Defining and Measuring Policy Coverage in Testing Access Control Policies
To facilitate managing access control in a system, security officers increasingly write access control policies in specification languages such as XACML, and use a dedicated software component called a Policy Decision Point (PDP). To increase confidence on written policies, certain types of policy testing (often in an ad hoc way) are usually conducted, which probe the PDP with some typical requests and check PDP's responses against expected ones. This paper develops a first step toward systematic policy testing by defining and measuring policy coverage when testing policies. We have developed a coverage-measurement tool to measure policy coverage given a set of XACML policies and a set of requests. We have developed a tool for request generation, which randomly generates requests for a given set of policies, and a tool for request reduction, which greedily selects a nearly minimal set of requests for achieving the same coverage as the originally generated requests. To evaluate coverage-based request reduction and its effect on fault detection, we have conducted an experiment with mutation testing on a set of real policies. Our experimental results show that the coveragebased test reduction can substantially reduce the size of generated requests and incur only relatively low loss on fault detection. We also conduct a study on the policy coverage achieved by manually generated requests.

title: Aggregate Query Answering on Anonymized Tables
abstract: Privacy is a serious concern when microdata need to be released for ad hoc analyses. The privacy goals of existing privacy protection approaches (e.g., k-anonymity and l-diversity) are suitable only for categorical sensitive attributes. Since applying them directly to numerical sensitive attributes (e.g., salary) may result in undesirable information leakage, we propose privacy goals to better capture the need of privacy protection for numerical sensitive attributes. Complementing the desire for privacy is the need to support ad hoc aggregate analyses over microdata. Existing generalization-based anonymization approaches cannot answer aggregate queries with reasonable accuracy. We present a general framework of permutation-based anonymization to support accurate answering of aggregate queries and show that, for the same grouping, permutation-based techniques can always answer aggregate queries more accurately than generalization-based approaches. We further propose several criteria to optimize permutations for accurate answering of aggregate queries, and develop efficient algorithms for each criterion.

title: Preventing attribute information leakage in automated trust negotiation
abstract: Automated trust negotiation is an approach which establishes trust between strangers through the bilateral, iterative disclosure of digital credentials. Sensitive credentials are protected by access control policies which may also be communicated to the other party. Ideally, sensitive information should not be known by others unless its access control policy has been satisfied. However, due to bilateral information exchange, information may flow to others in a variety of forms, many of which cannot be protected by access control policies alone. In particular, sensitive information may be inferred by observing negotiation participants' behavior even when access control policies are strictly enforced.In this paper, we propose a general framework for the safety of trust negotiation systems. Compared to the existing safety model, our framework focuses on the actual information gain during trust negotiation instead of the exchanged messages. Thus, it directly reflects the essence of safety in sensitive information protection. Based on the proposed framework, we develop policy databases as a mechanism to help prevent unauthorized information inferences during trust negotiation. We show that policy databases achieve the same protection of sensitive information as existing solutions without imposing additional complications to the interaction between negotiation participants or restricting users' autonomy in defining their own policies.

title: A compressed accessibility map for XML
abstract: XML is the undisputed standard for data representation and exchange. As companies transact business over the Internet, letting authorized customers directly access, and even modify, XML data offers many advantages in terms of cost, accuracy, and timeliness. Given the complex business relationships between companies, and the sensitive nature of information, access must be provided selectively, using sophisticated access control specifications. Using the specification directly to determine if a user has access to an XML data item can be extremely inefficient. The alternative of fully materializing, for each data item, the users authorized to access it can be space-inefficient. In this article, we introduce a compressed accessibility map (CAM) as a space- and time-efficient solution to the access control problem for XML data. A CAM compactly identifies the XML data items to which a user has access, by exploiting structural locality of accessibility in tree-structured data. We present a CAM lookup algorithm for determining if a user has access to a data item that takes time proportional to the product of the depth of the item in the XML data and logarithm of the CAM size. We develop an algorithm for building an optimal size CAM that takes time linear in the size of the XML data set. While optimality cannot be preserved incrementally under data item updates, we provide an algorithm for incrementally maintaining near-optimality. Finally, we experimentally demonstrate the effectiveness of the CAM for multiple users on a variety of real and synthetic data sets.

title: Routing XML queries
abstract: In file-sharing P2P networks, a fundamental problem is that of identifying databases that are relevant to user queries. This problem is referred to as the location problem in P2P literature. We propose a scalable solution to the location problem in a data-sharing P2P network, consisting of a network of XML database nodes and XML router nodes, and make the following contributions. We develop the internal organization and routing protocols for the XML router nodes, to enable scalable XPath query and update processing, under the open and the agreement cooperation models between nodes. Since router nodes tend to be memory constrained, we facilitate a space/performance tradeoff by permitting aggregated routing states, and developing algorithms for generating and using such aggregated information. We experimentally demonstrate the scalability of our approach, and the performance of our query and update protocols, using a detailed simulation model, varying key design parameters.

title: Index-based approximate XML joins
abstract: XML data integration tools are facing a variety of challenges for their efficient and effective operation. Among these is the requirement to handle a variety of inconsistencies or mistakes present in the data sets. We study the problem of integrating XML data sources through index assisted join operations, using notions of approximate match in the structure and content of XML documents as the join predicate. We show how a well known and widely deployed index structure, namely the R-tree, can be adopted to improve the performance of such operations. We propose novel search and join algorithms for R-trees adopted to index XML document collections. We also propose novel optimization objectives for R-tree construction, making R-trees better suited for this application.

title: Identifying Error-Prone Software&#8212;An Empirical Study
abstract: A major portion of the effort expended in developing commercial software today is associated with program testing. Schedule and/ or resource constraints frequently require that testing be conducted so as to uncover the greatest number of errors possible in the time allowed. In this paper we describe a study undertaken to assess the potential usefulness of various product-and process-related measures in identifying error-prone software. Our goal was to establish an empirical basis for the efficient utilization of limited testing resources using objective, measurable criteria. Through a detailed analysis of three software products and their error discovery histories, we have found simple metrics related to the amount of data and the structural complexity of programs to be of value for this purpose.

title: Service selection algorithms for Web services with end-to-end QoS constraints
abstract: Web services are new forms of Internet software that can be universally deployed and invoked using standard protocols. Services from different providers can be integrated into a composite service regardless of their locations, platforms, and/or execution speeds to implement complex business processes and transactions. In this paper, we study the end-to-end QoS issues of composite services by utilizing a QoS broker that is responsible for selecting and coordinating the individual service component. We design the service selection algorithms used by QoS brokers to construct the optimal composite service. The objective of the algorithms is to maximize the user-defined utility function value while meeting the end-to-end delay constraint. We propose two solution approaches to the service selection problem: the combinatorial approach, by modeling the problem as the Multiple Choice Knapsack Problem (MCKP), and the graph approach, by modeling the problem as the constrained shortest path problem in the graph theory. We study efficient solutions for each approach.

title: Jet subdivision schemes on the k-regular complex
abstract: We introduce a new family of subdivision schemes called jet subdivision schemes. Jet subdivision schemes are a natural generalization of the commonly used subdivision schemes for free-form surface modeling. In an order r jet subdivision scheme, rth order Taylor expansions, or r-jets, of functions are the essential objects being generated in a coarse-to-fine fashion. Standard subdivision surface methods correspond to the case r=0. Just as the standard free-form subdivision surface schemes, jet subdivision schemes are based on combining (i) a symmetric subdivision scheme in the shift-invariant setting with (ii) an extraordinary vertex rule. We formulate the notions of stationarity, symmetry, and smoothness for jet subdivision schemes. We then extend some well-known results in the theory of subdivision surfaces to the setting of jet subdivision schemes.By incorporating high order data into the subdivision rules, jet subdivision schemes offer more degrees of freedom for the design of extraordinary vertex rules than do standard subdivision schemes. Using a simple 2-point stencil, we construct an order 1 jet subdivision scheme, which is interpolatory, C1 everywhere, and free from polar artifacts at extraordinary vertices of any valence. It is similar to the popular butterfly scheme, but unlike the butterfly scheme, it produces surfaces that can be explicitly parameterized by spline functions. In addition, our jet subdivision scheme allows for explicit control of gradient information on the resulting surface.We address the problem of constructing curvature continuous subdivision schemes at extraordinary vertices by giving an example of a 'flexible C2 scheme' for extraordinary vertex of valence k = 3. The stencils for this subdivision scheme coincide with those of the popular Loop scheme. We discuss the mathematical structure of this example of a C2 scheme.

title: Decentralized multiple target tracking using netted collaborative autonomous trackers
abstract: This paper presents a decentralized approach to multiple target tracking. The novelty of this approach lies in the use of a set of autonomous while collaborative trackers to overcome the tracker coalescence problem with linear complexity. In this approach, the individual trackers are autonomous in the sense that they can select targets to track and evaluate themselves, and they are also collaborative since they need to compete for the targets against those trackers that are close to them through communication. The theoretical foundation of this new approach is based on the variational analysis of a Markov network that reveals the collaborative mechanism through fixed point iteration among these trackers and the existence of the equilibriums. In addition, a trained object detector is incorporated to help sense the potential newly appearing targets in the dynamic scene. Experimental results on challenging video sequences demonstrate the effectiveness and efficiency of the proposed method.

title: The Design of QoS Broker Algorithms for QoS-Capable Web Services
abstract: QoS (quality of service) support in Web services is an important issue since it ensures service usability and utility for each client and, in addition, improves server utilization. In this article, we present a QoS-capable Web service architecture, QCWS, by introducing a QoS broker module between service clients and providers (servers). The functions of the QoS broker module include tracking QoS information about servers, making selection decisions for clients, and negotiating with servers to get QoS agreements. We study two resource allocation algorithms (HQ and RQ) used by QoS brokers acting as the front-end of servers. The goals of the algorithms are to maximize the server resource usage while minimizing the QoS instability for each client. The first algorithm, HQ, assigns a homogeneous service level to all clients on the system and adjusts the service level according to the number of active clients. The second algorithm, RQ, assigns different service levels to clients according to their needs. Both algorithms try to minimize the resource reallocations for existing clients. The QoS performance and instability trade-offs are studied by simulation.