@article { ISI:000389146000004,
	title = {ANALYSIS AND VERIFICATION OF XACML POLICIES IN A MEDICAL CLOUD ENVIRONMENT},
	journal = {Scalable Computing-Practice and Experience},
	volume = {17},
	number = {3, SI},
	year = {2016},
	month = {SEP},
	pages = {189-205},
	abstract = {The connectivity of devices, machines and people via Cloud infrastructure can support collaborations among doctors and specialists from different medical organisations. Such collaborations may lead to data sharing and joint tasks and activities. Hence, the collaborating organisations are responsible for managing and protecting data they share. Therefore, they should define a set of access control policies regulating the exchange of data they own. However, existing Cloud services do not offer tools to analyse these policies. In this paper, we propose a Cloud Policy Verification Service (CPVS) for the analysis and the verification of access control policies specified using XACML. The analysis process detects anomalies at two policy levels: a) intra-policy: detects discrepancies between rules within a single security policy (conflicting rules and redundancies), and b) inter policies: detects anomalies between several security policies such as inconsistency and similarity. The verification process consists in verifying the completeness property which guarantees that each access request is either accepted or denied by the access control policy. In order to demonstrate the efficiency of our method, we also provide the time and space complexities. Finally, we present the implementation of our method and demonstrate how efficiently our approach can detect policy anomalies.},
	issn = {1895-1767},
	doi = {10.12694/scpe.v17i3.1180},
	author = {Ayache, Meryeme and Erradi, Mohammed and Khoumsi, Ahmed and Freisleben, Bernd}
}
@article {11714990120160901,
	title = {ANALYSIS AND VERIFICATION OF XACML POLICIES IN A MEDICAL CLOUD ENVIRONMENT.},
	journal = {Scalable Computing: Practice \& Experience},
	volume = {17},
	number = {3},
	year = {2016},
	pages = {189 - 205},
	abstract = {The connectivity of devices, machines and people via Cloud infrastructure can support collaborations among doctors and specialists from different medical organisations. Such collaborations may lead to data sharing and joint tasks and activities. Hence, the collaborating organisations are responsible for managing and protecting data they share. Therefore, they should define a set of access control policies regulating the exchange of data they own. However, existing Cloud services do not offer tools to analyse these policies. In this paper, we propose a Cloud Policy Verification Service (CPVS) for the analysis and the verification of access control policies specified using XACML. The analysis process detects anomalies at two policy levels: a) intra-policy: detects discrepancies between rules within a single security policy (conflicting rules and redundancies), and b) interpolicies: detects anomalies between several security policies such as inconsistency and similarity. The verification},
	keywords = {Automata, Cloud computing, Completeness, Data security, Formal Verification, Information storage \& retrieval systems {\textendash} Medical care, Security Anomaly Detection, XACML Policies},
	issn = {18951767},
	url = {http://search.ebscohost.com/login.aspx?direct=true\&db=iih\&AN=117149901\&site=ehost-live},
	author = {Ayache, Meryeme and Erradi, Mohammed and Khoumsi, Ahmed and Freisleben, Bernd}
}
@conference { ISI:000389502600019,
	title = {An Approach to Resolve NP-Hard Problems of Firewalls},
	booktitle = {Networked Systems, NETYS 2016},
	series = {Lecture Notes in Computer Science},
	volume = {9944},
	year = {2016},
	note = {4th International Conference on Networked Systems (NETYS), Marrakech, MOROCCO, MAY 18-20, 2016},
	pages = {229-243},
	abstract = {Firewalls are a common solution to protect information systems from intrusions. In this paper, we apply an automata-based methodology to resolve several NP-Hard problems which have been shown in the literature to be fundamental for the study of firewall security policies. We also compute space and time complexities of our resolution methods.},
	isbn = {978-3-319-46140-3; 978-3-319-46139-7},
	issn = {0302-9743},
	doi = {10.1007/978-3-319-46140-3\_19},
	author = {Khoumsi, Ahmed and Erradi, Mohamed and Ayache, Meryeme and Krombi, Wadie},
	editor = {Abdulla, PA and DelporteGallet, C}
}
@conference { ISI:000390888900008,
	title = {Towards an Efficient Policy Evaluation Process in Multi-Tenancy Cloud Environments},
	booktitle = {CCSW{\textquoteright}16: PROCEEDINGS OF THE 2016 ACM CLOUD COMPUTING SECURITY WORKSHOP},
	year = {2016},
	note = {8th ACM Cloud Computing Security Workshop (CCSW), Vienna, AUSTRIA, OCT 28, 2016},
	pages = {55-59},
	publisher = {ACM SIGSAC; ACM},
	organization = {ACM SIGSAC; ACM},
	abstract = {Cloud computing offers most of its services under multi-tenancy environments. To satisfy security requirements among collaborating tenants, each tenant may define a set of access control policies to secure access to shared data. Several cloud solutions make use of XACML to specify such policies. However, existing implementations of XACML perform a brute force search to compare a request to all existing rules in a given XACML policy. This decreases the decision process (i.e., policy evaluation) performance especially for policies with a large number of rules. In this paper, we propose an automata-based approach for an efficient XACML policy evaluation. We implemented our approach in a cloud policy engine called X2Automata. The engine first converts both XACML policies and access requests to automata. Second, it combines the two automata by a synchronous product. Third, it applies an evaluation procedure to the resulting automaton to decide whether an access request is granted or not. To highlight the efficiency of X2Automata, we compare its performance, based on the OpenStack cloud environment, with the XACML implementation named Balana.},
	isbn = {978-1-4503-4572-9},
	doi = {10.1145/2996429.2996431},
	author = {Ayache, Meryeme and Erradi, Mohammed and Freisleben, Bernd and Khoumsi, Ahmed}
}
@conference { ISI:000361756400014,
	title = {A Formal Approach to Verify Completeness and Detect Anomalies in Firewall Security Policies},
	booktitle = {FOUNDATIONS AND PRACTICE OF SECURITY (FPS 2014)},
	series = {Lecture Notes in Computer Science},
	volume = {8930},
	year = {2015},
	note = {7th International Symposium on Foundations and Practice of Security (FPS), Concordia Univ, Montreal, CANADA, NOV 03-05, 2014},
	pages = {221-236},
	abstract = {Security policies are a relevant solution to protect information systems from undue accesses. In this paper, we develop a formal and rigorous automata-based approach to design and analyze security policies. The interest of our approach is that it can be used as a common basis for analyzing several aspects of security policies, instead of using a distinct approach and formalism for studying each aspect. We first develop a procedure that synthesizes automatically an automaton which implements a given security policy. Then, we apply this synthesis procedure to verify completeness of security policies and detect several types of anomalies in security policies. We also study space and time complexities of the developed procedures.},
	isbn = {978-3-319-17040-4; 978-3-319-17039-8},
	issn = {0302-9743},
	doi = {10.1007/978-3-319-17040-4\_14},
	author = {Khoumsi, Ahmed and Krombi, Wadie and Erradi, Mohammed},
	editor = {Cuppens, F and GarciaAlfaro, J and Heywood, NZ and Fong, PWL}
}
@conference { ISI:000360829800037,
	title = {Automata-Based Approach to Design and Analyze Security Policies},
	booktitle = {2014 TWELFTH ANNUAL INTERNATIONAL CONFERENCE ON PRIVACY, SECURITY AND TRUST (PST)},
	year = {2014},
	note = {12th Annual International Conference on Privacy, Security and Trust (PST), Ryerson Univ, Toronto, CANADA, JUL 23-24, 2014},
	pages = {306-313},
	abstract = {Information systems must be controlled by security policies to protect them from undue accesses. Security policies are often designed by rules expressed using informal text, which implies ambiguities and inconsistencies in security rules. Our objective in this paper is to develop a formal approach to design and analyze security policies. We propose a procedure that synthesizes an automaton which implements a given security policy. Our automata-based approach can be a common basis to analyze several aspects of security policies. We use our automata-based approach to develop three analysis procedures to: verify completeness of a security policy, detect anomalies in a security policy, and detect functional discrepancies between several implementations of a security policy. We illustrate our approach using examples of security policies for a firewall.},
	isbn = {978-1-4799-3503-1},
	author = {Krombi, Wadie and Erradi, Mohammed and Khoumsi, Ahmed},
	editor = {Miri, A and Hengartner, U and Huang, NF and Josang, A and GarciaAlfaro, J}
}
