The Ninth International World Wide Web Conference (WWW9)
May 15-19, 2000 Amsterdam
Review by Mary Ellen Zurko
The Ninth International World Wide Web Conference (WWW9) was held on May 15-19, in Amsterdam. There were a number of activities of interest to Cipher readers, which I'll mention. I will only provide some detail on the refereed paper sessions on Security and ECommerce, which I attended.
On tutorial day, Avi Rubin gave the "Web Security" tutorial, Ricarda Weber gave the "Digital Payment Systems" tutorial, and Lorrie Faith Cranor gave one on "Internet Privacy and P3P". I opted for a Web area that was totally new to me, and went to an excellent full day tutorial by Ken Holman called "An Introduction to XSLT and XPath".
During the 3 main conference days, there were plenaries, and tracks for refereed papers, W3C reports, panels, and 3 special tracks; Culture, Web and Industry, and Web/Internet and Society. A theme running through the conference was Mobile Web, with at least 3 keynotes, 1 plenary panel, 1 refereed paper session, 2 Web and Industry track sessions and several posters. Best paper was awarded to "Graph structure in the Web" by 8 authors from 3 companies (AltaVista, IBM, and Compaq).
The W3C track has a session on "Building a `Web of Trust'" with talks on XML Signature, P3P -The Platform for Privacy Preferences, and Semantic Web Initiative. There was an "IPR Protection" session in the Culture track, with talks on "Digital Watermarking: A Solution to Electronic Copyright Management Systems Requirements" (Alessandro Piva, Universita' di Firenze Dip. Elettronica e Telecommunicazioni, Italy), "Copy Left UNESCO OCCAM Point of View" (Pier Paolo Saporito, UNESCO OCCAM Coordinatore Generale, Italy), "Digital Watermarking of 3D Models" (Jian Zhao, Fraunhofer Center for Research in Computer Graphics, USA) and "Copyright Limitation for Art On-line" (Christiaan A. Alberdingk Thijm, Institute for Information Law, Univeristy of Amsterdam, The Netherlands). "WAP Security Schemes in Today's Internet Environment" (Espen Kristensen, Ericsson) was part of the Mobile Web sessions in the Web and Industry Track. There was a panel on "The Role of Informational Property Rights in Digital Architecture" with Brian Fitzgerald (Southern Cross University), Bernt Hugenholtz (Institute for Information Law, University of Amsterdam), and Leif Gamertsfleder (Deacons Lawyers). There were posters on "Auditing Web Sites Using Their Access Patterns" and "Developing a Model of Trust for Electronic Commerce: An Application to a Permissive Marketing Web Site". In the Semantic Web Infrastructure session on Developer's Day, Dan Connolly of W3C presented "Specifying Web Architecture with Larch". He is currently using Larch to develop a formal specification to be used to determine if a Web page should be considered a trustworthy authority on a particular topic, and he hopes to have it in about 3 months.
The first paper in the Security session (chaired by Lorrie Faith Cranor) was "Risks of the Passport Single Signon Protocol" by David Kormann and Aviel Rubin. Avi presented. Avi motivated the need for single signon with examples of the sorts of places passwords are being used on the web. Then he discussed how Passport works. Sites using a Passport server for authentication will redirect unauthenticated requests to their passport server. If the browser does not have a cookie for that passport server, it will provide a login page and send the cookie to the browser when the user authenticates. If/when the user is successfully authenticated (via the login page or a preexisting cookie) the server will redirect the browser back to the original site, with tokens in the header indicating the request is authenticated. The original site will then send its own cookie to the browser, to eliminate any further redirections in that session. Avi discussed a bug that they had discovered where logging out of Passport did not actually do so (with a Netscape browser). He also discussed key management issues, which are underspecified in the available Microsoft white paper. A number of other attacks are outlined in the paper. During the question session, Avi was asked what his recommendation would be, and he indicated that Kerberos has a good track record, but requires unKerberized sites to get new software.
The next paper was "Design and Implementation of an Access Control Processor for XML Documents" by Ernesto Damiani, Sabrina De Capitani di Vimercati, Stefano Paraboschi, and Pierangela Samarati. Sabrina presented. The group has implemented a model of access control tied to XML schema and documents (presently only on the read action). Access control information can be applied to collections of documents or instances, and on elements/attributes. Exceptions (using denials) and overrides (hard and soft statements) are also supported. Access control information is determined via a process of parsing the XML document, labeling the parsed tree with access control information from the parse and the DTD, pruning the tree based on exceptions and overrides, and unparsing the tree to apply it to the document. Questions centered on implementation issues such as performance.
The last paper of the session was "Supporting Reconfigurable Security Policies for Mobile Programs" by Brant Hashii, Scott Malabarba, Raju Pandey, and Matt Bishop. Brant presented. He began by motivating the need for mobile code security, citing the recent ILOVEYOU bug. The security model they have implemented is built around an event/response mechanism, which allows a response (currently deny or audit) to be executed whenever a security-related event is recognized by their JVM. Programmers can extend the recognized events and the response types. Their principals are methods, classes, or groups of classes. Policy can be altered dynamically, to respond to internal changes or new threats. Brant presented the performance results of the benchmarks they ran.
The first paper in the E-Commerce session (chaired by Christine Vanoirbeek) was "An Entropy Approach to Unintrusive Targeted Advertising on the Web" by John Tomlin. Because of the math, this was a hard paper to present, and John did an excellent job getting the concepts across (which I am not able to do justice to). His work extends a linear programming approach to unintrusive customizing techniques. It divides users into buckets and ads into types, while keeping advertisers discreet. It uses nonlinear terms to "more or less evenly distrbut[e] the ads between groups of users" with a "bias toward the group(s) with the higher click-through probability".
The second paper was "A Web marketing System with Automatic Pricing" by Naoki Abe and Tomonari Kamba. Naoki presented. Their system will automatically set the best sales prices based on past prices and sales. Item category, and initial and minimum prices are specified for each item. Their algorithms have a goal of maximizing total revenue over all items. They tested algorithms based on stochastic approximation and linear approximation, They did preliminary evaluation on simulated data, where the algorithms converged on an optimal price. The questions after the presentation centered on user acceptance of the notion of automatic pricing, and were quite spirited.
The last paper of the session was "MicroISPs: Providing Convenient and Low-Cost High-Bandwidth Internet Access" By Jose Brustoloni and Juan Garay. Jose presented. The architecture is targeted at ISPs providing internet access at installations such as airports and conference centers. MicroISPs connect their LAN to conventional ISPs via a router. The architecture supports both online and offline charging of the users by the MicroISP. It uses IPSec's IKE for exchange of authentication keys with the paying users. It uses IPSec's AH to authenticate packets, so that non-paying packets can be detected and dropped. The architecture requires MicroISPs to be certified by an authority trusted by the user (thus the user must bring some notion of which authorities they trust with them, in some form), while users certificates can be self-signed (as payment is assumed to be the most important issue for the MicroISP). Encryption of information is optional, as sufficient protection may be occurring at some other level (such as a corporate VPN).
May 22, 2000.