Policy migration for sensitive credentials in trust negotiation
Trust negotiation is an approach to establishing trust between strangers through the bilateral, iterative disclosure of digital credentials. Under automated trust negotiation, access control policies are associated with sensitive credentials to control under what circumstances those credentials can be disclosed. Ideally, the information in a user's sensitive credential should not be known by others unless the corresponding policy is satisfied. However, the original model for user interaction in trust negotiation has pitfalls which can be easily exploited to infer one's private information, even if access control policies are strictly enforced. To preserve one's privacy, a more flexible interaction model for trust negotiation is required. On the other hand, it is also desirable for two parties to be able to establish trust whenever possible. There is potentially a conflict between privacy preservation and the assurance of a successful trust negotiation. In this paper, we identify the situation where sensitive information can be inferred through observing one's behavior in trust negotiation. Then we propose policy migration as one approach to preventing such inference. Compared to previously proposed approaches, policy migration has a low management overhead, and provides a nice balance between inference prevention and guarantees of success in trust establishment. We also discuss the limitations of policy migration, and possible directions for more comprehensive solutions.

title: Integrating XML data sources using approximate joins
abstract: XML is widely recognized as the data interchange standard of tomorrow because of its ability to represent data from a variety of sources. Hence, XML is likely to be the format through which data from multiple sources is integrated. In this article, we study the problem of integrating XML data sources through correlations realized as join operations. A challenging aspect of this operation is the XML document structure. Two documents might convey approximately or exactly the same information but may be quite different in structure. Consequently, an approximate match in structure, in addition to content, has to be folded into the join operation. We quantify an approximate match in structure and content for pairs of XML documents using well defined notions of distance. We show how notions of distance that have metric properties can be incorporated in a framework for joins between XML data sources and introduce the idea of reference sets to facilitate this operation. Intuitively, a reference set consists of data elements used to project the data space. We characterize what constitutes a good choice of a reference set, and we propose sampling-based algorithms to identify them. We then instantiate our join framework using the tree edit distance between a pair of trees. We next turn our attention to utilizing well known index structures to improve the performance of approximate XML join operations. We present a methodology enabling adaptation of index structures for this problem, and we instantiate it in terms of the R-tree. We demonstrate the practical utility of our solutions using large collections of real and synthetic XML data sets, varying parameters of interest, and highlighting the performance benefits of our approach.

title: Aggregate Query Answering on Anonymized Tables
abstract: Privacy is a serious concern when microdata need to be released for ad hoc analyses. The privacy goals of existing privacy protection approaches (e.g., k-anonymity and l-diversity) are suitable only for categorical sensitive attributes. Since applying them directly to numerical sensitive attributes (e.g., salary) may result in undesirable information leakage, we propose privacy goals to better capture the need of privacy protection for numerical sensitive attributes. Complementing the desire for privacy is the need to support ad hoc aggregate analyses over microdata. Existing generalization-based anonymization approaches cannot answer aggregate queries with reasonable accuracy. We present a general framework of permutation-based anonymization to support accurate answering of aggregate queries and show that, for the same grouping, permutation-based techniques can always answer aggregate queries more accurately than generalization-based approaches. We further propose several criteria to optimize permutations for accurate answering of aggregate queries, and develop efficient algorithms for each criterion.

title: Defining and Measuring Policy Coverage in Testing Access Control Policies
abstract: To facilitate managing access control in a system, security officers increasingly write access control policies in specification languages such as XACML, and use a dedicated software component called a Policy Decision Point (PDP). To increase confidence on written policies, certain types of policy testing (often in an ad hoc way) are usually conducted, which probe the PDP with some typical requests and check PDP's responses against expected ones. This paper develops a first step toward systematic policy testing by defining and measuring policy coverage when testing policies. We have developed a coverage-measurement tool to measure policy coverage given a set of XACML policies and a set of requests. We have developed a tool for request generation, which randomly generates requests for a given set of policies, and a tool for request reduction, which greedily selects a nearly minimal set of requests for achieving the same coverage as the originally generated requests. To evaluate coverage-based request reduction and its effect on fault detection, we have conducted an experiment with mutation testing on a set of real policies. Our experimental results show that the coveragebased test reduction can substantially reduce the size of generated requests and incur only relatively low loss on fault detection. We also conduct a study on the policy coverage achieved by manually generated requests.

title: Interoperable strategies in automated trust negotiation
abstract: Automated trust negotiation is an approach to establishing trust between strangers through the exchange of digital credentials and the use of access control policies that specify what combinations of credentials a stranger must disclose in order to gain access to each local service or credential. We introduce the concept of a trust negotiation protocol, which defines the ordering of messages and the type of information messages will contain. To carry out trust negotiation, a party pairs its negotiation protocol with a trust negotiation strategy that controls the exact content of the messages, i.e., which credentials to disclose, when to disclose them, and when to terminate a negotiation. There are a huge number of possible strategies for negotiating trust, each with different properties with respect to speed of negotiations and caution in giving out credentials and policies. In the autonomous world of the Internet, entities will want the freedom to choose negotiation strategies that meet their own goals, which means that two strangers who negotiate trust will often not use the same strategy. To date, only a tiny fraction of the space of possible negotiation strategies has been explored, and no two of the strategies proposed so far will interoperate. In this paper, we define a large set of strategies called the disclosure tree strategy (DTS) family. Then we prove that if two parties each choose strategies from the DTS family, then they will be able to negotiate trust as well as if they were both using the same strategy. Further, they can change strategies at any point during negotiation. We also show that the DTS family is closed, i.e., any strategy that can interoperate with every strategy in the DTS family must also be a member of the DTS family. We also give examples of practical strategies that belong to the DTS family and fit within the TrustBuilder architecture and protocol for trust negotiation.

title: Limiting the Disclosure of Access Control Policies during Automated Trust Negotiation
abstract: Automated trust negotiation is a new approach to establishing trust between strangers through the exchange of property-based digital credentials, and the use of mobile access control policies that specify what combinations of credentials a stranger must supply in order to gain access to each local service or credential. In this paper, we show that access control policies can also contain sensitive information that should be protected from inappropriate access by strangers during negotiation. We present and analyze two automated trust negotiation strategies that support protection for access control policies. The first is the relevant credentials set strategy, which does not directly disclose access control policies and has a fast running time, but may disclose more credentials than strictly necessary. The second strategy is the all relevant policies strategy, which freely discloses all relevant access control policies that the other negotiating party has earned access to during negotiation, and offers the possibility of disclosing fewer credentials

title: Tracking articulated body by dynamic Markov network
abstract: A new method for visual tracking of articulated objects is presented. Analyzing articulated motion is challenging because the dimensionality increase potentially demands tremendous increase of computation. To ease this problem, we propose an approach that analyzes subparts locally while reinforcing the structural constraints at the mean time. The computational model of the proposed approach is based on a dynamic Markov network, a generative model which characterizes the dynamics and the image observations of each individual subpart as well as the motion constraints among different subparts. Probabilistic variational analysis of the model reveals a mean field approximation to the posterior densities of each subparts given visual evidence, and provides a computationally efficient way for such a difficult Bayesian inference problem. In addition, we design mean field Monte Carlo (MFMC) algorithms, in which a set of low dimensional particle filters interact with each other and solve the high dimensional problem collaboratively. Extensive experiments on tracking human body parts demonstrate the effectiveness, significance and computational efficiency of the proposed method.

title: Collaborative tracking of multiple targets
abstract: Coalescence, meaning the tracker associates more than one trajectories to some targets while loses track for others, is a challenging problem for visual tracking of multiple targets, especially when similar targets move close or present occlusions. Existing approaches that are based on joint data association are confronted by the combinatorial complexity due to the concatenation of the state spaces of individual targets. This paper presents a novel collaborative approach with linear complexity to the coalescence problem. The basic idea is the collaborative inference mechanism, in which the estimate of an individual target is not only determined by its own observation and dynamics, but also through the interaction and collaboration with the estimates of its adjacent targets, which leads to a competition mechanism that enables different targets to compete for the common image observations. The theoretical foundation of the new approach is based on Markov networks. Variational analysis of this Markov network reveals a mean field approximation to the posterior density of each target, therefore provides a computationally efficient way for such a difficult inference problem. In addition, a mean field Monte Carlo (MFMC) algorithm is designed to achieve Bayesian inference by simulating the competition among a set of low dimensional particle filters. Compared with the existing solutions, the proposed new collaborative approach stands out by its effectiveness and low computational cost to the coalescence problem, as pronounced in the extensive experiments.

title: Switching observation models for contour tracking in clutter
abstract: We propose a generative model approach to contour tracking against nonstationary clutter and to coping with occlusions by explicit modelling and inferring. The proposed dynamic Bayesian networks consist of multiple hidden processes, which model the target, the clutter and the occlusions. The image observation models, which depict the generation of the image features, are conditioned on all the hidden processes. Based on this framework, the tracker can automatically switch among different observation models according to the hidden states of the clutter and occlusions. In addition, the inference of these hidden states provides self-evaluations for the tracker. The tracking and inference are implemented based on sequence Monte Carlo techniques. The effectiveness of the proposed approach to robust tracking and inferring nonstationary clutter and occlusion is demonstrated for a variety of image sequences.

title: QCWS: an implementation of QoS-capable multimedia web services
abstract: QoS (Quality of Service), which defines service quality such as latency, availability, timeliness and reliability, is important for web applications that provide real-time information, multimedia content, or time-critical services. Many web applications are best implemented by servers with a guaranteed server processing capacity. In this research, we study the QoS control issues using the current Web services standards. We propose a QoS-capable Web service architecture, QCWS, by deploying a QoS broker between Web service clients and providers. The functions of the QoS broker module include tracking QoS information about servers, making selection decisions for clients, and negotiating with servers to get QoS agreements. We have implemented a QCWS prototype using IBM WSDK, enhanced with simple QoS capabilities. We have measured the performance running under different service priorities.

title: Modeling and Measuring Privacy Risks in QoS Web Services
abstract: The privacy issue for QoS Web services is considered. As more Web services are constructed and deployed, many of our personal needs may be served by more than one service providers regardless of their platforms and implementation technologies. Service selection is performed by comparing the QoS attributes of all candidate services. Releasing private data without due control may raise the risk of allowing potential adversaries to collect, reveal or utilize one's data in undesirable ways. We propose a QoS model that quantifies a user's privacy risk in order to make the service selection process manageable. The privacy risk is derived using the percentage of the private data set to be released, and user-defined context-oriented weights that quantify the potential damage of privacy leaking in a specific context. We have included privacy risk cost as one of the QoS parameters by extending the end-to-end QoS composition algorithms developed previously