Maintaining Authorization Hook Placements Across Program Versions

Nirupama Talele, Divya Muthukumaran, Frank Capobianco, Trent Ray Jaeger, Gang Tan

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Abstract

We examine the problem of maintaining security code across program versions. There are now several cases where programmers manually retrofit their programs with security code, such as authorization mechanisms. However, programs evolve, so a challenge for programmers is to determine whether their security code remains correct across multiple versions of the program. The insight of this work is that programmers can use the constraints on the authorization policies that can be enforced in one version of the program to limit their effort in validating authorization hook placements in later versions. We develop a tool we call HEIMDAL to implement this insight, finding that a modest number of authorization constraints require review across several versions of the X window server program.

Original languageEnglish (US)
Title of host publicationProceedings - 2016 IEEE Cybersecurity Development, SecDev 2016
PublisherInstitute of Electrical and Electronics Engineers Inc.
Pages67-68
Number of pages2
ISBN (Electronic)9781509055883
DOIs
StatePublished - Feb 1 2017
Event2016 IEEE Cybersecurity Development, SecDev 2016 - Boston, United States
Duration: Nov 3 2016Nov 4 2016

Publication series

NameProceedings - 2016 IEEE Cybersecurity Development, SecDev 2016

Other

Other2016 IEEE Cybersecurity Development, SecDev 2016
CountryUnited States
CityBoston
Period11/3/1611/4/16

Fingerprint

Hooks
Servers

All Science Journal Classification (ASJC) codes

  • Computer Networks and Communications
  • Software
  • Safety, Risk, Reliability and Quality

Cite this

Talele, N., Muthukumaran, D., Capobianco, F., Jaeger, T. R., & Tan, G. (2017). Maintaining Authorization Hook Placements Across Program Versions. In Proceedings - 2016 IEEE Cybersecurity Development, SecDev 2016 (pp. 67-68). [7839793] (Proceedings - 2016 IEEE Cybersecurity Development, SecDev 2016). Institute of Electrical and Electronics Engineers Inc.. https://doi.org/10.1109/SecDev.2016.024
Talele, Nirupama ; Muthukumaran, Divya ; Capobianco, Frank ; Jaeger, Trent Ray ; Tan, Gang. / Maintaining Authorization Hook Placements Across Program Versions. Proceedings - 2016 IEEE Cybersecurity Development, SecDev 2016. Institute of Electrical and Electronics Engineers Inc., 2017. pp. 67-68 (Proceedings - 2016 IEEE Cybersecurity Development, SecDev 2016).
@inproceedings{c68b5fbecd494ee0ae8df6532250b168,
title = "Maintaining Authorization Hook Placements Across Program Versions",
abstract = "We examine the problem of maintaining security code across program versions. There are now several cases where programmers manually retrofit their programs with security code, such as authorization mechanisms. However, programs evolve, so a challenge for programmers is to determine whether their security code remains correct across multiple versions of the program. The insight of this work is that programmers can use the constraints on the authorization policies that can be enforced in one version of the program to limit their effort in validating authorization hook placements in later versions. We develop a tool we call HEIMDAL to implement this insight, finding that a modest number of authorization constraints require review across several versions of the X window server program.",
author = "Nirupama Talele and Divya Muthukumaran and Frank Capobianco and Jaeger, {Trent Ray} and Gang Tan",
year = "2017",
month = "2",
day = "1",
doi = "10.1109/SecDev.2016.024",
language = "English (US)",
series = "Proceedings - 2016 IEEE Cybersecurity Development, SecDev 2016",
publisher = "Institute of Electrical and Electronics Engineers Inc.",
pages = "67--68",
booktitle = "Proceedings - 2016 IEEE Cybersecurity Development, SecDev 2016",
address = "United States",

}

Talele, N, Muthukumaran, D, Capobianco, F, Jaeger, TR & Tan, G 2017, Maintaining Authorization Hook Placements Across Program Versions. in Proceedings - 2016 IEEE Cybersecurity Development, SecDev 2016., 7839793, Proceedings - 2016 IEEE Cybersecurity Development, SecDev 2016, Institute of Electrical and Electronics Engineers Inc., pp. 67-68, 2016 IEEE Cybersecurity Development, SecDev 2016, Boston, United States, 11/3/16. https://doi.org/10.1109/SecDev.2016.024

Maintaining Authorization Hook Placements Across Program Versions. / Talele, Nirupama; Muthukumaran, Divya; Capobianco, Frank; Jaeger, Trent Ray; Tan, Gang.

Proceedings - 2016 IEEE Cybersecurity Development, SecDev 2016. Institute of Electrical and Electronics Engineers Inc., 2017. p. 67-68 7839793 (Proceedings - 2016 IEEE Cybersecurity Development, SecDev 2016).

Research output: Chapter in Book/Report/Conference proceedingConference contribution

TY - GEN

T1 - Maintaining Authorization Hook Placements Across Program Versions

AU - Talele, Nirupama

AU - Muthukumaran, Divya

AU - Capobianco, Frank

AU - Jaeger, Trent Ray

AU - Tan, Gang

PY - 2017/2/1

Y1 - 2017/2/1

N2 - We examine the problem of maintaining security code across program versions. There are now several cases where programmers manually retrofit their programs with security code, such as authorization mechanisms. However, programs evolve, so a challenge for programmers is to determine whether their security code remains correct across multiple versions of the program. The insight of this work is that programmers can use the constraints on the authorization policies that can be enforced in one version of the program to limit their effort in validating authorization hook placements in later versions. We develop a tool we call HEIMDAL to implement this insight, finding that a modest number of authorization constraints require review across several versions of the X window server program.

AB - We examine the problem of maintaining security code across program versions. There are now several cases where programmers manually retrofit their programs with security code, such as authorization mechanisms. However, programs evolve, so a challenge for programmers is to determine whether their security code remains correct across multiple versions of the program. The insight of this work is that programmers can use the constraints on the authorization policies that can be enforced in one version of the program to limit their effort in validating authorization hook placements in later versions. We develop a tool we call HEIMDAL to implement this insight, finding that a modest number of authorization constraints require review across several versions of the X window server program.

UR - http://www.scopus.com/inward/record.url?scp=85015232041&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=85015232041&partnerID=8YFLogxK

U2 - 10.1109/SecDev.2016.024

DO - 10.1109/SecDev.2016.024

M3 - Conference contribution

T3 - Proceedings - 2016 IEEE Cybersecurity Development, SecDev 2016

SP - 67

EP - 68

BT - Proceedings - 2016 IEEE Cybersecurity Development, SecDev 2016

PB - Institute of Electrical and Electronics Engineers Inc.

ER -

Talele N, Muthukumaran D, Capobianco F, Jaeger TR, Tan G. Maintaining Authorization Hook Placements Across Program Versions. In Proceedings - 2016 IEEE Cybersecurity Development, SecDev 2016. Institute of Electrical and Electronics Engineers Inc. 2017. p. 67-68. 7839793. (Proceedings - 2016 IEEE Cybersecurity Development, SecDev 2016). https://doi.org/10.1109/SecDev.2016.024