U.S. flag

An official website of the United States government

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Search Publications

NIST Authors in Bold

Displaying 1301 - 1325 of 1431

Securing Web Servers

September 21, 1999
Author(s)
Peter M. Mell, David F. Ferraiolo
This ITL Bulletin enumerates and describes techniques by which one can secure web servers. It categorizes the techniques into security levels to aid in their cost-effective application.

Object Retrieval and Access Management in Electronic Commerce

September 1, 1999
Author(s)
S A. Wakid, John Barkley, Mark Skall
Electronic commerce over the Internet is now tens of billions of dollars per year and growing. This article describes how objects used in EC can be located and protected from unauthorized access. It discusses the three kinds of EC: customer interactions

The Advanced Encryption Standard: A Status Report

August 25, 1999
Author(s)
Elizabeth B. Lennon
In 1997, the National Institute of Standards and Technology (NIST) initiated a process to select a symmetric-key encryption algorithm to be used to protect sensitive (unclassified) Federal Information, in furtherance of NIST's statutory responsibilities

Enforcing Integrity While Maintaining Secrecy

July 27, 1999
Author(s)
D G. Marks
We consider the role of constraints in maintaining both secrecy and integrity in a multilevel secure database. In a multilevel database, certain integrity and classification constraints create a secrecy problem since data additions, deletions or

Computer Attacks: What They Are and How to Defend Against Them

May 26, 1999
Author(s)
Peter M. Mell
Although a host of technologies exists to detect and prevent attacks against computers, a human must coordinate responding to a successful network penetration. At the same time, the majority of systems administrators are not prepared to handle a

Enhancements to Data Encryption and Digital Signature Federal Standards

March 4, 1999
Author(s)
Elizabeth B. Lennon
This ITL Bulletin, February 1999, summarizes proposed changes to two Federal Information Processing Standards (FIPS): FIPS 46-2, Data Encryption Standard, and FIPS 186, Digital Signature Standard. It outlines the proposed enhancements to the two standards

Secure Web-Based Access to High-Performance Computing Resources

January 15, 1999
Author(s)
R P. McCormack, J E. Koontz, J E. Devaney
An authentication framework is described that provides a secure meansor clients to access remote computing resources via the Web. Clientsauthenticate themselves to a proxy Web server using a secure protocoland a digital certificate. The server constructs a

Common Criteria: Launching the International Standards

November 25, 1998
Author(s)
E F. Troy
This Information Technology Laboratory (ITL) Bulletin provides an introduction and overview of the Common Criteria (CC) for Information Technology (IT) Security and describes its US and multi-national implementation. The CC is the new standard for

Role-Based Access Control for the Web

October 29, 1998
Author(s)
John Barkley, David R. Kuhn, Lynne S. Rosenthal, Mark Skall, Anthony V. Cincotta
Establishing and maintaining a presence on the World Wide Web (Web), once a sideline for U.S. industry, has become a key strategic aspect of marketing and sales. Many companies have demonstrated that a well designed Web site can have a positive effect on

Managing Role/Permission Relationships Using Object Access Types

October 23, 1998
Author(s)
John Barkley, Anthony V. Cincotta
The role metaphor in Role Based Access Control (RBAC) is particularly powerful in its ability to express access policy in terms of the way in which administrators view organizations. Much of the effort in providing administrative tools for RBAC has been

Role Based Access Control on MLS Systems Without Kernel Changes

October 23, 1998
Author(s)
David R. Kuhn
Role based access control (RBAC) is attracting increasing attention as a security mechanism for both commercial and many military systems. This paper shows how RBAC can be implemented using the mechanisms available on traditional multi-level security

Inheritance Properties of Role Hierarchies

October 9, 1998
Author(s)
Wayne Jansen
Role Based Access Control (RBAC) refers to a class of security mechanisms that mediate access to resources through organizational identities called roles. A number of models have been published that formally describe the basic properties of RBAC. One

Role-Based Access Control Features in Commercial Database Management Systems

October 9, 1998
Author(s)
Ramaswamy Chandramouli, R. Sandhu
This paper analyzes and compares role-based access control (RBAC) features supported in the most recent versions of three popular commercial database management systems: Informix Online Dynamic Server Version 7.2, Oracle Enterprise Server Version 8.0 and

Cryptography Standards and Infrastructures for the Twenty-First Century

September 17, 1998
Author(s)
Shirley M. Radack
This bulletin reports on the progress being made by NIST and by its government and industry partners to advance the development of electronic commerce systems in which users will have confidence. There are efforts underway to update existing standards for

A Revised Model for Role-Based Access Control

July 9, 1998
Author(s)
Wayne Jansen
Role Based Access Control (RBAC) refers to a class of security mechanisms that mediate access to resources through organizational identities called roles. A number of models have been published that formally describe the basic properties of RBAC. This

A Federal Public Key Infrastructure With Multiple Digital Signature Algorithms

April 22, 1998
Author(s)
William E. Burr, William T. Polk
Several digital algorithms are coming into general use. A certificate containing a key for one algorithm can be signed with a different algorithm. This paper discusses the interoperability issues where different digital signature algorithms are used in one
Displaying 1301 - 1325 of 1431