Abstract
This paper presents Policap — a Policy Service for distributed applications that use CORBA security model. Policap was proposed for insertion in the JaCoWeb Project context, which is developing an authorization scheme for large-scale networks based on CORBA security standards. The contribution of this paper is the combination of client-side and server-side access control, in a single domain. In this paper, operations of security management not currently included in the OMG standards are also proposed. The paper further presents the implementation results obtained and an evaluation of these results based on Common Criteria, ISO standard 15408.
The original version of this chapter was revised: The copyright line was incorrect. This has been corrected. The Erratum to this chapter is available at DOI: 10.1007/978-0-387-35586-3_46
Chapter PDF
References
Bob Blakley, “The Emperor’s Old Armor,” In Proc. of the ACM NSPW, 1996, pp. 2–16.
OMG, “Security Service:v1.5,” OMG Doc. Number 00-06-25, June 2000.
OMG, “Security Domain Membership Management Service,” orbos/01-07-20, 2001.
Bob Blakley, “CORBA Security: An Introduction to Safe Computing with Objects”, The Addison-Wesley OT Series, 1999.
C. M. Westphall, “An Authorization Scheme for Security in Large-Scale Distributed Systems,” CPGEEL-DAS-UFSC, Doctoral Thesis, Brazil, December 2000.
Li Gong, “A Secure Identity-Based Capability Systems,” In Proc. of the 1989 IEEE Symp. on Security and Privacy, pp. 56–63, Oakland, California, May 1989.
ISO/IEC, “Common Criteria for Information Technology Security Evaluation,” ISO/IEC 15408, December 1999 (http://www.commoncriteria.org/cc/cc.html).
Information Security Systems Organization, “Controlled Access Protection Profile,” NSA, Oct. 1999. (http://www.radium.ncsc.mil/tpep/library/protection_profiles/).
CC Project, “Common Methodology for Information Technology Security Evaluation,” In Part 2: Evaluation Methodology, August 1999.
K. Jamer — CSE Canada, “Common Evaluation Methodology Special Topic: Testing,” ppt slides. In: ICCC First International Common Criteria, May 2000, Baltimore, U.S.A. (http://niap.nist.gov/cc-scheme/iccc/trackd.html)
J. Straw, “Common Evaluation Methodology Special Topic: Vulnerability Analysis,” ppt slides. In: Proceedings of the ICCC First International Common Criteria, May 2000, Baltimore, Maryland, U.S.A (http://niap.nist.ggov/cc-scheme/iccc/trackd.html)
Pankaj Jalote, “An Integrated Approach to Software Engineering,” Springer-Verlag New York Inc., ISBN 3–540-97561–6, 1991.
A. K. Ghosh et al., “An Automated Approach for Identifying Potential Vulnerabilities in Software,” In: Proc. of the IEEE Symp. on Security and Privacy, 1998, pp. 104–114.
T. J. Klevinsky, “Contemporary Hacking Tools and Their Use in Penetration Testing,” Course. In: FCSC99 — The Federal Computer Security Conference. Course Day, May 1999, Baltimore, MD, U.S.A (http://www.sans.org/sf99/thursday.htm#thu-1).
Campbell, Roy and Qian Tin, “Dynamic Agent-Based Security Architecture for Mobile Computers,” Proc. of the Second PDCN ’98, Australia, December 1998.
Adiron Inc., “Control — Access Control for ORBAsec SL2 V 1.0 Alpha,” Adiron Center, Syracuse University, Dec. 1999.
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2002 IFIP International Federation for Information Processing
About this chapter
Cite this chapter
Westphall, C.M., da Fraga, J.S., Wangham, M.S., Obelheiro, R.R., Lung, L.C. (2002). Policap — Proposal, Development and Evaluation of a Policy Service and Capabilities for CORBA Security. In: Ghonaimy, M.A., El-Hadidi, M.T., Aslan, H.K. (eds) Security in the Information Society. IFIP Advances in Information and Communication Technology, vol 86. Springer, Boston, MA. https://doi.org/10.1007/978-0-387-35586-3_21
Download citation
DOI: https://doi.org/10.1007/978-0-387-35586-3_21
Publisher Name: Springer, Boston, MA
Print ISBN: 978-1-4757-1026-7
Online ISBN: 978-0-387-35586-3
eBook Packages: Springer Book Archive