Automated Security Analysis of Authorization Policies with Contextual Information
Role-Based Access Control (RBAC) has made great attention in the security community and is widely deployed in the enterprise as a major tool to manage security and restrict system access to unauthorized users. As the RBAC model evolves to meet enterprise requirements, the RBAC policies will become complex and need to be managed by multiple collaborative administrators. The collaborative administrator may interact unintendedly with the policies, creates the undesired effect to the security requirements of the enterprise. Consequently, researchers have studied various safety analyzing techniques that are useful to prevent such issues in RBAC, especially with the Administrative Role-Based Access Control (ARBAC97). For critical applications, several extensions of RBAC, such as Spatial-Temporal Role-Based Access Control (STRBAC), are being adopted in recent years to enhance the security of an application on authorization with contextual information such as time and space. The features, which proposed in STRBAC for collaborative administrators, may interact in subtle ways that violate the original security requirements. However, the analysis of it has not been considered in the literature.
In this research, we consider the security analysis technique for the extension of STRBAC, named Administrative STRBAC (ASTRBAC), and illustrate the safety analysis technique to detect and report the violation of the security requirements. This technique leverages First-Order Logic and Symbolic Model Checking (SMT) by translating the policies to decidable reachability problems, which are essential to understand the security policies and inform policies designer using this model to take appropriate actions. Our extensive experimental evaluation demonstrates the correctness of our proposed solutions in practice, which supports finite ASTRBAC policies analysis without prior knowledge about the number of users in the system.
KeywordsComputer security Security analysis Access control Role-Based Access Control Spatial-Temporal Role-Based Access Control
This research is funded by Vietnam National University HoChiMinh City (VNU-HCM) under grant number C2018-20-10.
- 2.National Computer Security Center (NCSC): A guide to understanding discretionary access control in trusted system, Report NSCD-TG-003 Version1, 30 September 1987Google Scholar
- 3.Osborn, S.: Mandatory access control and role-based access control revisited. In: Proceedings of the 2nd ACM Workshop on Role-Based Access Control, RBAC 1997, pp 31–40. ACM (1997)Google Scholar
- 5.Ferraiolo, D., Kuhn, R.: Role-based access control. In: 15th NIST-NCSC National Computer Security Conference, pp. 554–563, October 1992Google Scholar
- 6.Sandhu, R., Ferraiolo, D., Kuhn, R.: The NIST model for role-based access control: toward a unified standard. In: 5th ACM Workshop Role-Based Access Control, pp. 47–63, July 2000Google Scholar
- 8.Kumar, M., Newman, R.: STRBAC - an approach towards spatiotemporal role-based access control. In: Proceedings of the Third IASTED International Conference on Communication Network and Information Security CNIS, pp. 150–155 (2006)Google Scholar
- 10.Li, N., Tripunitara, M.: Security analysis in role-based access control. In: The Proceedings of ACM Symposium on Access Control Models and Technologies, pp. 126–135. ACM Press (2004)Google Scholar
- 11.Jha, S., Li, N., Tripunitara, M., Wang, Q., Winsborough, H.: Towards formal verification of role-based access control policies. IEEE TDSC 5(4), 242–255 (2008)Google Scholar
- 12.Gofman, M.I., Luo, R., Solomon, Ayla C., Zhang, Y., Yang, P., Stoller, S.D.: RBAC-PAT: a policy analysis tool for role based access control. In: Kowalewski, S., Philippou, A. (eds.) TACAS 2009. LNCS, vol. 5505, pp. 46–49. Springer, Heidelberg (2009). https://doi.org/10.1007/978-3-642-00768-2_4CrossRefGoogle Scholar
- 15.Ranise, S., Truong, A., Vigano, L.: Automated analysis of RBAC policies with temporal constraints and static role hierarchies. In: the Proceeding of the 30th ACM Symposium on Applied Computing (SAC15), pp. 2177–2184. ACM (2015)Google Scholar
- 16.Ranise, S., Truong, A., Armando, A.: Scalable and precise automated analysis of administrative temporal role-based access control. In: Proceedings of the 19th ACM Symposium on Access Control Models and Technologies, pp. 103–114. ACM (2014) Google Scholar
- 22.Kumar, M., Newman, R.: STRBAC - an approach towards spatio-temporal role-based access control. In: Communication, Network, and Information Security, pp. 150–155 (2006)Google Scholar
- 23.Aich, S., Mondal, S., Sural, S., Majumdar, A.K.: Role based access control with spatiotemporal context for mobile applications. In: Gavrilova, M.L., Tan, C.J.K., Moreno, E.D. (eds.) Transactions on Computational Science IV. LNCS, vol. 5430, pp. 177–199. Springer, Heidelberg (2009). https://doi.org/10.1007/978-3-642-01004-0_10CrossRefGoogle Scholar
- 24.Uzun, E., Atluri, V., Sural, S., Vaidya, J., Parlato, G., Ferrara, A.: Analyzing temporal role-based access control models. In: SACMAT, pp. 177–186. ACM (2012)Google Scholar
- 29.Sasturkar, A., Yang, A., Stoller, S., Ramakrishnan, C.: Policy analysis for administrative role-based access control. In: 19th IEEE Computer Security Foundations Workshop, pp. 124–138 (2006)Google Scholar
- 30.Dinh, K.K.Q., Tran, T.D., Truong, A.: Security analysis of administrative role-based access control policies with contextual information. In: Dang, T.K., Wagner, R., Küng, J., Thoai, N., Takizawa, M., Neuhold, E.J. (eds.) FDSE 2017. LNCS, vol. 10646, pp. 243–261. Springer, Cham (2017). https://doi.org/10.1007/978-3-319-70004-5_17CrossRefGoogle Scholar