DMCA
Unified Platform for Secure Networked Information Systems (2008)
BibTeX
@MISC{Zhou08unifiedplatform,
author = {Wenchao Zhou and Yun Mao and Boon Thau Loo and Martín Abadi},
title = {Unified Platform for Secure Networked Information Systems},
year = {2008}
}
Share
 |
 |
 |
 |
||
OpenURL
Abstract
In this paper, we present a unified declarative platform for specifying, implementing, analyzing and auditing large-scale secure information systems. Our proposed system builds upon techniques from logic-based trust management systems, declarative networking, and data analysis via provenance. First, we propose the Secure Network Datalog (SeNDlog) language that unifies Binder, a logic-based language for access control in distributed systems, and Network Datalog (NDlog), a distributed recursive query language for declarative networks. SeNDlog enables network routing, information systems, and their security policies to be specified and implemented within a common declarative framework. Second, we extend existing distributed recursive query processing techniques to execute SeNDlog programs that incorporate the notion of authenticated communication among untrusted nodes. Third, we demonstrate that an integrated declarative framework enables cross-layer analysis and auditing via the use of distributed network provenance. Finally, using a local cluster and the PlanetLab testbed, we perform a detailed performance study of a variety of declarative secure networked information systems implemented using our platform. We further perform an evaluation of network provenance via a SeNDlog-based packet tracing service within a local cluster.
Keyphrases
secure networked information system information system local cluster integrated declarative framework access control cross-layer analysis network datalog planetlab testbed unified declarative platform proposed system recursive query processing technique common declarative framework distributed recursive query language secure network datalog network provenance sendlog program distributed system declarative network logic-based language data analysis authenticated communication detailed performance study large-scale secure information system declarative secure sendlog-based packet distributed network provenance declarative networking logic-based trust management system security policy untrusted node
