Abstract
Formal security specifications for a distributed application can be checked for compliance at run-time, during the execution of the application. We propose the RunTime Security Evaluation (RTSE) method which makes use of executable security assertions, histories/traces of events, and operational evaluation in the distributed environment to ensure the security specifications regarding the confidentiality and integrity requirements for the application are fulfilled at run-time. A model problem is used to aid in developing the security requirements formally, and assessment of the RTSE method is given based on the results obtained for the implementation of the model problem. The elements necessary for the use of the RTSE method in an application are discussed, along with the requirements for their derivation from the functional requirements and security requirements given for the application.
Recommended Citation
Serban, Cristina and McMillin, Bruce M., "Run Time Security Evaluation for Distributed Applications" (1996). Computer Science Technical Reports. 192.
https://scholarsmine.mst.edu/comsci_techreports/192
Department(s)
Computer Science
Report Number
CSc-96-04
Document Type
Technical Report
Document Version
Final Version
File Type
text
Language(s)
English
Rights
© 1996 University of Missouri - Rolla, All rights reserved
Publication Date
1996-07-01
Comments
The first Author is a Graduate Student
This report is substantially the text of the Ph.D. dissertation of the first author, completed July, 1996.
Acknowledgements:
I am deeply grateful to my advisor, Dr. Bruce McMillin, for the academic guidance he provided with an open mind and so much patience during my years of research work.
I appreciate the help I received from the members of my committee: Dr. Arlan DeKock, Dr. F ikret Ercal, Dr. Ralph Wilkerson, and Dr. Matt Insall. I would also like to thank Professors Baird and Prater for help and guidance, and Pat Davis for being such a wonderful person in the CS Department.
The support provided by the following organizations: the National Science Foundation under grant number MSS-9216479, the Air Force Office of Scientific Research under contract numbers F 49620-92-J-0546 and F-49620-93-I-0409, Harding University, the Department of Computer Science at the University of Missouri - Rolla, and the Department of Computer Science at SUNY Stony Brook is gratefully acknowledged.
I would like to thank the persons from the security community - John McLean, Carl Landwehr, Cathy Meadows, Marv Schaefer, Cynthia Irvine, Colin O'Halloran, John Graham-Cumming, to mention just a few - who were willing to listen to my questions, and provide answers, comments and encouragement.
F inally, I am greatly indebted and grateful to my family and my friends, for being so loving, supportive and patient during all my years in graduate school.