Lecture Notes in Computer Science 2808 Edited by G. Goos, J. Hartmanis, and J. van Leeuwen

Size: px

Start display at page:

Download "Lecture Notes in Computer Science 2808 Edited by G. Goos, J. Hartmanis, and J. van Leeuwen"

Warren Anthony
5 years ago
Views:

1 Lecture Notes in Computer Science 2808 Edited by G. Goos, J. Hartmanis, and J. van Leeuwen

2 3 Berlin Heidelberg New York Hong Kong London Milan Paris Tokyo

3 Einar Snekkenes Dieter Gollmann (Eds.) Computer Security ESORICS th European Symposium on Research in Computer Security Gjøvik, Norway, October 13-15, 2003 Proceedings 13

4 Series Editors Gerhard Goos, Karlsruhe University, Germany Juris Hartmanis, Cornell University, NY, USA Jan van Leeuwen, Utrecht University, The Netherlands Volume Editors Einar Snekkenes Gjøvik University College P.O. Box 191, 2802 Gjøvik, Norway Dieter Gollmann Microsoft Research, Roger Needham Building 7 JJ Thomson Avenue, Cambridge CB3 0FB, United Kingdom diego@microsoft.com Cataloging-in-Publication Data applied for A catalog record for this book is available from the Library of Congress Bibliographic information published by Die Deutsche Bibliothek Die Deutsche Bibliothek lists this publication in the Deutsche Nationalbibliographie; detailed bibliographic data is available in the Internet at < CR Subject Classification (1998): E.3, D.4.5, C.2.0, H.2.0, K.6.5, K.4.4 ISSN ISBN Springer-Verlag Berlin Heidelberg New York This work is subject to copyright. All rights are reserved, whether the whole or part of the material is concerned, specifically the rights of translation, reprinting, re-use of illustrations, recitation, broadcasting, reproduction on microfilms or in any other way, and storage in data banks. Duplication of this publication or parts thereof is permitted only under the provisions of the German Copyright Law of September 9, 1965, in its current version, and permission for use must always be obtained from Springer-Verlag. Violations are liable for prosecution under the German Copyright Law. Springer-Verlag Berlin Heidelberg New York a member of BertelsmannSpringer Science+Business Media GmbH Springer-Verlag Berlin Heidelberg 2003 Printed in Germany Typesetting: Camera-ready by author, data conversion by Olgun Computergrafik Printed on acid-free paper SPIN: /

5 Preface ESORICS, the European Symposium On Research In Computer Security, is the leading research-oriented conference on the theory and practice of computer security in Europe. The aim of ESORICS is to further the progress of research in computer security by establishing a European forum for bringing together researchers in this area, by promoting the exchange of ideas with system developers and by encouraging links with researchers in related areas. ESORICS is coordinated by an independent steering committee. In the past it took place every two years at various locations throughout Europe. Starting this year, it will take place annually. ESORICS 2003 was organized by Gjøvik University College, and took place in Gjøvik, Norway, October 13 15, The program committee received 114 submissions, originating from 26 countries on all continents. Half the papers originated in Europe (57). The most dominant countries were: UK (16), USA (14), Germany (6), South Korea (6), Sweden (6), Italy (5), France (4) and Poland (4). Each submission was reviewed by at least three program committee members or other experts. The program committee chair and co-chair were not allowed to submit papers. The final selection of papers was made at a program committee meeting followed by a week of discussions. Out of the 114 papers received, only 19 got accepted (17%). In comparison, ESORICS 2000 and 2002 received 75 and 83 papers and accepted 19% and 16%, respectively. The program reflected the full range of security research, including access control, cryptographic protocols, privacy enhancing technologies, security models, authentication, and intrusion detection. The program committee gratefully acknowledges all authors who submitted papers for their efforts in maintaining the standards of this conference. It is also my pleasure to thank the members of the program committee, the additional reviewers, and the members of the organization committee for their work and support. Gjøvik, October 2003 Einar Snekkenes

6 General Chair Jørn Wroldsen (Gjøvik University College) Program Committee Tuomas Aura Joachim Biskup Tønnes Brekne Frédéric Cuppens Marc Dacier Sabrina De Captani di Vimercati Hervé Debar Yves Deswarte Simon Foley Dieter Gollmann Trent Jaeger Kaoru Kurosawa Heiko Mantel John McHugh Ken Moody Stefano Paraboschi Birgit Pfitzmann Avi Rubin Peter Ryan Pierangela Samarati (co-chair) Tomas Sander Einar Snekkenes (chair) Michael Steiner Paul Syverson Michael Waidner Microsoft Research, UK University of Dortmund, Germany Telenor, Norway ENST-Bretagne, France Eurecom, France University of Milan, Italy France Telecom R&D, France LAAS-CNRS, France University College Cork, Ireland Microsoft Research, UK IBM Research, USA Ibaraki University, Japan DFKI, Germany CERT, USA University of Cambridge, UK University of Bergamo, Italy IBM Research, Switzerland Johns Hopkins University, USA University of Newcastle, UK University of Milan, Italy Hewlett-Packard, USA Gjøvik University College, Norway IBM Research, USA NRL, USA IBM Research, Switzerland Additional Reviewers Anas Abou El Kalam, Carlos Aguilar, Michael Backes, Jeremy Bryans, Laurent Bussard, Christian Cachin, Pau-chen Cheng, Jason Crampton, Roger Dingledine, Ulrich Flegel, Cédric Fournet, Tetsu Iwata, Klaus Julisch, Jan Jürjens, Yücel Karabulut, Wataru Kishimoto, Thomas Leineweber, Shinichiro Matsuo, Ralf Menzel, Refik Molva, Ira Moskowitz, Vincent Nicomette, Yasuhiro Ohtaki, Jörg Parthe, Benny Pinkas, Gerhard Popp, Fabien Pouget, Michael Roe, Ayda Saïdane, Pasha Shabalin, Ron Steinfeld, Morton Swimmer, Vu Dong Tô, Sandra Wortmann, Yuliang Zheng, Alf Zugenmaier

7 VIII Organization Organizing Committee Birgith Børthus (chair) Hilding Sponberg (co-chair) Øivind Kolloen Rigmor Øvstetun Fred Johansen Svein Pettersen Steering Committee Elisa Bertino (University of Milan, Italy) Joachim Biskup (University of Dortmund, Germany) Frédéric Cuppens (ENST-Bretagne, France) Marc Dacier (Eurecom, France) Yves Deswarte (LAAS-CNRS, France) Gérard Eizenberg (ONERA, France) Simon Foley (University College Cork, Ireland) Dieter Gollmann (Microsoft Research, UK) Franz-Peter Heider (debis IT Security Services, Germany) Jeremy Jacob (University of York, UK) Sokratis Katsikas (University of the Aegean, Greece) Helmut Kurth (atsec, Germany) Peter Landrock (Cryptomathic, UK) Jean-Jacques Quisquater (UCL, Belgium) Peter Ryan (University of Newcastle, UK; Steering Committee Chair) Pierangela Samarati (University of Milan, Italy) Einar Snekkenes (Gjøvik University College, Norway) Michael Waidner (IBM Research, Switzerland)

8 Table of Contents Signature and Access Control Policies for XML Documents... 1 Elisa Bertino, Elena Ferrari, and Loredana Parasiliti Provenza Authorization and Access Control in Adaptive Workflows Dulce Domingos, António Rito-Silva, and Pedro Veiga Flexible Regulation of Distributed Coalitions Xuhui Ao and Naftaly H. Minsky Initiator-Resilient Universally Composable Key Exchange Dennis Hofheinz, Jörn Müller-Quade, and Rainer Steinwandt Multi-round Secure Light-Weight Broadcast Exclusion Protocol with Pre-processing Yuji Watanabe and Masayuki Numao Precisely Answering Multi-dimensional Range Queries without Privacy Breaches Lingyu Wang, Yingjiu Li, Duminda Wijesekera, and Sushil Jajodia Passive Attack Analysis for Connection-Based Anonymity Systems Andrei Serjantov and Peter Sewell Rapid Mixing and Security of Chaum s Visual Electronic Voting Marcin Gomu lkiewicz, Marek Klonowski, and Miros law Kuty lowski Towards Accountable Management of Privacy and Identity Information Marco Casassa Mont, Siani Pearson, and Pete Bramhall A Toolkit for Managing Enterprise Privacy Policies Michael Backes, Birgit Pfitzmann, and Matthias Schunter Authenticating Mandatory Access Controls and Preserving Privacy for a High-Assurance Smart Card Helmut Scherzer, Ran Canetti, Paul A. Karger, Hugo Krawczyk, Tal Rabin, and David C. Toll Hardware Encapsulation of Security Services Adrian Baldwin and Simon Shiu A Formal Security Model of the Infineon SLE 88 Smart Card Memory Management David von Oheimb, Georg Walter, and Volkmar Lotz

9 X Table of Contents Bridging Model-Based and Language-Based Security Rogardt Heldal and Fredrik Hultin An On-the-Fly Model-Checker for Security Protocol Analysis David Basin, Sebastian Mödersheim, and Luca Viganò Symmetric Authentication within a Simulatable Cryptographic Library Michael Backes, Birgit Pfitzmann, and Michael Waidner An Improved Reference Flow Control Model for Policy-Based Intrusion Detection Jacob Zimmermann, Ludovic Mé, and Christophe Bidan Visualisation for Intrusion Detection Stefan Axelsson On the Detection of Anomalous System Call Arguments Christopher Kruegel, Darren Mutz, Fredrik Valeur, and Giovanni Vigna Author Index...345

Lecture Notes in Computer Science 2497 Edited by G. Goos, J. Hartmanis, and J. van Leeuwen

Lecture Notes in Computer Science 2497 Edited by G. Goos, J. Hartmanis, and J. van Leeuwen 3 Berlin Heidelberg New York Barcelona Hong Kong London Milan Paris Tokyo Enrico Gregori Giuseppe Anastasi Stefano