@article {14653,
	title = {A secure PLAN},
	journal = {IEEE Transactions on Systems, Man, and Cybernetics, Part C: Applications and Reviews},
	volume = {33},
	year = {2003},
	month = {2003/08//},
	pages = {413 - 426},
	abstract = {Active networks, being programmable, promise greater flexibility than current networks. Programmability, however, may introduce safety and security risks. This correspondence describes the design and implementation of a security architecture for the active network PLANet. Security is obtained with a two-level architecture that combines a functionally restricted packet language, PLAN, with an environment of general-purpose service routines governed by trust management. In particular, a technique is used which expands or contracts a packet{\textquoteright}s service environment based on its level of privilege, termed namespace-based security. The design and implementation of an active-network firewall and virtual private network is used as an application of the security architecture. Measurements of the system show that the addition of the firewall imposes an approximately 34\% latency overhead and as little as a 6.7\% space overhead to incoming packets.},
	keywords = {active networks, active-network firewall, Authentication, Authorization, Contracts, cryptography, Environmental management, Extraterrestrial measurements, functionally restricted packet language, general-purpose service routines, Internet, latency overhead, namespace-based security, packet switching, PLANet, Planets, privilege level, programmable networks, Safety, safety risks, secure PLAN, security of data, security risks, trust management, two-level architecture, virtual private network, Virtual private networks, Web and internet services},
	isbn = {1094-6977},
	doi = {10.1109/TSMCC.2003.817347},
	author = {Hicks, Michael W. and Keromytis,A. D and Smith,J. M}
}
@conference {14654,
	title = {A secure PLAN (extended version)},
	booktitle = {DARPA Active NEtworks Conference and Exposition, 2002. Proceedings},
	year = {2002},
	month = {2002///},
	pages = {224 - 237},
	publisher = {IEEE},
	organization = {IEEE},
	abstract = {Active networks promise greater flexibility than current networks, but threaten safety and security by virtue of their programmability. We describe the design and implementation of a security architecture for the active network PLANet (Hicks et al., 1999). Security is obtained with a two-level architecture that combines a functionally restricted packet language, PLAN (Hicks et al., 1998), with an environment of general-purpose service routines governed by trust management (Blaze et al., 1996). In particular, we employ a technique which expands or contracts a packet{\textquoteright}s service environment based on its level of privilege, termed namespace-based security. As an application of our security architecture, we present the design and implementation of an active-network firewall. We find that the addition of the firewall imposes an approximately 34\% latency overhead and as little as a 6.7\% space overhead to incoming packets},
	keywords = {active internetwork, active networks, active-network firewall, Authentication, authorisation, Authorization, Cities and towns, Computer networks, Computer science, cryptography, functionally restricted packet language, general-purpose service routines, Information security, internetworking, IP networks, latency overhead, namespace-based security, PLAN, PLANet, Planets, programmability, Safety, security architecture, telecommunication security, trust management, two-level architecture, Web and internet services},
	isbn = {0-7695-1564-9},
	doi = {10.1109/DANCE.2002.1003496},
	author = {Hicks, Michael W. and Keromytis,A. D and Smith,J. M}
}
@article {17821,
	title = {Flexible support for multiple access control policies},
	journal = {ACM Trans. Database Syst.},
	volume = {26},
	year = {2001},
	month = {2001/06//},
	pages = {214 - 260},
	abstract = {Although several access control policies can be devised for controlling access to information, all existing authorization models, and the corresponding enforcement mechanisms, are based on a specific policy (usually the closed policy). As a consequence, although different policy choices are possible in theory, in practice only a specific policy can actually be applied within a given system. In this paper, we present a unified framework that can enforce multiple access control policies within a single system. The framework is based on a language through which users can specify security policies to be enforced on specific accesses. The language allows the specification of both positive and negative authorizations and incorporates notions of authorization derivation, conflict  resolution, and decision strategies. Different strategies may be applied to different users, groups, objects, or roles, based on the needs of the security policy. The overall result is a flexible and powerful, yet simple, framework that can easily capture many of the traditional access control policies as well as protection requirements that exist in real-world applications, but are seldom supported by existing systems. The major advantage of our approach is that it can be used to specify different access control policies that can all coexist in the same system and be enforced by the same security server.},
	keywords = {access control policy, Authorization, logic programming},
	isbn = {0362-5915},
	doi = {10.1145/383891.383894},
	url = {http://doi.acm.org/10.1145/383891.383894},
	author = {Jajodia,Sushil and Samarati,Pierangela and Sapino,Maria Luisa and V.S. Subrahmanian}
}
