research-article

MLSvisual: a visualization tool for teaching access control using multi-level security

Authors:

Chaoli WangAuthors Info & Claims

ITiCSE '14: Proceedings of the 2014 conference on Innovation & technology in computer science education

Pages 93 - 98

https://doi.org/10.1145/2591708.2591730

Published: 21 June 2014 Publication History

Get Access

Abstract

Information security continues to be a pressing issue for industry and government. Perhaps the two most fundamental mechanisms for controlling access to information are cryptography and access control systems. This paper presents MLSvisual, a tool that helps students learn the multi-level(Bell-LaPadula) access control model. MLSvisual allows students to create, explore, and modify an MLS policy through a graphical visualization system. A query system can be used by students to test their understanding of a given policy. Instructors can utilize a test function in the tool to assign an exercise or quiz, with answers sent to them via email. We also present the results of an evaluation of MLSvisual within a senior-level course on information security. This evaluation received positive feedback and showed that MLSviusal helped the understanding of the Bell-LaPadula model and enhanced the course. We believe that this user-level tool will help instructors to teach this material more effectively, and make teaching this material more practical in resource-constrained environments.

References

[1]

D. E. Bell and L. J. La Padula. Secure computer systems: Mathematical foundations. Technical Report MTR-2547, Vol 1, The MITRE Corporation, Bedford, MA, Nov. 1973.

Google Scholar

[2]

K. J. Biba. Integrity considerations for secure computer systems. MTR-3153, Rev. 1, The MITRE Corporation, Bedford, MA, Apr. 1977.

Google Scholar

[3]

W. E. Boebert and R. Y. Kain. A practical alternative to hierarchical integrity policies. In Proceedings of National Computer Security Conference, pages 18--27, Oct. 1985.

Google Scholar

[4]

J. R. Crandall, S. L. Gerhart, and J. G. Hogle. Driving home the buffer overflow problem: A training module for programmers and managers. In Proceedings of National Colloquium for Information Systems Security Education, June 2002.

Google Scholar

[5]

D. Ebeling and R. Santos. Public key infrastructure visualization. The Journal of Computing Sciences in Colleges, 23(1):247--254, Oct. 2007.

Digital Library

Google Scholar

[6]

S. Hallyn and P. Kearns. Tools to administer domain and type enforcement. In Proceedings of USENIX Conference on System Administration, pages 151--156, Dec. 2001.

Digital Library

Google Scholar

[7]

R. S. Sandhu, E. J. Coyne, H. L. Feinstein, and C. E. Youman. Role-based access control models. IEEE Computer, 20(2):38--47, 1996.

Digital Library

Google Scholar

[8]

D. Schweitzer and L. Baird. The design and use of interactive visualization applets for teaching ciphers. In Proceedings of IEEE Workshop on Information Assurance, pages 69--75, 2006.

Crossref

Google Scholar

[9]

D. Schweitzer, L. Baird, M. Collins, W. Brown, and M. Sherman. Grasp: A visualization tool for teaching security protocols. In Proceedings of National Colloquium for Information Systems Security Education, pages 75--81, 2006.

Google Scholar

[10]

D. Schweitzer and W. Brown. Using visualization to teach security. The Journal of Computing Sciences in Colleges, 24(5):143--150, 2009.

Digital Library

Google Scholar

[11]

D. Schweitzer, M. Collins, and L. Baird. A visual approach to teaching formal access models in security. In Proceedings of National Colloquium for Information Systems Security Education, 2007.

Google Scholar

[12]

J. Tao, J. Ma, M. Keranen, J. Mayo, and C.-K. Shene. ECvisual: A Visualization Tool for Elliptic Curve Based Ciphers. In Proceedings of ACM Technical Symposium on Computer Science Education, pages 571--576, 2012.

Digital Library

Google Scholar

[13]

J. Tao, J. Ma, J. Mayo, C.-K. Shene, and M. Keranen. DESvisual: A Visualization Tool for the DES Cipher. The Journal of Computing Sciences in Colleges, 27(1):81--89, 2011.

Digital Library

Google Scholar

[14]

X. Yuan, Y. Qadah, J. Xu, H. Yu, R. Archer, and B. Chu. An animated learning tool for kerberos authentication architecture. The Journal of Computing Sciences in Colleges, 22(6):147--155, 2007.

Digital Library

Google Scholar

Cited By

View all

Fernandez RCheng PSmith BFenton TBoraey YNhlabatsi AKhan KFetais N(2023)Interactive Graphical Access Control Tools2023 IEEE Symposium on Visual Languages and Human-Centric Computing (VL/HCC)10.1109/VL-HCC57772.2023.00046(255-259)Online publication date: 3-Oct-2023
https://doi.org/10.1109/VL-HCC57772.2023.00046
Fernandez RCheng PNhlabatsi AKhan KFetais N(2023)Effective Collaboration in the Management of Access Control Policies: A Survey of ToolsIEEE Access10.1109/ACCESS.2023.324286311(13929-13947)Online publication date: 2023
https://doi.org/10.1109/ACCESS.2023.3242863
Carr SCheng YHu YMayo JRadwan AShene CWalker JMerkle LDoyle MSheard JSoh LDorn B(2022)Design and Use of a Visualization for Teaching Integer CoercionProceedings of the 53rd ACM Technical Symposium on Computer Science Education - Volume 110.1145/3478431.3499278(794-800)Online publication date: 22-Feb-2022
https://dl.acm.org/doi/10.1145/3478431.3499278
Show More Cited By

Index Terms

MLSvisual: a visualization tool for teaching access control using multi-level security
1. Social and professional topics
  1. Professional topics
    1. Computing education
      1. Computing education programs
        Computer science education
        Information systems education

Recommendations

RBACvisual: A Visualization Tool for Teaching Access Control using Role-based Access Control
ITiCSE '15: Proceedings of the 2015 ACM Conference on Innovation and Technology in Computer Science Education

This paper presents RBACvisual, a user-level visualization tool designed to facilitate the study and teaching of the role-based access control (RBAC) model, which has been widely used in companies to restrict access to authorized users. RBACvisual ...
UNIXvisual: A Visualization Tool for Teaching UNIX Permissions
ITiCSE '17: Proceedings of the 2017 ACM Conference on Innovation and Technology in Computer Science Education

UNIXvisual is a user-level visualization tool designed to facilitate the study and teaching of access control in UNIX. UNIXvisual is aimed at both novice users, who need only to control access to their own files, and students of computer security, who ...
UNIXvisual: A Visualization Tool for Teaching the UNIX Permission Model
ITiCSE '16: Proceedings of the 2016 ACM Conference on Innovation and Technology in Computer Science Education

This paper describes UNIXvisual, which helps students learn access control in UNIX. UNIXvisual is aimed both at novice users, who need only to control access to their own files, and students of computer security, who need a deeper and more comprehensive ...

Comments

Please enable JavaScript to view thecomments powered by Disqus.

Information & Contributors

Information

Published In

ITiCSE '14: Proceedings of the 2014 conference on Innovation & technology in computer science education

June 2014

378 pages

ISBN:9781450328333

DOI:10.1145/2591708

Conference Chairs:
Åsa Cajander
Uppsala University, Sweden
,
Mats Daniels
Uppsala University, Sweden
,
Program Chairs:
Tony Clear
Auckland University of Technology, NZ
,
Arnold Pears
Uppsala University, Sweden

Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 21 June 2014

Permissions

Request permissions for this article.

Request Permissions

Check for updates

Author Tags

Qualifiers

Research-article

Funding Sources

Conference

ITICSE '14

Sponsor:

Bilkent University
SIGCSE

ITICSE '14: Innovation and Technology in Computer Science Education Conference 2014

June 21 - 25, 2014

Uppsala, Sweden

Acceptance Rates

ITiCSE '14 Paper Acceptance Rate 36 of 164 submissions, 22%;

Overall Acceptance Rate 552 of 1,613 submissions, 34%

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

8
Total Citations
View Citations
186
Total Downloads

Downloads (Last 12 months)5
Downloads (Last 6 weeks)0

Reflects downloads up to 21 Nov 2024

Other Metrics

View Author Metrics

Citations

Cited By

View all

Fernandez RCheng PSmith BFenton TBoraey YNhlabatsi AKhan KFetais N(2023)Interactive Graphical Access Control Tools2023 IEEE Symposium on Visual Languages and Human-Centric Computing (VL/HCC)10.1109/VL-HCC57772.2023.00046(255-259)Online publication date: 3-Oct-2023
https://doi.org/10.1109/VL-HCC57772.2023.00046
Fernandez RCheng PNhlabatsi AKhan KFetais N(2023)Effective Collaboration in the Management of Access Control Policies: A Survey of ToolsIEEE Access10.1109/ACCESS.2023.324286311(13929-13947)Online publication date: 2023
https://doi.org/10.1109/ACCESS.2023.3242863
Carr SCheng YHu YMayo JRadwan AShene CWalker JMerkle LDoyle MSheard JSoh LDorn B(2022)Design and Use of a Visualization for Teaching Integer CoercionProceedings of the 53rd ACM Technical Symposium on Computer Science Education - Volume 110.1145/3478431.3499278(794-800)Online publication date: 22-Feb-2022
https://dl.acm.org/doi/10.1145/3478431.3499278
Burska KRusnak VOslejsek R(2021)Enhancing Situational Awareness for Tutors of Cybersecurity Capture the Flag Games2021 25th International Conference Information Visualisation (IV)10.1109/IV53921.2021.00045(235-242)Online publication date: Jul-2021
https://doi.org/10.1109/IV53921.2021.00045
Walker JWang MCarr SMayo JShene CZhang JSherriff MHeckman SCutter PMonge A(2020)A System for Visualizing the Process Address Space in the Context of Teaching Secure Coding in CProceedings of the 51st ACM Technical Symposium on Computer Science Education10.1145/3328778.3366894(1033-1039)Online publication date: 26-Feb-2020
https://dl.acm.org/doi/10.1145/3328778.3366894
Švábenský VVykopal JČeleda PZhang JSherriff MHeckman SCutter PMonge A(2020)What Are Cybersecurity Education Papers About?Proceedings of the 51st ACM Technical Symposium on Computer Science Education10.1145/3328778.3366816(2-8)Online publication date: 26-Feb-2020
https://dl.acm.org/doi/10.1145/3328778.3366816
Walker JWang MCarr SMayo JShene CScharlau BMcDermott RPears ASabin M(2019)Teaching Integer Security Using Simple VisualizationsProceedings of the 2019 ACM Conference on Innovation and Technology in Computer Science Education10.1145/3304221.3319760(513-519)Online publication date: 2-Jul-2019
https://dl.acm.org/doi/10.1145/3304221.3319760
Carr SMayo J(2016)Workshop on teaching modern models of access control hands-onJournal of Computing Sciences in Colleges10.5555/3007225.300723232:1(35-36)Online publication date: 1-Oct-2016
https://dl.acm.org/doi/10.5555/3007225.3007232

View Options

Login options

Check if you have access through your login credentials or your institution to get full access on this article.

Cited By

Index Terms

Recommendations

RBACvisual: A Visualization Tool for Teaching Access Control using Role-based Access Control

UNIXvisual: A Visualization Tool for Teaching UNIX Permissions

UNIXvisual: A Visualization Tool for Teaching the UNIX Permission Model