Programme

Monday, July 20, 2009
08:30AM - 09:30AM	Registration
09:30AM - 10:00AM	Opening Session
10:00AM - 11:00AM	Keynote Talk: Is the user STILL the enemy? Dr. Anne Adams, Institute of Educational Technology, The Open University, UK
11:00AM - 11:30AM	COFFEE BREAK
11:30AM - 1:00PM	Session 1: Privacy and Security Management Chair: Naftaly Minsky, Rutgers University, USA
Full Papers	Abductive Authorization Credential Gathering       ******Best Student Paper Award********* Moritz Becker, Jason Mackay, Microsoft Research, USA Blair Dillaway, Microft Corporation, USA. Towards Session-aware RBAC Administration and Enforcement with XACML Min Xu, George Mason University, USA Duminda Wijesekera, George Mason University, USA Xinwen Zhang, Samsung Information Systems America, USA Deshan Cooray, George Mason University, USA. Using Modeling and Simulation for Policy Decision Support in Identity Management Marco Casassa Mont, Hewlett-Packard Labs, Great Britain Adrian Baldwin, Simon Shiu, HP Labs Bristol, Great Britain.
1:00PM - 2:30PM	LUNCH BREAK
2:30PM - 3:45PM	Session 2: Short Papers Chair: Ken Moody, University of Cambridge, UK
Short Papers	Visualizing Access Control Policy Analysis Results Prathima Rao, Gabriel Ghinita, Elisa Bertino, Purdue University, USA Jorge Lobo, IBM T. J. Watson Research Center, USA. Policies for Self Tuning Home Networks Dimosthenis Pediaditakis, Leonardo Mostarda, Changyu Dong, Imperial College London, Great Britain Naranker Dulay, Imperial College London, Great Britain. Strong and Weak Policy Relations Michael May, Kinneret College on the Sea of Galilee, Israel Insup Lee, University of Pennsylvania, USA Carl Gunter, UIUC, USA Steve Zdancewic, University of Pennsylvania, USA. Verification of Policy-Based Self-Managed Cell Interactions Using Alloy Alberto Schaeffer-Filho, Imperial College London, Great Britain Emil Lupu, Imperial College London, Great Britain Morris Sloman, Susan Eisenbach, Imperial College London, Great Britain An Entropy-based Countermeasure against Intelligent DoS Attacks Targeting Firewalls Fahd Al-Haidari, KFUPM, Saudi Arabia Mohammed Sqalli, King Fahd University of Petroleum & Minerals, Saudi Arabia Jamil Hamodi, Khaled Salah, KFUPM, Saudi Arabia.
3:45PM - 4:30PM	COFFEE BREAK
4:30PM - 6:00PM	Session 3: Applications Chair: Duminda Wijesekera, George Mason University, USA
Full Papers	Apply Measurable Risk to Strengthen Security of a Role-based Delegation supporting Workflow System Weili Han, Fudan University, P.R. China. Qun Ni, Hong Chen, Purdue University, USA Policy-based Real-time Decision-Making for Personalized Service Delivery Jochen Bauknecht, NEC Laboratories Europe, Germany Johannes Haeussler, Daniel Kraft, Marcus Kuhnen, Mario Lischka, NEC Europe Ltd., Germany Anett Schuelke, NEC Laboratories Europe, Germany. Model Checking Firewall Policy Configurations Alan Jeffrey, Bell Labs, Alcatel-Lucent, USA Taghrid Samak, DePaul University, USA.
6:00PM	WELCOME RECEPTION Physics Department Common Room, 8th Floor, Physics Building, Prince Consort Road
Tuesday, July 21, 2009
9:00AM - 10:00AM	Keynote Talk: Policy and IT Claudio Bartolini, HP Labs, Palo Alto, USA
10:00AM - 10:30AM	COFFEE BREAK
10:30AM - 12:00PM	Session 4: Policy Refinement Chair: Hanan Luftiyya, University of Western Ontario, Canada
Full Papers	ChangeRefinery: Assisted Refinement of High-Level IT Change Requests David Trastour, HP Labs, Great Britain Robert Fink, Feng Liu, University of Munich, Germany. Realizing the CDL Cross-Domain Language in the Ponder2 Policy Framework: Experiences and Research Directions Roshan Thomas, Sparta, USA Giovanni Russello, Imperial College London, Great Britain Simon Tsang, Telcordia, USA. Delegation Assistance Achim Brucker, Helmut Petritsch, SAP Research, Germany Andreas Schaad, SAP, Germany.
12:00PM - 1:00PM	Poster and Demo Session
Demos	ProActive Caching - A Framework for performance optimized Access Control Evaluations Mathias Kohler, SAP AG, Germany Robert Fies, SAP Research, Germany. A Policy-based Sensor Selection System with Goal Oriented Singular Value Decomposition Technique Hoi Chan, IBM T.J. Watson Research Center, USA Thomas Kwok, IBM T.J. Research Center, USA.
1:00PM - 2:30PM	LUNCH BREAK
2:30PM - 3:45PM	Session 5: Short Papers Chair: Alessandra Russo, Imperial College London, UK
Short Papers	XACML Policy profile for multidomain Network Resource Provisioning and supporting Authorisation Infrastructure Yuri Demchenko, Mihai Cristea, Cees de Laat, University of Amsterdam, The Netherlands. Engineering a Policy-based Management System for Distributed Interoperability Chiang Jason, Gary Levin, Shih-Wei Li, Telcordia, USA Constantin Serban, Michelle Wolberg, Telcordia Technologies, USA Ritu Chadha, Telcordia, USA. A Digital Rights Management Model for Healthcare Nicholas Sheppard, Reihaneh Safavi-Naini, Mohammad Jafari, University of Calgary, Canada. POLIPO: Policies & OntoLogies for Interoperability, Portability, and autOnomy Daniel Trivellato, Fred Spiessens, Nicola Zannone, TU/e, The Netherlands Sandro Etalle, Eindhoven Technical University, The Netherlands. Common Carrier Monitoring Service Providers Carl Gunter, University of Illinois, USA.
3:45PM - 4:30PM	COFFEE BREAK
4:30PM - 6:00PM	Session 6: Systems and Tools Chair: Yuri Demchenko, University of Amsterdam, The Netherlands
Full Papers	Efficient XACML Policy Evaluation with a Statistics Based & Clustering Framework Said Marouf, Mohamed Shehab, UNC Charlotte, USA Anna Squicciarini, Smitha Sundareswaran, Penn State, USA. Policy Processing: Don't Take it for Granted Joseane Fidalgo, UFPE, Brazil Carlos Kamienski, Universidade Federal do ABC (UFABC), Brazil Ramide Dantas, Universidade Federal de Pernambuco, Brazil Djamel Sadok, UFPE, Brazil Boerje Ohlman, Ericsson Research, Sweden. In Vivo Evolution of Policies that Govern a Distributed System Constantin Serban, Telcordia Technologies, USA Naftaly Minsky, Rutgers University, USA.
7:30PM	CONFERENCE DINNER Bombay Brasserie, Courtfield Road, London SW7 4QH  map
Wednesday, July 22, 2009
9:00AM - 10:00AM	Keynote Talk: Analysing policies for electronic voting Dr. Mark Ryan, Department of Computer Science, University of Birmingham, UK
10:00AM - 10:30AM	COFFEE BREAK
10:30AM - 12:00PM	Session 7: Formal Semantics of Policies Chair: Helge Janicke, De Montfort University, UK
Full Papers	A Temporal Description Logic Based Access Control Model for Expressing History Constrained Policies in Semantic Web Environments Fathieh Faghih, Sharif University of Technology, Iran. Access Control Policies for Semantic Networks Tatyana Ryutov, USC Information Sciences Institute, USA. Formalization and Management of Group Obligations Yehia El Rakaiby, TELECOM-Bretagne, France Frederic Cuppens, Nora Cuppens-Boulahia, TELECOM Bretagne, France.
12:00PM - 1:30PM	Panel Discussion: W(h)ither Policy 2020? Chair: Arosha Bandara, The Open University, UK
	This is the 10th anniversary year for the conference and therefore an opportunity to look ahead and set the challenges for the next 10 years of research. Therefore, this year's panel discussion will try and address the following: What have been the major accomplishments of policy-based management? What are the major challenges ahead? Which research topics should we be focussing on? Which ones have we investigated to death? How should we broaden the application areas of policy-based management? e.g., pervasive systems What will be the killer application that catapults policy-based management into wide scale use? Is standardisation dead? The panel comprises experts in the field, drawn from both academia and industry: Prof. Naftaly Minsky, Rutgers University, USA Dr. Theo Dimitrakos, CISSR, British Telecom, UK Prof. Marek Sergot, Imperial College London, UK Prof. Duminda Wijesekera, George Mason University, USA
1:30PM - 2:30PM	LUNCH BREAK
2:30PM - 4:00PM	Session 8: Short Papers Chair: Scott Newman, US Army CERDEC, USA
Short Papers	An XACML Extension for Business Process-centric Access Control Policies Christian Wolter, SAP Research, Germany. Towards consistency of policy states in decentralized autonomic network management Jeferson Nobre, Lisandro Zambenedetti Granville, UFRGS, Brazil. The Zodiac Policy Subsystem: a Policy-Based Management System for a High-security MANET Yuu-Heng Cheng, Scott Alexander, Alexander Poylisher, Telcordia, USA Mariana Raykova, Steven Bellovin, Columbia University, USA. xDUCON: Cross Domain Usage Control through Shared Data Spaces Giovanni Russello, Naranker Dulay, Imperial College London, Great Britain. Detecting Conflicts in ABAC Policies with Rule-reduction and Binary-search Techniques Cheng-chun Shu, ICT, CAS, P.R. China Erica Yang, Alvaro Arenas, Science and Technology Facility Council,UK, Great Britain. Mapping Policies to Management Systems Abdelnasser Ouda, University of Western Ontario, Canada. Michael Bauer, Hanan Luftiyya, University of Western Ontario, Canada.
4:00PM	CLOSE

---

Keynotes

Is the user STILL the enemy?
Dr. Anne Adams, Institute of Educational Technology, The Open University, UK

Abstract

Global communications is a powerful force in advancing the freedom of information. However, with an increase in different types of personal data, as well as functionality for accessing and using such data, there are associated risks. The limit of users' acceptability for these risks is of the utmost importance because perceived infringements of security can lead to a rejection of communication technology thus decreasing its commercial viability. This presentation will review over 10 years of research with various multimedia, virtual reality, mobile, pervasive and web2 technologies in academic, industrial and public sectors. The findings highlight designers' natural preference for replicating real world scenarios virtually. Technology, however, can distort that world, making natural assumptions inaccurate. This presentation shows how this has serious implications for the past, present and future approaches to security policy making. Over 10 years ago a plea was sent out to security policy makers to change their adversarial approach. Major threats to security were identified as not necessarily from malicious intent but inadvertently supported by the technology and policies for implementation. The question now is: what have we learnt?

Bio

Dr. Anne Adams is a Lecturer in the Institute of Educational Technology at the Open University, a visiting Senior Lecturer at the Middlesex University Interaction Design Centre and previously an external examiner for the Royal College of Surgeon and Bath University. From an interdisciplinary background in psychology, ergonomics and computing Dr. Adams has developed a wide range of research interests varying from digital libraries to security and HCI, the social impacts of technology, CSCW and has recently written several chapters on research methods in HCI. Initial UCL research focused on security and usability reviewing authentication mechanisms and users' perceptions of privacy within multimedia communications. Later projects on digital resources, awareness and mobile devices identified the importance of context in technology design. Finally a position at Nottingham University advanced her research into mobile and ubiquitous technology. Previous research projects were based within a variety of organisations from industry (i.e. telecommunications and building) to clinical (e.g. NHS, Department of Health) and academic settings. Her current work at the Open University has focused on technology enhanced learning and practice based learning through the Open CETL. She is a member of the ACM, has been on the committee for the BCS HCI group and has organised and contributed to international forums on Healthcare and Mobile Digital Libraries. She has presented at and chaired sessions at international conferences and been both an invited and keynote speaker for academic, industrial and health organisations across the world including the Royal Society of Medicine, Google, Royal College of Surgeons, the Higher Education Academy and Microsoft.
Back

---

Policy and IT
Claudio Bartolini, HP Labs, Palo Alto, USA

Abstract

The traditional domain of application of industrial and academic research on policy has been distributed systems and networks. Within it, research on information security policy has been a particularly fertile field. In this talk, I'll explore the impact of policy onto all dimensions of IT: not just technology (systems and networks), but also - and especially - people and processes. With this exploration, I'll show that information security is just one of the preoccupation of a chief information officer (CIO): setting policies for a medium or large IT organization requires setting policy for other processes, such as change release, service requests, help desk procedures etc. I'll discuss the impact of policy choices and highlight research challenges in policy for the wider domain of IT. In particular I will touch on some recent work carried out with HP Labs colleagues on model-based and market-based decision support techniques for understanding the impact and consequences of IT policy choices onto the organization.

Bio

Claudio Bartolini manages the predictive IT analytics research group in HP Labs Palo Alto and Bristol. He's been with HP Labs since 1996 holding a variety of technical positions at Bristol and Palo Alto. He has published extensively and has been granted patents in the domains of IT service management and e-commerce. He has organized and taken part in the technical committee of many of various editions of IM, NOMS, DSOM, POLICY among others. Claudio holds a M.Sc E.E. from the University of Bologna, Italy and a Ph.D. in Information Engineering from the University of Ferrara, Italy.
Back

---

Analysing policies for electronic voting
Dr. Mark Ryan, Department of Computer Science, University of Birmingham, UK

Abstract

Electronic voting systems have subtle and often apparently conflicting requirements, that have proved very difficult to provide in practice. One one hand, the requirement of "vote verifiability" enables a voter to check that her vote is included in the final tally. On the other hand, a voter should not be able to prove to another party that she voted in a particular way, in order to protect her from coercion. These properties may appear to contradict each other. In the talk, we discuss how the properties can be formalised, and how particular systems can be analysed to check whether they satisfy the policies.

Bio

Mark Ryan obtained his bachelors and masters degrees from University of Cambridge, and his PhD from Imperial College London. He is Reader in Computer Science at University of Birmingham. His current research is in computer security, particularly the analysis of cryptographic protocols. He has recently worked on protocols for electronic voting, trusted computing, and anonymous service usage. Previously, he was active in applications of logic, and he co-authored the textbook "Logic in Computer Science" which has sold about 20 000 copies. Ryan's research is supported by EPSRC, as well as Microsoft and Hewlett Packard.
Back