Deploy, Adjust and Readjust: Supporting Dynamic Reconfiguration of Policy Enforcement

  • Gabriela Gheorghe
  • Bruno Crispo
  • Roberto Carbone
  • Lieven Desmet
  • Wouter Joosen
Part of the Lecture Notes in Computer Science book series (LNCS, volume 7049)

Abstract

For large distributed applications, security and performance are two requirements often difficult to satisfy together. Addressing them separately leads more often to fast systems with security holes, rather than secure systems with poor performance. For instance, caching data needed for security decisions can lead to security violations when the data changes faster than the cache can refresh it. Retrieving such fresh data without caching it impacts performance. In this paper, we analyze a subproblem: how to dynamically configure a distributed authorization system when both security and performance requirements change. We examine data caching, retrieval and correlation, and propose a runtime management tool that, with external input, finds and enacts the customizations that satisfy both security and performance needs. Preliminary results show it takes around two seconds to find customization solutions in a setting with over one thousand authorization components.

Keywords

configuration policy enforcement middleware cache 

References

  1. 1.
    Globus Alliance: Globus Toolkit 4 API (November 2010), http://www.globus.org/toolkit/docs/4.2/4.2.1/security/
  2. 2.
    Atluri, V., Gal, A.: An authorization model for temporal and derived data: securing information portals. ACM Trans. Inf. Syst. Secur. 5, 62–94 (2002)CrossRefGoogle Scholar
  3. 3.
    Axiomatics: Axiomatics Policy Server 4.0 (November 2010), http://www.axiomatics.com/products/axiomatics-policy-server.html
  4. 4.
    Chadwick, D., Zhao, G., Otenko, S., Laborde, R., Su, L., Nguyen, T.A.: PERMIS: a modular authorization infrastructure. Concurr. Comput.: Pract. Exper. 20, 1341–1357 (2008)CrossRefGoogle Scholar
  5. 5.
    Chadwick, D.W., Su, L., Laborde, R.: Coordinating access control in grid services. Concurrency and Computation: Practice and Experience 20(9), 1071–1094 (2008)CrossRefGoogle Scholar
  6. 6.
    Colombo, M., Lazouski, A., Martinelli, F., Mori, P.: A Proposal on Enhancing XACML with Continuous Usage Control Features. In: Grids, P2P and Services Computing, pp. 133–146. Springer, US (2010)CrossRefGoogle Scholar
  7. 7.
    Djordjevic, I., Dimitrakos, T.: A note on the anatomy of federation. BT Technology Journal 23, 89–106 (2005)CrossRefGoogle Scholar
  8. 8.
    Dulay, N., Lupu, E., Sloman, M., Damianou, N.: A policy deployment model for the ponder language. In: 2001 IEEE/IFIP International Symposium on Integrated Network Management Proceedings, pp. 529–543 (2001)Google Scholar
  9. 9.
    Frisch, A.M., Peugniez, T.J., Doggett, A.J., Nightingale, P.W.: Solving non-boolean satisfiability problems with stochastic local search: A comparison of encodings. J. Autom. Reason. 35, 143–179 (2005)CrossRefMATHMathSciNetGoogle Scholar
  10. 10.
    Gebel, G., Peterson, G.: Authentication and TOCTOU (2011), http://analyzingidentity.com/2011/03/18/
  11. 11.
    Gheorghe, G., Neuhaus, S., Crispo, B.: xESB: An Enterprise Service Bus for Access and Usage Control Policy Enforcement. In: Nishigaki, M., Jøsang, A., Murayama, Y., Marsh, S. (eds.) IFIPTM 2010. IFIP AICT, vol. 321, pp. 63–78. Springer, Heidelberg (2010)CrossRefGoogle Scholar
  12. 12.
    Goovaerts, T., Desmet, L., Joosen, W.: Scalable Authorization Middleware for Service Oriented Architectures. In: Erlingsson, Ú., Wieringa, R., Zannone, N. (eds.) ESSoS 2011. LNCS, vol. 6542, pp. 221–233. Springer, Heidelberg (2011)CrossRefGoogle Scholar
  13. 13.
    IBM: IBM Tivoli Access Manager (November 2010), http://www-01.ibm.com/software/tivoli/products/access-mgr-e-bus/
  14. 14.
    Internet2MiddlewareInitiative/MACE: Shibboleth 2 (2011), https://wiki.shibboleth.net/confluence/display/SHIB2/Home
  15. 15.
    Ioannidis, S., Bellovin, S.M., Ioannidis, J., Keromytis, A.D., Anagnostakis, K.G., Smith, J.M.: Virtual private services: Coordinated policy enforcement for distributed applications. I. J. Network Security 4(1), 69–80 (2007)Google Scholar
  16. 16.
    Kassaei, F.: eBay Identity Assertion Framework (May 2010), http://www.slideshare.net/farhangkassaei/ebay-identity-assertion-framework-iaf
  17. 17.
    Kerner, S.M.: Inside Facebook’s Open Source Infrastructure (July 2010), http://www.developer.com/open/article.php/3894566/
  18. 18.
    Knuth, D.E.: The art of computer programming, vol. 2. Addison-Wesley Longman Publishing Co., Inc., Boston (1997)Google Scholar
  19. 19.
    Layer 7 Technologies: Policy Manager for XML Gateways (November 2010), http://www.layer7tech.com/products/policy-manager-for-xml-gatewaysl
  20. 20.
    Miller, R.: The Facebook Data Center FAQ (September 2010), http://www.datacenterknowledge.com/the-facebook-data-center-faq/
  21. 21.
    Mitre: Common Vulnerabilities and Exposures (2011), http://cve.mitre.org/
  22. 22.
    Shoup, R.: Scalability best practices - Lessons from eBay. InfoQ (May 2008), http://www.infoq.com/articles/ebay-scalability-best-practices
  23. 23.
    Shoup, R.: More Best Practices from Large Scale Websites - Lessons from eBay. Talk at QCon San Francisco (November 2010), http://qconsf.com/sf2010
  24. 24.
    Wei, D., Jiang, C.: Frontend Performance Engineering in Facebook. In: O’Reilly Velocity, Web Performance and Operations Conference (June 2009)Google Scholar
  25. 25.
    Wei, Q.: Towards Improving the Availability and Performance of Enterprise Authorization Systems. Ph.D. thesis, University of British Columbia (2009)Google Scholar

Copyright information

© IFIP International Federation for Information Processing 2011

Authors and Affiliations

  • Gabriela Gheorghe
    • 1
  • Bruno Crispo
    • 1
  • Roberto Carbone
    • 2
  • Lieven Desmet
    • 3
  • Wouter Joosen
    • 3
  1. 1.DISIUniversità degli Studi di TrentoItaly
  2. 2.Security and Trust UnitFBKTrentoItaly
  3. 3.IBBT-DistrinetK.U. LeuvenLeuvenBelgium

Personalised recommendations