@article { ISI:000389146000004,
	title = {ANALYSIS AND VERIFICATION OF XACML POLICIES IN A MEDICAL CLOUD ENVIRONMENT},
	journal = {Scalable Computing-Practice and Experience},
	volume = {17},
	number = {3, SI},
	year = {2016},
	month = {SEP},
	pages = {189-205},
	abstract = {The connectivity of devices, machines and people via Cloud infrastructure can support collaborations among doctors and specialists from different medical organisations. Such collaborations may lead to data sharing and joint tasks and activities. Hence, the collaborating organisations are responsible for managing and protecting data they share. Therefore, they should define a set of access control policies regulating the exchange of data they own. However, existing Cloud services do not offer tools to analyse these policies. In this paper, we propose a Cloud Policy Verification Service (CPVS) for the analysis and the verification of access control policies specified using XACML. The analysis process detects anomalies at two policy levels: a) intra-policy: detects discrepancies between rules within a single security policy (conflicting rules and redundancies), and b) inter policies: detects anomalies between several security policies such as inconsistency and similarity. The verification process consists in verifying the completeness property which guarantees that each access request is either accepted or denied by the access control policy. In order to demonstrate the efficiency of our method, we also provide the time and space complexities. Finally, we present the implementation of our method and demonstrate how efficiently our approach can detect policy anomalies.},
	issn = {1895-1767},
	doi = {10.12694/scpe.v17i3.1180},
	author = {Ayache, Meryeme and Erradi, Mohammed and Khoumsi, Ahmed and Freisleben, Bernd}
}
@article {11714990120160901,
	title = {ANALYSIS AND VERIFICATION OF XACML POLICIES IN A MEDICAL CLOUD ENVIRONMENT.},
	journal = {Scalable Computing: Practice \& Experience},
	volume = {17},
	number = {3},
	year = {2016},
	pages = {189 - 205},
	abstract = {The connectivity of devices, machines and people via Cloud infrastructure can support collaborations among doctors and specialists from different medical organisations. Such collaborations may lead to data sharing and joint tasks and activities. Hence, the collaborating organisations are responsible for managing and protecting data they share. Therefore, they should define a set of access control policies regulating the exchange of data they own. However, existing Cloud services do not offer tools to analyse these policies. In this paper, we propose a Cloud Policy Verification Service (CPVS) for the analysis and the verification of access control policies specified using XACML. The analysis process detects anomalies at two policy levels: a) intra-policy: detects discrepancies between rules within a single security policy (conflicting rules and redundancies), and b) interpolicies: detects anomalies between several security policies such as inconsistency and similarity. The verification},
	keywords = {Automata, Cloud computing, Completeness, Data security, Formal Verification, Information storage \& retrieval systems {\textendash} Medical care, Security Anomaly Detection, XACML Policies},
	issn = {18951767},
	url = {http://search.ebscohost.com/login.aspx?direct=true\&db=iih\&AN=117149901\&site=ehost-live},
	author = {Ayache, Meryeme and Erradi, Mohammed and Khoumsi, Ahmed and Freisleben, Bernd}
}
@conference { ISI:000389502600019,
	title = {An Approach to Resolve NP-Hard Problems of Firewalls},
	booktitle = {Networked Systems, NETYS 2016},
	series = {Lecture Notes in Computer Science},
	volume = {9944},
	year = {2016},
	note = {4th International Conference on Networked Systems (NETYS), Marrakech, MOROCCO, MAY 18-20, 2016},
	pages = {229-243},
	abstract = {Firewalls are a common solution to protect information systems from intrusions. In this paper, we apply an automata-based methodology to resolve several NP-Hard problems which have been shown in the literature to be fundamental for the study of firewall security policies. We also compute space and time complexities of our resolution methods.},
	isbn = {978-3-319-46140-3; 978-3-319-46139-7},
	issn = {0302-9743},
	doi = {10.1007/978-3-319-46140-3\_19},
	author = {Khoumsi, Ahmed and Erradi, Mohamed and Ayache, Meryeme and Krombi, Wadie},
	editor = {Abdulla, PA and DelporteGallet, C}
}
@conference { ISI:000390888900008,
	title = {Towards an Efficient Policy Evaluation Process in Multi-Tenancy Cloud Environments},
	booktitle = {CCSW{\textquoteright}16: PROCEEDINGS OF THE 2016 ACM CLOUD COMPUTING SECURITY WORKSHOP},
	year = {2016},
	note = {8th ACM Cloud Computing Security Workshop (CCSW), Vienna, AUSTRIA, OCT 28, 2016},
	pages = {55-59},
	publisher = {ACM SIGSAC; ACM},
	organization = {ACM SIGSAC; ACM},
	abstract = {Cloud computing offers most of its services under multi-tenancy environments. To satisfy security requirements among collaborating tenants, each tenant may define a set of access control policies to secure access to shared data. Several cloud solutions make use of XACML to specify such policies. However, existing implementations of XACML perform a brute force search to compare a request to all existing rules in a given XACML policy. This decreases the decision process (i.e., policy evaluation) performance especially for policies with a large number of rules. In this paper, we propose an automata-based approach for an efficient XACML policy evaluation. We implemented our approach in a cloud policy engine called X2Automata. The engine first converts both XACML policies and access requests to automata. Second, it combines the two automata by a synchronous product. Third, it applies an evaluation procedure to the resulting automaton to decide whether an access request is granted or not. To highlight the efficiency of X2Automata, we compare its performance, based on the OpenStack cloud environment, with the XACML implementation named Balana.},
	isbn = {978-1-4503-4572-9},
	doi = {10.1145/2996429.2996431},
	author = {Ayache, Meryeme and Erradi, Mohammed and Freisleben, Bernd and Khoumsi, Ahmed}
}
@conference { ISI:000380401800126,
	title = {curlX: a MiddleWare to Enforce Access Control Policies within a Cloud Environment},
	booktitle = {2015 IEEE CONFERENCE ON COMMUNICATIONS AND NETWORK SECURITY (CNS)},
	year = {2015},
	note = {IEEE Conference Communications and Network Security CNS, Florence, ITALY, SEP 28-30, 2015},
	pages = {771-772},
	abstract = {Today cloud security and privacy concerns pose significant challenges. One particular challenge consists in how to take into consideration the user{\textquoteright}s security policies while accessing the outsourced data. In fact, for a given application, we may have a set of rules, as high level security policy, which needs to hold prior to any query execution. Therefore, the main problem that we tackle in this ongoing project is how to enforce this high level security policy in the cloud storage layer without conflicts. To address this challenges, we propose a middleware denoted curlX which consists of two main processes: the security policy enforcement process and the verification process.},
	isbn = {978-1-4673-7876-5},
	author = {Ayache, Meryeme and Erradi, Mohammed and Freisleben, Bernd}
}
@article {8885929720120901,
	title = {Using Aspect-Oriented State Machines for Detecting and Resolving Feature Interactions.},
	journal = {Computer Science \& Information Systems},
	volume = {9},
	number = {3},
	year = {2012},
	pages = {1046 - 1074},
	abstract = {The article focuses on the use of aspect-oriented state machines that helps in detecting feature interactions. It mentions that domain- specific language (DSL) is introduced to manage Finite State Machines with pattern matching technique. It mentions that in software product-line (SPL) engineers divides a software system into functional features through feature model.},
	keywords = {aspect interactions, Aspect-oriented programming, Computer hardware description languages, Computer software, conflict detection, conflict resolution, domain-specific aspect languages, feature interactions, Finite state machines (Computer science), formal methods, Image registration, object-oriented programming, state machines},
	issn = {18200214},
	url = {http://search.ebscohost.com/login.aspx?direct=true\&db=iih\&AN=88859297\&site=ehost-live},
	author = {Dinkelaker, Tom and Erradi, Mohammed and Ayache, Meryeme}
}
@article { ISI:000309649500004,
	title = {Using Aspect-Oriented State Machines for Detecting and Resolving Feature Interactions},
	journal = {COMPUTER SCIENCE AND INFORMATION SYSTEMS},
	volume = {9},
	number = {3, SI},
	year = {2012},
	month = {SEP},
	pages = {1045-1074},
	abstract = {Composing different features in a software system may lead to conflicting situations. The presence of one feature may interfere with the correct functionality of another feature, resulting in an incorrect behavior of the system. In this work we present an approach to manage feature interactions. A formal model, using Finite State Machines (FSM) and Aspect-Oriented (AO) technology, is used to specify, detect and resolve features interactions. In fact aspects can resolve interactions by intercepting the events which causes troubleshoot. Also a Domain-Specific Language (DSL) was developed to handle Finite State Machines using a pattern matching technique.},
	issn = {1820-0214},
	doi = {10.2298/CSIS111216033D},
	author = {Dinkelaker, Tom and Erradi, Mohammed and Ayache, Meryeme}
}
