CONTENTS - Emerald

language which would cope with a variety of operating systems, databases and microprocessor
cards. The shortcomings of Unix and MCOS are described, as is a prototype
shell which is essentially a state machine acting on a description le, together with
naming conventions for secret data.
041231 `An Authorization Model for Personal Databases'
C Radu, M Vandenwauver, R Govaerts, J Vandewalle, Cardis 94 pp 61{72
The authors describe a database security model for smartcards which came out of
their work with CAFE. This is centrally administered, role and capability based, and
has a granularity hierarchy of objects with a tree structure; each capability gives access
to everything below the node it names.
041232 `A Security Architecture for Fault-Tolerant Systems'
MK Reiter, KP Birman, R van Renesse, ACM Transactions on Computer Systems v
12 no 4 (Nov 94) pp 340{371
The authors describe Horus, an architecture for distributed systems based on secure
process groups. Its underlying mechanisms are founded on fault tolerant authentication
protocols, some of which are described, and a secure time service. These mechanisms
are implemented in a layer which is inaccessible to user processes.
041233 `Non-interference through Determinism'
AW Roscoe, JCP Woodcock,LWulf, ESORICS 94 pp 33{53
The authors consider noninterference in terms of the nondeterminism introduced
into an abstract machine by hiding and interleaving operations, and propose to protect
low users from high data by insisting that their virtual machines be deterministic.
Under this de nition, security is preserved by re nement. A le system design is
sketched, and the relationship between Z and CSP formalisms is discussed.
041234 `Propagation of Authorizations in Distributed Database Systems'
P Samarati, P Ammann, S Jajodia, Fairfax 94 pp 136{147
Authorisations which propagate in distributed systems may do so inconsistently,
especially in the presence of intermittent site and communications failures. Algorithms
are presented for restoring consistency; logs of authorisation table updates are kept
locally and propagated, and procedures exist for dealing with out-of-order updates by
referring to these logs.
041235 `On the Expressive Power of the Unary Transformation Model'
RS Sandhu, S Ganta, ESORICS 94 pp 301{318
The authors develop their transformation model of access control by introducing
a variant in which individual commands can test only one cell of the access control
matrix at a time. They prove that this has just as much expressive power, provided
that every user and every object can be constrained to be of a unique type.
041236 `To Net Or Not To Net?'
WSchwartau, Network Security (Dec 94) pp 7{11
The author describes a product called Sidewinder, whose purpose is to enforce a
multilevel integrity policy in an Internet environment.
041237 `Total ordered security level assignment which inhibits entity
inference'
H Shina, Y Okuda, H Nagase, ISITA 94 pp 273{276
The authors propose an algorithm to assign security labels to entities in a computer
system in accordance with a model such as Bell-LaPadula. The proposed algorithm
generates the highest security label for each entity. This is in contrast to the low water
mark principle which assigns the lowest label to each entity.
17