Producing hook placements to enforce expected access control policies

Divya Muthukumaran, Nirupama Talele, Trent Jaeger, Gang Tan

Research output: Chapter in Book/Report/Conference proceedingConference contribution

4 Scopus citations

Abstract

Many security-sensitive programs manage resources on behalf of mutually distrusting clients. To control access to resources, authorization hooks are placed before operations on those resources. Manual hook placements by programmers are often incomplete or incorrect, leading to insecure programs. We advocate an approach that automatically identifies the set of locations to place authorization hooks that mediates all security-sensitive operations in order to enforce expected access control policies at deployment. However, one challenge is that programmers often want to minimize the effort of writing such policies. As a result, they may remove authorization hooks that they believe are unnecessary, but they may remove too many hooks, preventing the enforcement of some desirable access control policies. In this paper, we propose algorithms that automatically compute a minimal authorization hook placement that satisfies constraints that describe desirable access control policies. These authorization constraints reduce the space of enforceable access control policies; i.e., those policies that can be enforced given a hook placement that satisfies the constraints.We have built a tool that implements this authorization hook placement method, demonstrating how programmers can produce authorization hooks for real-world programs and leverage policy goalspecific constraint selectors to automatically identify many authorization constraints. Our experiments show that our technique reduces manual programmer effort by as much as 58% and produces placements that reduce the amount of policy specification by as much as 30%.

Original languageEnglish (US)
Title of host publicationEngineering Secure Software and Systems - 7th International Symposium, ESSoS 2015, Proceedings
EditorsFrank Piessens, Juan Caballero, Nataliia Bielova
PublisherSpringer Verlag
Pages178-195
Number of pages18
ISBN (Electronic)9783319156170
DOIs
StatePublished - 2015
Event7th International Symposium on Engineering Secure Software and Systems, ESSoS 2015 - Milan, Italy
Duration: Mar 4 2015Mar 6 2015

Publication series

NameLecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume8978
ISSN (Print)0302-9743
ISSN (Electronic)1611-3349

Other

Other7th International Symposium on Engineering Secure Software and Systems, ESSoS 2015
CountryItaly
CityMilan
Period3/4/153/6/15

All Science Journal Classification (ASJC) codes

  • Theoretical Computer Science
  • Computer Science(all)

Fingerprint Dive into the research topics of 'Producing hook placements to enforce expected access control policies'. Together they form a unique fingerprint.

Cite this