A novel policy-driven reversible anonymisation scheme for XML-based services

Author's version of an article in the journal: Information Systems. Also available from the publisher at: http://dx.doi.org/10.1016/j.is.2014.05.007 This paper proposes a reversible anonymisation scheme for XML messages that supports fine-grained enforcement of XACML-based privacy policies. Reversible anonymisation means that information in XML messages is anonymised, however the information required to reverse the anonymisation is cryptographically protected in the messages. The policy can control access down to octet ranges of individual elements or attributes in XML messages. The reversible anonymisation protocol effectively implements a multi-level privacy and security based approach, s…

Secure Information Sharing in an Industrial Internet of Things

This paper investigates how secure information sharing with external vendors can be achieved in an Industrial Internet of Things (IIoT). It also identifies necessary security requirements for secure information sharing based on identified security challenges stated by the industry. The paper then proposes a roadmap for improving security in IIoT which investigates both short-term and long-term solutions for protecting IIoT devices. The short-term solution is mainly based on integrating existing good practices. The paper also outlines a long term solution for protecting IIoT devices with fine-grained access control for sharing data between external entities that would support cloud-based dat…

Performance assessment of institutional photovoltaic based energy system for operating as a micro-grid

Abstract A building integrated photovoltaic (PV) system with energy storage within an institution may need appropriate coordination among distributed energy sources (DERs). It is required to have an appropriate energy management strategy to improve system performance as well as to operate it as a micro-grid during the grid outage condition. In this paper, TERI’s (India) Retreat Facility’s energy system has been used, and its performance with a distributed generator has been assessed with operational strategies for fulfilling the institutional load demand in coordination with the PV, grid and battery storage; and with possibility of operating it as a micro-grid during the grid outage period …

Privacy Violation Classification of Snort Ruleset

Published version of a paper presented at the 2010 18th Euromicro International Conference on Parallel, Distributed and Network-Based Processing (PDP). (c) 2010 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other users, including reprinting/ republishing this material for advertising or promotional purposes, creating new collective works for resale or redistribution to servers or lists, or reuse of any copyrighted components of this work in other works. Paper also available from the publisher:http://dx.doi.org/10.1109/PDP.2010.87 It is important to analyse the privacy impact of Intrusion Detection System (IDS) rules, in order to understand a…

SAFEPASS - Presenting a Convenient, Portable and Secure Password Manager

Decision-cache based XACML authorisation and anonymisation for XML documents

Author's version of an article in the journal: Computer Standards and Interfaces. Also available from the publisher at: http://dx.doi.org/10.1016/j.csi.2011.10.007 This paper describes a decision cache for the eXtensible Access Control Markup Language (XACML) that supports fine-grained authorisation and anonymisation of XML based messages and documents down to XML attribute and element level. The decision cache is implemented as an XACML obligation service, where a specification of the XML elements to be authorised and anonymised is sent to the Policy Enforcement Point (PEP) during initial authorisation. Further authorisation of individual XML elements according to the authorisation specifi…

ViSPE: A Graphical Policy Editor for XACML

In this paper we present the Visual Security Policy Editor (ViSPE), a policy-maker-friendly graphical editor for the eXtensible Access Control Markup Language (XACML). The editor is based on the programming language Scratch and implemented in Smalltalk. It uses a graphical block-based syntax for declaring access control polices that simplifies many of the cumbersome and verbose parts of XACML. Using a graphical language allows the editor to aid the policy-maker in building polices by providing visual feedback and by grouping blocks and operators that fit together and also indicating which blocks that stick together. It simplifies building policies while still maintaining the basic structure…

Privacy handling for critical information infrastructures

This paper proposes an architecture and a methodology for privacy handling in Critical Information Infrastructures. Privacy is in this respect considered as both the risk of revealing person-sensitive information, for example from critical infrastructures in health institutions, but also to identify and avoid leakage of confidential information from the critical information infrastructures themselves. The architecture integrates privacy enhancing technologies into an enterprise service bus, which allows for policy-controlled authorisation, anonymisation and encryption of information in XML elements or attributes in messages on the service bus. The proposed methodology can be used to identif…

Privacy-enhanced network monitoring

Doktorgradsavhandling i informasjons- og kommunikasjonsteknologi, Universitetet i Agder, 2014 This PhD dissertation investigates two necessary means that are required for building privacy-enhanced network monitoring systems: a policy-based privacy or confidentiality enforcement technology; and metrics measuring leakage of private or confidential information to verify and improve these policies. The privacy enforcement mechanism is based on fine-grained access control and reversible anonymisation of XML data to limit or control access to sensitive information from the monitoring systems. The metrics can be used to support a continuous improvement process, by quantifying leakages of private o…

Streamlining Assessment using a Knowledge Metric

PRIvacy LEakage Methodology (PRILE) for IDS Rules

This paper introduces a methodology for evaluating PRIvacy LEakage in signature-based Network Intrusion Detection System (IDS) rules. IDS rules that expose more data than a given percentage of all data sessions are defined as privacy leaking. Furthermore, it analyses the IDS rule attack specific pattern size required in order to keep the privacy leakage below a given threshold, presuming that occurrence frequencies of the attack pattern in normal text are known. We have applied the methodology on the network intrusion detection system Snort’s rule set. The evaluation confirms that Snort in its default configuration aims at not being excessively privacy invasive. However we have identified s…

Location-Aware Mobile Intrusion Detection with Enhanced Privacy in a 5G Context

Published version of an article from the journal: Wireless Personal Communications. The original publication is available at Spingerlink. http://dx.doi.org/10.1007/s11277-010-0069-6 The paper proposes a location-aware mobile Intrusion Prevention System (mIPS) architecture with enhanced privacy that is integrated in Managed Security Service (MSS). The solution is envisaged in a future fifth generation telecommunications (5G) context with increased but varying bandwidth, a virtualised execution environment and infrastructure that allows threads, processes, virtual machines and storage to be migrated to cloud computing services on demand, to dynamically scale performance and save power. 5G mob…

Mobile Security with Location-Aware Role-Based Access Control

Published version of an article from the book: Security and privacy in mobile information and communication systems. Also available on SpringerLink: http://dx.doi.org/10.1007/978-3-642-30244-2_15 This paper describes how location-aware Role-Based Access Control (RBAC) can be implemented on top of the Geographically eXtensible Access Control Markup Language (GeoXACML). It furthermore sketches how spatial separation of duty constraints (both static and dynamic) can be implemented using GeoXACML on top of the XACML RBAC profile. The solution uses physical addressing of geographical locations which facilitates easy deployment of authorisation profiles to the mobile device. Location-aware RBAC c…

Two tiered privacy enhanced intrusion detection system architecture

The paper describes an architecture for privacy-enhanced intrusion detection systems, that separates privacy-invasive and privacy-preserving operations. This can be useful in cases where less sensitive network monitoring is outsourced to a third party and more sensitive network monitoring operations and data forensics are performed in-house or by law enforcement agencies.

Intrusion Detection System Test Framework for SCADA Systems

Mitigating Local Attacks Against a City Traffic Controller

A Scratch-based Graphical Policy Editor for XACML

This paper proposes a policy-maker-friendly editor for the extensible Access Control Markup Language (XACML) based on the programming language Scratch. Scratch is a blocks-based programming language designed for teaching children programming, which allows users to build programs like a puzzle. We take this concept one step further with an XACML policy editor based on the graphic programming elements of Scratch implemented in Smalltalk. This allows for aiding the user on how to build policies by grouping blocks and operators that fit together and also indicating which blocks that will stick together. It simplifies building the XACML policies while still having an XACML “feel” of the graphic …

Towards Efficient Teacher Assisted Assignment Marking Using Ranking Metrics

This paper describes a tool with supporting methodology for efficient teacher assisted marking of open assignments based on student answer ranking metrics. It includes a methodology for how to design tasks for markability. This improves marking efficienty and reduces cognitive strain for the teacher during marking, and also allows for easily giving feedback to students on common pitfalls and misconceptions to improve both the learning outcome for the students as well as the teacher’s productivity by reducing the time needed for marking open assignments. An advantage with the method is that it is language agnostic as well as generally being agnostic to the discipline of the course being asse…

Domestic demand predictions considering influence of external environmental parameters

A precise prediction of domestic demand is very important for establishing home energy management system and preventing the damage caused by overloading. In this work, active and reactive power consumption prediction model based on historical power usage data and external environment parameter data (temperature and solar radiation) is presented for a typical Southern Norwegian house. In the presented model, a neural network is adopted as a main prediction technique and historical domestic load data of around 2 years are utilized for training and testing purpose. Temperature and global irradiation (which illustrates the solar radiation level quantitatively) are employed as external parameter…

Enforcing mobile security with location-aware role-based access control

This paper describes how location-aware role-based access control RBAC can be implemented on top of the Geospatial eXtensible Access Control Markup Language GeoXACML. It furthermore sketches how spatial separation of duty constraints both static and dynamic can be implemented using GeoXACML on top of the XACML RBAC profile. The solution uses physical addressing of geographical locations, which facilitates easy deployment of authorisation profiles to the mobile device. Location-aware RBAC can be used to implement location-dependent access control and also other security enhancing solutions on mobile devices, such as location-dependent device locking, firewall, intrusion prevention or payment…

A roadmap towards improving managed security services from a privacy perspective

Published version of an article in the journal: Ethics and Information Technology. Also available from the publisher at: http://dx.doi.org/10.1007/s10676-014-9348-3 This paper proposes a roadmap for how privacy leakages from outsourced managed security services using intrusion detection systems can be controlled. The paper first analyses the risk of leaking private or confidential information from signature-based intrusion detection systems. It then discusses how the situation can be improved by developing adequate privacy enforcement methods and privacy leakage metrics in order to control and reduce the leakage of private and confidential information over time. Such metrics should allow fo…