1. Data and Applications Security Developments and Directions Dr. Bhavani Thuraisingham The University of Texas at Dallas Secure Knowledge Management: and Web Security November 5, 2010

2. Outline of the Unit l Background on Knowledge Management l Secure Knowledge Management l Confidentiality, Privacy and Trust l Integrated System l Secure Knowledge Management Technologies l Web Security l Digital Libraries l Directions

3. References l Proceedings Secure Knowledge Management Workshop - Secure Knowledge Management Workshop, Buffalo, NY, September 2004 - http://www.cse.buffalo.edu/caeiae/skm2004/ l Secure Knowledge Management - Bertino, Khan, Sandhu and Thuraisingham - IEEE Transactions on Systems man and Cybernetics - This lecture is based on the above paper

4. What is Knowledge Management l Knowledge management, or KM, is the process through which organizations generate value from their intellectual property and knowledge-based assets l KM involves the creation, dissemination, and utilization of knowledge l Reference: http://www.commerce-database.com/knowledge- management.htm?source=google

5. Knowledge Management Components Components: Strategies Processes Metrics Cycle: Knowledge, Creation Sharing, Measurement And Improvement Technologies: Expert systems Collaboration Training Web Components of Knowledge Management: Components, Cycle and Technologies

6. IdentificationCreation Diffusion - Tacit, Explicit IntegrationModification Action Organizational Learning Process Metrics Source: Reinhardt and Pawlowsky Incentives

7. Aspects of Secure Knowledge Management (SKM) l Protecting the intellectual property of an organization l Access control including role-based access control l Security for process/activity management and workflow - Users must have certain credentials to carry out an activity l Composing multiple security policies across organizations l Security for knowledge management strategies and processes l Risk management and economic tradeoffs l Digital rights management and trust negotiation

8. SKM: Strategies, Processes, Metrics, Techniques l Security Strategies: - Policies and procedures for sharing data - Protecting intellectual property - Should be tightly integrated with business strategy l Security processes - Secure workflow - Processes for contracting, purchasing, order management, etc. l Metrics - What is impact of security on number of documents published and other metrics gathered l Techniques - Access control, Trust management

9. SKM: Strategies, Processes, Metrics, Techniques

10. IdentificationCreation Diffusion - Tacit, Explicit IntegrationModification Action Security Impact on Organizational Learning Process Metrics What are the restrictions On knowledge sharing By incorporating security Incentives

11. Security Policy Issues for Knowledge Management l Defining Policies during Knowledge Creation l Representing policies during knowledge management l Enforcing policies during knowledge manipulation and dissemination

12. Secure Knowledge Management Architecture

13. SKM for Coalitions l Organizations for federations and coalitions work together to solve a problem - Universities, Commercial corporation, Government agencies l Challenges is to share data/information and at the same time ensure security and autonomy for the individual organizations l How can knowledge be shared across coalitions?

14. SKM Coalition Architecture Export Knowledge Component Knowledge for Agency A Knowledge for Coalition Export Knowledge Component Knowledge for Agency C Component Knowledge for Agency B Export Knowledge

15. SKM Technologies l Data Mining - Mining the information and determine resources without violating security l Secure Semantic Web - Secure knowledge sharing l Secure Annotation Management - Managing annotations about expertise and resources l Secure content management - Markup technologies and related aspects for managing content l Secure multimedia information management

16. Directions for SKM l We have identified high level aspects of SKM - Strategies, Processes. Metrics, techniques, Technologies, Architecture l Need to investigate security issues - RBAC, UCON, Trust etc. l CS departments should collaborate with business schools on KM and SKM

17. Web Security l End-to-end security - Need to secure the clients, servers, networks, operating systems, transactions, data, and programming languages - The various systems when put together have to be secure l Composable properties for security l Access control rules, enforce security policies, auditing, intrusion detection l Verification and validation l Security solutions proposed by W3C and OMG l Java Security l Firewalls l Digital signatures and Message Digests, Cryptography

18. Attacks to Web Security

19. Secure Web Components

20. E-Commerce Transactions l E-commerce functions are carried out as transactions - Banking and trading on the internet - Each data transaction could contain many tasks l Database transactions may be built on top of the data transaction service - Database transactions are needed for multiuser access to web databases - Need to enforce concurrency control and recovery techniques

21. Types of Transaction Systems l Stored Account Payment - e.g., Credit and debit card transactions - Electronic payment systems - Examples: First Virtual, CyberCash, Secure Electronic Transaction l Stored Value Payment - Uses bearer certificates - Modeled after hard cash l Goal is to replace hard cash with e-cash - Examples: E-cash, Cybercoin, Smart cards

22. Building Database Transactions Payments Protocol TCP/IP Protocol Socket Protocol Database Transaction Protocol HTTP Protocol

23. Secure Digital Libraries l Digital libraries are e-libraries - Several communities have developed digital libraries l Medical, Social, Library of Congress l Components technologies - Web data management, Multimedia, information retrieval, indexing, browsing, -- - - l Security has to be incorporated into all aspects - Secure models for digital libraries, secure functions

24. Secure Digital Libraries

25. Secure Web Databases l Database access through the web - JDBC and related technologies l Query, indexing and transaction management - E.g., New transaction models for E-commerce applications - Index strategies for unstructured data l Query languages and data models - XML has become the standard document interchange language l Managing XML databases on the web - XML-QL, Extensions to XML, Query and Indexing strategies l Integrating heterogeneous data sources on the web - Information integration and ontologies are key aspects l Mining the data on the web - Web content, usage, structure and content mining

26. Directions for Web Security l End-to-end security - Secure networks, clients, servers, middleware - Secure Web databases, agents, information retrieval systems, browsers, search engines, - - - l As technologies evolve, more security problems - Data mining, intrusion detection, encryption are some of the technologies for security l Next steps - Secure semantic web, Secure knowledge management - Building trusted applications from untrusted components