In defining large, complex access control policies, one would like to compose sub-policies, perhaps authored by different organizations, into a single global policy. Existing po...
Modern enterprise systems support Role-Based Access Control (RBAC). Although RBAC allows restricting access to privileged operations, a deployer may actually intend to restrict ac...
Paolina Centonze, Gleb Naumovich, Stephen J. Fink,...
We present a programming model for building web applications with security properties that can be confidently verified during a security review. In our model, applications are d...
Akshay Krishnamurthy, Adrian Mettler, David Wagner
SQL injection attacks (SQLIAs) consist of maliciously crafted SQL inputs, including control code, used against Databaseconnected Web applications. To curtail the attackers’ abil...
Anyi Liu, Yi Yuan, Duminda Wijesekera, Angelos Sta...
A number of research systems have demonstrated the benefits of accompanying each request with a machine-checkable proof that the request complies with access-control policy — a...
Lujo Bauer, Limin Jia, Michael K. Reiter, David Sw...