sector EEO and Employment Law Conference August 28, 2009 – San Francisco, CA Workplace Privacy Policies Robert D. Brownstone, Esq.* _________________________________________________________________________ *Robert D. Brownstone is the Law & Technology Director at Fenwick & West LLP. He advises clients on electronic discovery, information-security, electronic information management and retention/destruction policies and protocols. Mr. Brownstone also collaborates with clients as to computer solutions enabling compliance with legal obligations. A nationwide advisor, speaker and writer on many law and technology issues, he is frequently quoted in the press as an expert on electronic information. He also teaches Electronic Discovery classes at the University of San Francisco School (USF) of Law and Santa Clara University School of Law. Mr. Brownstone is a member of: four state bars; the NELI Advisory Board; and the executive committee of the State Bar of California’s Law Practice Management and Technology (LPMT) Section. Before joining Fenwick & West in 2000, Mr. Brownstone had a varied 13-year career as a litigator, law school administrator, law school teacher and consultant. He received his J.D. magna cum laude from Brooklyn Law School in 1986 and his B.A. from Swarthmore College in 1982. THESE MATERIALS ARE MEANT TO ASSIST IN A GENERAL UNDERSTANDING OF THE CURRENT LAW RELATING TO PRIVACY AND ELECTRONIC INFORMATION MANAGEMENT. THEY ARE NOT TO BE REGARDED AS LEGAL ADVICE. ORGANIZATIONS OR INDIVIDUALS WITH PARTICULAR QUESTIONS SHOULD SEEK ADVICE OF COUNSEL. © 2009 Fenwick & West LLP Robert D. Brownstone advises clients on electronic discovery, on electronic information management and on retention/destruction policies and protocols.
    [Show full text]
  • Social Media Approach As a Marketing Tool
    Social Media Approach as a Marketing Tool 1. Introduction Social media isn’t a new “Internet Hip” that just popped up, but it has been around for years in the shape of forums and newsgroups. So what has changed? The introduction of various new tools and the tremendous increase of the internet user base in the last decade along with easier internet access gave the big push. To best define social media, we need to break it down. Social is relating to human society; the interaction of the individual and the group. Media is a medium of cultivation, conveyance, or expression (Merriam-Webster Collegiate Dictionary). So, social media is a media designed to be disseminated through social interaction, created using highly accessible and scalable publishing techniques. Social media uses Internet and web-based technologies to transform broadcast media monologues (one-to- many aka traditional media) into social media dialogues (many-to-many). Primarily, social media depends on interactions between people –as discussions and integration of words – using technology as a conduit. Social media has been touted as presenting a fresh direction for marketing by allowing companies to talk with consumers, as opposed to talking at them (Wikipedia). It lives on the contributions and feedback of everyone. It eliminates the gap between the writers and the readers and forms a conversation-like content. As mentioned earlier, social media comes in the forms of various online tools or services. These can be categorized into numerous groups each with its own characteristics and usages. To elaborate, blogs, for example, aka web logs are an online journal for the writers to share their experiences, opinions, and thoughts while providing the readers the option add their feedback and comments to the topic.
    [Show full text]
  • Developing Corporate Blog Policies
    Dear Diary (((Hello(Hello World!World!)))):: Developing Corporate Blog Policies Karena Tyan Massachusetts Institute of Technology November 17, 2007 6.805: Ethics and Law on the Electronic Frontier Professors Hal Abelson, Mike Fischer, Danny Weitzner AbAbAbstractAb stract Blogging is an increasingly popular marketing strategy in the corporate world, but many companies have yet to develop proper policies and guidelines for managing corporate and personal employee blogs. This paper develops a deeper understanding of the nature and power of blogs as a corporate asset through blog studies and offers an example of possible corporate blog policy through analysis of several existing ones. We find successful policies that both protect company interests and promote employee speech are best developed through cooperation between employee-bloggers and employers. Contents 1 Introduction 2 Blogs 2.1 What are blogs? 2.2 Corporate blogs 2.2.1 What are corporate blogs? 2.2.2 Why corporate blogging? 2.2.2.1 External corporate blogs 2.2.2.2 Internal corporate blogs 3 Blog Policy 3.1 Why are blog policies important? 3.2 Custom-tailoring a blog policy for your company 3.2.1 Formulating your company's blog-policy 3.2.1.1 IBM 3.2.1.2 Sun Microsystems 3.2.1.3 Plaxo 3.2.1.4 Thomas Nelson Publishers 3.2.2 Summary of Process 3.2.3 Suggested policies 4 Conclusion 5 Appendix A: IBM blog policy 6 Appendix B: Sun Microsystems blog policy 7 Appendix C: Sun Microsystems blog guidelines 8 Appendix D: Plaxo blog policy 9 Appendix E: Yahoo! blog policy 10 Appendix F: Thomas Nelson Publishers blog policy 11 Bibliography 1 Introduction In the past decade or so, blogging has risen as a powerful new means of communication.
    [Show full text]
  • Can Blogging and Employment Co-Exist?
    Comments Can Blogging and Employment Co-Exist? By JOHN S. HONG* SUPPOSE RACHEL JONES, a hypothetical employee at a midsized newspaper, writes the following entry on her personal Web log': I really hate clowns. Seriously. Okay, first off. They have these stu- pid little tricks that they do to thrill little kids. Then they have that evil-looking make-up that gives me nightmares. They run around laughing like complete morons and then charge you an arm and a leg for a couple of hours of complete torture. Jones's supervisor finds the entry during her weekly Friday ritual of reading through her employees's Web logs. The supervisor's hus- band happens to be the clown that worked the party Jones threw for her children. The day after that posting, Jones is fired. The fairness of terminating Jones's employment is debatable. Jones's supervisor may genuinely perceive the Web log-or "blog," as it is more commonly known-entry as a personal insult against her and her family. If Jones's co-workers commonly read the blog and know of the supervisor's affinity for clowns, this "personal insult" might have a detrimental effect on company morale, hurting the com- pany's bottom line. On the other hand, Jones's entry does not deal at all with the newspaper's business interests. It is merely a personal rant regarding off-duty activities that does not in the least pertain to the news. So what rights does an employee, such as Jones, have when fired for an off-duty blog posting that does not pertain to her employer's business interests or other legitimate business needs? * Class of 2007; B.A., Davidson College, 1999; Managing Editor, U.S.F.
    [Show full text]
  • Workplace Blogs and Workers' Privacy Rafael Gely University of Missouri School of Law, [email protected]
    University of Missouri School of Law Scholarship Repository Faculty Publications Summer 2006 Workplace Blogs and Workers' Privacy Rafael Gely University of Missouri School of Law, [email protected] Leonard Bierman University of TexasA & M Mays Business, [email protected] Follow this and additional works at: http://scholarship.law.missouri.edu/facpubs Part of the Internet Law Commons, and the Labor and Employment Law Commons Recommended Citation Rafael Gely & Leonard Bierman, Workplace Blogs and Workers' Privacy, 66 La. L. Rev. 1079 (2006) This Article is brought to you for free and open access by University of Missouri School of Law Scholarship Repository. It has been accepted for inclusion in Faculty Publications by an authorized administrator of University of Missouri School of Law Scholarship Repository. Workplace Blogs and Workers' Privacy Rafael Gely* Leonard Bierman** I. INTRODUCTION Over the years, the ability of employers to impinge upon the privacy rights of their employees has been shaped to a large extent by technology. New forms of technology have allowed employers to more intrusively and surreptitiously monitor employees while at work in forms that were unimaginable few years ago.' Advances in technology even allow employers to monitor employees outside the traditional confines of the physical workplace. 2 Employees who work at home are subject to monitoring through webcams, or monitoring of keyboard strokes.3 Even employees whose jobs take them on the road are subject to monitoring4 through satellite monitoring through GPS positioning devices. Technology serves also a different function. Technology helps create new ways for employees to communicate and interact with other employees both in and outside the workplace.
    [Show full text]
  • The Blogging Revolution: Government in the Age of Web 2.0 David C
    PROVIDING CUTTING-EDGE KNOWLEDGE TO GOVERNMENT LEADERS The Blogging Revolution: Government in the Age of Web 2.0 IBM Center for The Business of Government The IBM Center for About the IBM Center for The Business of Government Through research stipends and events, the IBM Center for The Business of Government stimulates research and facilitates discussion of new approaches to improving the effectiveness of government at the federal, state, local, and international levels. The Center is one of the ways that IBM seeks to advance knowledge on how to improve public sector effectiveness. The IBM Center focuses on the future of the operation and management of the public sector. The Blogging Revolution: The About IBM Global Business Services With consultants and professional staff in more than 160 countries globally, IBM Global Business Services is the world’s largest consulting services organization. IBM Global Business Services provides clients with business process and industry expertise, a deep understanding of technology solutions that address specific industry issues, and the ability to design, build and run those solutions in a way that delivers bottom-line business David C. Wyld value. For more information visit www.ibm.com. 2.0 Web Age of in the Government Maurin Professor of Management and Director of the Strategic e-Commerce/ e-Government Initiative For additional information, contact: Department of Management Jonathan D. Breul Southeastern Louisiana University Executive Director IBM Center for The Business of Government E-Government Series 1301 K Street, NW Fourth Floor, West Tower Washington, DC 20005 (202) 515-4504, fax: (202) 515-4375 e-mail: [email protected] website: www.businessofgovernment.org Wyld C.
    [Show full text]
  • Employee "Blogging" and Legal Reform Rafael Gely University of Missouri School of Law, [email protected]
    University of Missouri School of Law Scholarship Repository Faculty Publications Spring 2007 Social Isolation and American Workers: Employee "Blogging" and Legal Reform Rafael Gely University of Missouri School of Law, [email protected] Leonard Bierman University of TexasA & M Mays Business, [email protected] Follow this and additional works at: http://scholarship.law.missouri.edu/facpubs Part of the Internet Law Commons, and the Labor and Employment Law Commons Recommended Citation Rafael Gely & Leonard Bierman, Social Isolation and American Workers: Employee Blogging and Legal Reform, 20 Harv. J.L. & Tech. 287 (2007) This Article is brought to you for free and open access by University of Missouri School of Law Scholarship Repository. It has been accepted for inclusion in Faculty Publications by an authorized administrator of University of Missouri School of Law Scholarship Repository. HarvardJournal of Law & Technology Volume 20, Number 2 Spring 2007 SOCIAL ISOLATION AND AMERICAN WORKERS: EMPLOYEE BLOGGING AND LEGAL REFORM Rafael Gely and Leonard Bierman* TABLE OF CONTENTS 1. IN TROD UCTIO N .............................................................................. 288 II. B LOGS: A PRIM ER ........................................................................ 292 1I1. SOCIAL ISOLATION IN AMERICA ................................................. 296 A. The Decline in Interpersonal "Connectedness"................. 296 B. The Workplace as a Nexus of Interpersonal Connectivity ....... 297 C. The Law and Declining Workplace
    [Show full text]