Table Of ContentRESEARCH DIRECTIONS IN DATA
AND APPLICATIONS SECURITY XVIII
IFIP– The International Federation for Information Processing
IFIP was founded in 1960 under the auspices of UNESCO, following the First World Computer
Congress held in Paris the previous year. An umbrella organization for societies working in
information processing, IFIP’s aim is two-fold: to support information processing within its
member countries and to encourage technologytransfer to developing nations. As its mission
statement clearly states,
IFIP’s mission is to be the leading, truly international, apolitical organization
which encourages and assists in the development, exploitation and application of
information technology for the benefit of all people.
IFIP is a non-profitmaking organization, run almost solely by 2500 volunteers. It operates through
a number of technical committees, which organize events and publications. IFIP’s eventsrange
from an international congress to local seminars, but the most important are:
The IFIP World Computer Congress, held everysecond year;
Open conferences;
Working conferences.
The flagship event is the IFIP World Computer Congress, at which both invited and contributed
papers are presented. Contributed papers are rigorously refereed and the rejection rate is high.
As with the Congress, participation in the open conferences is open to all and papers may be
invited or submitted. Again, submitted papers are stringently refereed.
The working conferences are structured differently. They are usually run by a working group and
attendance is small and by invitation only. Their purpose is to create an atmosphere conducive to
innovation and development. Refereeing is less rigorous and papers are subjected to extensive
group discussion.
Publications arising from IFIP events vary. The papers presented at the IFIP World Computer
Congress and at open conferences are published as conference proceedings, while the results of
the working conferences are often published as collections of selected and edited papers.
Any national society whose primary activity is in information may apply to become a full member
of IFIP, although full membership is restricted to one society per country. Full members are
entitled to vote at the annual General Assembly, National societies preferring a less committed
involvement may apply for associate or corresponding membership. Associate members enjoy the
same benefits as full members, but without voting rights. Corresponding members are not
represented in IFIP bodies. Affiliated membership is open to non-national societies, and
individual and honorary membership schemes are also offered.
RESEARCH DIRECTIONS
IN DATA AND
APPLICATIONS
SECURITY XVIII
IFIP TC11 / WG11.3 Eighteenth Annual Conference on
Data and Applications Security
July 25–28, 2004, Sitges, Catalonia, Spain
Edited by
Csilla Farkas
University of South Carolina
USA
Pierangela Samarati
University of Milan
Italy
KLUWER ACADEMIC PUBLISHERS
NEW YORK,BOSTON, DORDRECHT, LONDON, MOSCOW
eBookISBN: 1-4020-8128-6
Print ISBN: 1-4020-8127-8
©2004 Springer Science + Business Media, Inc.
Print ©2004by International Federation for Information Processing.
Boston
All rights reserved
No part of this eBook maybe reproducedortransmitted inanyform or byanymeans,electronic,
mechanical, recording, or otherwise,withoutwritten consent from the Publisher
Created in the United States of America
Visit Springer's eBookstore at: http://www.ebooks.kluweronline.com
and the Springer Global Website Online at: http://www.springeronline.com
Contents
Preface ix
Conference Organization x
Contributing Authors xi
Part I INVITED TALK I
Invited Talk - Inference Control Problems in Statistical
Database Query Systems 1
Lawrence H.Cox
Part II ACCESS CONTROL
Attribute Mutability in Usage Control 15
Jaehong Park, Xinwen Zhang, and Ravi Sandhu
Star-Tree: An Index Structure for Efficient Evaluation
of Spatiotemporal Authorizations 31
Vijayalakshmi Atluri and Qi Guo
An Extended Analysis of Delegating Obligations 49
Andreas Schaad
Implementing Real-Time Update of Access Control Policies 65
Indrakshi Ray and Tai Xin
Part III DATA PROTECTION TECHNIQUES
Defending Against Additive Attacks with Maximal
Errors in Watermarking Relational Databases 81
Yingjiu Li, Vipin Swarup, and Sushil Jajodia
Performance-Conscious Key Management in Encrypted Databases 95
Hakan Hacigümüs and Sharad Mehrotra
Damage Discovery in Distributed Database Systems 111
Yanjun Zuo and Brajendra Panda
vi DATA AND APPLICATIONS SECURITY XVIII
Part IV DATABASE THEORY AND INFERENCECONTROL
Information Flow Analysis for File Systems and
Databases Using Labels 125
Ehud Gudes, Luigi V. Mancini, and Francesco Parisi-Presicce
Refusal in Incomplete Databases 143
Joachim Biskup and Torben Weibert
Why Is this User Asking so Many Questions?
Explaining Sequences of Queries 159
Aybar C. Acar and Amihai Motro
Part V INVITED TALK II
Invited Talk - Towards Semantics-Aware Access Control 177
Ernesto Damiani and Sabrina De Capitani di Vimercati
Part VI SYSTEM SECURITYANALYSIS
RBAC/MAC Security for UML 189
T. Doan, S. Demurjian, T.C. Ting, and C. Phillips
Secure Bridges: A Means to Conduct Secure
Teleconferences over Public Telephones 205
Inja Youn and Duminda Wijesekera
Part VII ACCESS CONTROL DESIGN AND MANAGEMENT
Policy-basedSecurityManagement for Enterprise Systems 219
R. Mukkamala, L. Chekuri, M. Moharrum, and S. Palley
A Pattern System for Access Control 235
Torsten Priebe, Eduardo B. Fernandez, Jens I. Mehlau, and Günther Pernul
A Design for Parameterized Roles 251
Mei Ge and Sylvia L. Osborn
Part VIII DISTRIBUTED SYSTEMS
Efficient Verification of Delegation in
Distributed Group Membership Management 265
Ladislav Huraj and Helmut Reiser
Web Resource Usage Control in RSCLP 281
Steve Barker
Securely Distributing Centralized Multimedia Content
Utilizing Peer-to-PeerCooperation 295
Indrajit Ray and Tomas Hajek
Contents vii
Part IX PRIVACY
On The Damage and Compensation of PrivacyLeakage 311
Da-Wei Wang, Churn-Jung Liau, Tsan-sheng Hsu, and Jeremy K.-P. Chen
An Experimental Study of Distortion-Based Techniques for
Association Rule Hiding 325
Emmanuel D. Pontikakis, Achilleas A. Tsitsonis, and Vassilios S. Verykios
Privacy-PreservingMulti-Party
Decision Tree Induction 341
Justin Z. Zhan, LiWu Chang, and Stan Matwin
Part X NETWORK PROTECTION AND CONFIGURATION
Configuring Storage Area Networks for Mandatory Security 357
Benjamin Aziz, Simon N. Foley, John Herbert, and Garret Swart
A Framework for Trusted Wireless Sensor Networks 371
Joon S. Park and Abhishek Jain
Author Index 385
Preface
This volume contains the papers presented at the Eighteenth Annual IFIP
WG 11.3 Conference on Data and Applications Security held in Sitges, Cat-
alonia, Spain on July 25-28, 2004. The purpose of this conference is to present
and disseminate original research results in data and applications security. The
conference provides a forum for researchers and practitioners to discuss their
experiences and enables participants to benefit from scientific discussions.
In response to the call for papers, forty-nine research papers were submitted.
Based on the reviews by program committee members and volunteer reviewers
from the IFIP Working Group 11.3, twenty-three papers were selected for pre-
sentation and publication. The conference program also includes two invited
talks and a panel debate. The first invited talk, by Lawrence Cox, discusses sta-
tistical data protection methods and presents open problems in securing sen-
sitive data. The second invited talk, by Ernesto Damiani, introduces a new
research direction: semantics-aware access control. Future research directions
for access control models are the topics of the panel debate.
The success of a working conference depends on the volunteer efforts of
many individuals. We would like to thank the authors of the submitted papers,
and the program committee members and referees for their time and effort in
reviewing papers. We also thank Felix Saltor, General Chair, Marta Oliva,
Organizing Chair, and Eduardo Fernández-Medina for their hard work in or-
ganizing the conference and taking care of local arrangements. We would like
to thank the invited speakers and panelists for accepting our invitation to con-
tribute to the program. We express special thanks to Andrei Stoica for his help
in collating this volume and Sabrina De Capitani Di Vimercati for her help
with managing the online submissions. Last, but not least, we would like to
thank all the conference attendees and hope you find the program stimulating.
CSILLAFARKAS AND PIERANGELASAMARATI
Conference Organization
Program co-Chairs
Csilla Farkas, University of South Carolina, USA
Pierangela Samarati, University of Milan, Italy
Organizational co-Chairs
Marta Oliva, University of Lleida, Spain
Eduardo Fernández-Medina, University of Castilla-La Mancha, Spain
General Chair
Fèlix Saltor, Technical University of Catalonia, Spain
Program Committee
Gail-Joon Ahn, University of North Carolina at Charlotte, U.S.A.
Vijay Atluri, Rutgers University, U.S.A.
Sabrina De Capitani di Vimercati, Università degli Studi di Milano, Italy
Eduardo Fernandez-Medina, Univ. of Castilla-La Mancha, Spain
Ehud Gudes, Ben-Gurion University, Israel
Carl Landwehr, National Science Foundation, U.S.A.
Tsau Young Lin, San Jose State University, U.S.A.
Peng Liu, Pennsylvania State University, U.S.A.
Peng Ning, North Carolina State University, U.S.A.
Ravi Mukkamala, Old Dominion University, U.S.A.
Martin Olivier, University of Pretoria, South Africa
Sylvia Osborn, University of Western Ontario, Canada
Indrakshi Ray, Colorado State University, U.S.A.
Indrajit Ray, Colorado State University, U.S.A.
Sujeet Shenoi, University of Tulsa, U.S.A.
David Spooner, Rennselaer Polytechnic Institute, U.S.A.
Bhavani Thuraisingham, NSF and MITRECorp., U.S.A.
T.C. Ting, University of Connecticut, U.S.A.
Duminda Wijesekera, George Mason University, U.S.A.
External Reviewers
John Campbell Donggang Liu Dan Thomsen
Lawrence Cox Ioannis Mavridis Xintao Wu
Michael Geisterfer Shankar Pal Tai Xin
Rajni Goel Peter Ryan Dingbang Xu
Naren B. Kodali Dongwan Shin Meng Yu
Contributing Authors
Aybar C. Acar, George Mason University, USA
Vijayalakshmi Atluri, Rutgers University, USA
Benjamin Aziz, University CollegeCork, Ireland
Steve Barker, King’s College, UK
Joachim Biskup, University of Dortmund, Germany
LiWu Chang, Naval Research Laboratory, USA
Lakshmi Chekuri, Old Dominion University, USA
Jeremy K.-P. Chen, University of Texas, Austin, USA
Lawrence H. Cox, National Center for Health Statistics, USA
Ernesto Damiani, University of Milan, Italy
Sabrina De Capitani di Vimercati, University of Milan, Italy
Steven Demurjian, University of Connecticut, USA
Thuong Doan, University of Connecticut, USA
Eduardo B. Fernandez, Florida Atlantic University, USA
Simon N. Foley, University College Cork, Ireland
Mei Ge, University of Western Ontario, Canada
Ehud Gudes, Ben-Gurion University, Israel
Qi Guo, Rutgers University, USA
Hakan Hacigümüs, IBM Almaden Research Center, USA
Tomas Hajek, Colorado State University, USA
John Herbert, University College Cork, Ireland
Tsan-sheng Hsu, Academia Sinica, Taiwan
Ladislav Huraj, Matthias Bel University, Slovak Republic
Abhishek Jain, Syracuse University, USA
Sushil Jajodia, George Mason University, USA
Yingjiu Li, Singapore Management University, Singapore
Churn-Jung Liau, Academia Sinica, Taiwan
Luigi V. Mancini, University Roma La Sapienza, Italy
Stan Matwin, University of Ottawa, Canada
Jens I. Mehlau, University of Regensburg, Germany
Sharad Mehrotra, University of California, Irvine, USA
Mohammed A. Moharrum, Old Dominion University, USA
Amihai Motro, George Mason University, USA
Ravi Mukkamala, Old Dominion University, USA
Sylvia L. Osborn, The University of Western Ontario, Canada
Saritha Palley, Old Dominion University, USA
