Anderson Santana de Oliveira

SAP Network Blog: Security Vulnerabilities Detection and Protection Using Eclipse

andersonsantana — Wed, 14 Dec 2011 09:29:09 +0000

In an effort to bring back this blog to life, I would like to share with you the outstanding work from Gabriel Serme together with Paul el Khoury and Marco Guarnieri. Gabriel is a PhD candidate at SAP research working with me on the CESSA Project. He delevopped a tool to detect and to correct in a semi-automated manner web application vulnerabilities using aspect-oriented programming.
Plese check his blog post for more details:

http://weblogs.sdn.sap.com/pub/wlg/26610.

Evolving Security Requirements in Multi-Layered Service-Oriented-Architectures

andersonsantana — Tue, 13 Dec 2011 16:44:00 +0000

This post is about a paper we presented at SETOP 2011.
It basicaly presents the vision of the CESSA project.

Authors: Muhammad Sabir Idrees, Gabriel Serme, Yves Roudier, Anderson Santana De Oliveira, Herve GrallMario Sudholt

Here is the abstract:
Due to today’s rapidly changing corporate environments, business processes are increasingly subject to dynamic configuration and
evolution. The evolution of new deployment architectures, as illustrated by the move towards mobile platforms and the Internet Of Services, and the introduction of new security regulations(imposed by national and international regulatory bodies, such as
SOX(Sarbanes-Oxley Act of 2002 (Pub.L. 107-204, 116 Stat. 745, enacted July 30, 2002) or BASEL are an important constraint in the design and development of business processes.
In such a context, it is not sufficient to apply the corresponding adaptations only at the service orchestration or at the
choreography level; there is also the need for controlling the impact of new security requirements to several architectural
layers, specially in cloud computing, where the notion of Platforms as Services and Infrastructure as Services are fundamental. In this paper we survey several research questions related to security cross-domain and cross-layer security
functionality in Service Oriented Architectures, from an original point of view.

We provide the first insights on how a general service model empowered with aspect oriented programming capabilities can provide clean modularization to such cross-cutting security concerns.

Colibri 09 presentations

andersonsantana — Wed, 29 Jul 2009 09:41:37 +0000

Below you may find the slides for the talks I have given at the Colibri colloquium:

Automating model-based software engineering
David Déharbe (UFRN), Pascal Fontaine (LORIA), Stephan Merz (LORIA), Anamaria Martins Moreira (UFRN), Anderson Santana de Oliveira (UFERSA)

Vérification automatique des systèmes à base de règles avec le narrowing stratégique
Anderson Santana de Oliveira (UFERSA), David Déharbe (UFRN), Pierre-Etienne Moreau (INRIA)

18th International Workshop on Functional and (Constraint) Logic Programming WFLP’09

andersonsantana — Sat, 04 Apr 2009 02:34:36 +0000

I am part of the program commitee for WFLP 2009, the 18th International Workshop on Functional and (Constraint) Logic Programming, part of RDP’09 which will take place in Brasilia.

Novo concurso para Ciências da Computação na UFERSA

andersonsantana — Mon, 09 Mar 2009 20:26:53 +0000

A Universidade Federal Rural do Semi-Árido, UFERSA, da qual faço parte hoje, abriu inscrições para 5 vagas para professor adjunto com dedicação exclusiva para o curso de Ciências da Computação. O requisito é formação em computação e áreas afins. O diploma de doutorado deve ser apresentado somente no ato da posse, portanto, se você está prestes a defender a tese, esta é uma excelente oportunidade. Um atrativo é o programa de mestrado em cooperação ampla com a Universidade do Estado do Rio Grande do Norte, UERN.

Confira o edital em: http://www.ufersa.edu.br/concursos/

Faculty Position at UFRN, Natal Brazil

andersonsantana — Wed, 22 Oct 2008 23:41:14 +0000

The Federal University of Rio Grande do Norte has opened a permanent
Faculty Position in the area of “Integrated Circuits Design”.
Prospective candidates are invited to visit
“http://www.dimap.ufrn.br/concurso2008″ for details about the
application procedure. All information is in Portuguese as this is the
working language in our Institution.

We will be receiving application until November 7th, 2008. Gross
salary starts at BR$6.497,15.

Recent papers

andersonsantana — Wed, 09 Jul 2008 17:20:11 +0000

I have participated in two papers that were presented at SecRet 2008:

Claude Kirchner, Hélène Kirchner and Anderson Santana de Oliveira – Analysis of Rewrite-Based Access Control Policies

The rewrite-based approach provides executable specifications for security policies, which can be independently designed, verified, and then anchored on programs using a modular discipline. In this paper, we describe how to perform queries over these rule-based policies in order to increase the trust of the policy author on the correct behavior of the policy. The analysis we provide is founded on the narrowing process, which provides both the necessary abstraction for simulating executions of the policy over access requests and the
mechanism for solving what-if queries from the security administrator. We illustrate this general approach by the analysis of a firewall system policy.
Horatiu Cirstea, Pierre-Etienne Moreau and Anderson Santana de Oliveira – Rewrite Based Specification of Access Control Policies

Data protection within information systems is one of the main concerns in computer systems security and different access control policies can be used to specify the access requests that should be granted or denied. These access control mechanisms should guarantee that
information can be accessed only by authorized users and thus prevent all information leakage. We propose a methodology for specifying and implementing access control policies using the rewrite based framework Tom. This approach allows us to check that any reachable state
obtained following an access granted in the implementation satisfies the policy specification. We show that when security levels are not totally ordered some information leakage can be detected.

Phd Thesis

andersonsantana — Mon, 24 Mar 2008 15:40:39 +0000

My thesis defense will be on March 31st, in LORIA. For more information about the thesis check this page: http://andersonsantana.wordpress.com/thesis-manuscript/

FMSE’07 presentation slides

andersonsantana — Sun, 04 Nov 2007 02:41:47 +0000

The file below contain the slides of my talk at the FMSE workshop.

FMSE’07 slides

Phd opportunity in Nancy, France

andersonsantana — Mon, 08 Oct 2007 09:40:17 +0000

We are looking for candidates for a phd on the following subject:

Specification and Verification of Access Control Policies

click on the link above for more information.