Francesco Alberti
ABSTRACT
Automated techniques for the security analysis of Role-Based Access Control (RBAC) access control policies are crucial for their design and maintenance. The definition of administrative domains by means of attributes attached to users makes the RBAC model easier to use in real scenarios but complicates the development of security analysis techniques, that should be able to modularly reason about a wide range of attribute domains. In this paper, we describe an automated symbolic security analysis technique for administrative attribute-based RBAC policies. A class of formulae of first-order logic is used as an adequate symbolic representation for the policies and their administrative actions. State-of-the-art automated theorem proving techniques are used (off-the-shelf) to mechanize the security analysis procedure. Besides discussing the assumptions for the effectiveness and termination of the procedure, we demonstrate its efficiency through an extensive empirical evaluation.
- http://research.microsoft.com/en-us/um/redmond/projects/z3.Google Scholar
- http://www.cs.man.ac.uk/~korovink/iprover.Google Scholar
- http://www.cs.miami.edu/~tptp.Google Scholar
- http://www.cs.stonybrook.edu/~stoller/ccs2007.Google Scholar
- http://www.smt-lib.org.Google Scholar
- A. Armando and S. Ranise. Automated Symbolic Analysis of ARBAC Policies. In STM Workshop, 2010. Google ScholarDigital Library
- R. E. Bryant. Graph-Based Algorithms for Boolean Function Manipulation. IEEE TCAD, 35(8), 1986. Google ScholarDigital Library
- J. Crampton. Understanding and developing role-based administrative models. In Proc. 12th ACM CCS, pages 158--167, ACM Press, 2005. Google ScholarDigital Library
- H. B. Enderton. A Mathematical Introduction to Logic. Academic Press, Inc., 1972.Google Scholar
- H. Gallaire, J. Minker, and J.-M. Nicolas. Logic and Databases: A Deductive Approach. Computing Surveys, 16(2):153--185, 1984. Google ScholarDigital Library
- S. Ghilardi, E. Nicolini, S. Ranise, and D. Zucchelli. Towards SMT Model-Checking of Array-based Systems. In Proc. of IJCAR, LNCS, 2008. Google ScholarDigital Library
- S. Ghilardi and S. Ranise. MCMT: a Model Checker Modulo Theories. In Proc. of IJCAR, LNCS, 2010. Google ScholarDigital Library
- T. Hillenbrand and C. Weidenbach. Superposition for Finite Domains. Res. Rep. RG1-002, MPI, 2007.Google Scholar
- S. Jha, N. Li, M. V. Tripunitara, Q. Wang, and H. Winsborough. Towards formal verification of role-based access control policies. IEEE Trans. on Dependable and Secure Comp., 5(4):242--255, 2008. Google ScholarDigital Library
- S. Jha and T. Reps. Model Checking SPKI/SDSI. J. of Comp. Sec., 12:317--353, 2004. Google ScholarDigital Library
- A. Kern, A. Schaad, and J. Moffett. An Administrative Concept for the Enterprise Role-Based Access Control Model. In SACMAT, pages 3--11, 2003. Google ScholarDigital Library
- N. Li and Z. Mao. Administration in Role-Based Access Control. In Proc. of ASIACCS, 2007. Google ScholarDigital Library
- N. Li and M. V. Tripunitara. Security analysis in role-based access control. ACM TISSEC, 9(4), 2006. Google ScholarDigital Library
- R. Piskac, L. de Moura, and N. Bjoerner. Deciding Effectively Propositional Logic Using DPLL and Substitution Sets. JAR, 44(4):401--424, 2010. Google ScholarDigital Library
- R. Sandhu, E. Coyne, H. Feinstein, and C. Youmann. Role-Based Access Control Models. IEEE Computer, 2(29):38--47, 1996. Google ScholarDigital Library
- A. Sasturkar, P. Yang, S. D. Stoller, and C. Ramakrishnan. Policy analysis for administrative role based access control. In Proc. of 19th CSF Workshop. IEEE, July 2006. Google ScholarDigital Library
- A. Schaad, V. Lotz, and K. Sohr. A model-checking approach to analysing organisational controls in a loan origination process. In SACMAT, pages 139--149, 2006. Google ScholarDigital Library
- S. D. Stoller, P. Yang, M. I. Gofman, and C. R. Ramakrishnan. Symbolic Reachability Analysis for Parameterized Administrative Role Based Access Control. In SACMAT'09, pages 445--454, 2007. Google ScholarDigital Library
- S. D. Stoller, P. Yang, C. Ramakrishnan, and M. I. Gofman. Efficient policy analysis for administrative role based access control. In ACM CCS, 2007. Google ScholarDigital Library
- N. Zhang, M. Ryan, and D. P. Guelev. Evaluating access control policies through model checking. In 8th Info. Sec. Conf., number 3650 in LNCS, 2005. Google ScholarDigital Library
Index Terms
- Efficient symbolic automated analysis of administrative attribute-based RBAC-policies
Recommendations
Automated Analysis of Access Control Policies Based on Model Checking
AbstractAccess control is becoming increasingly important for today’s ubiquitous systems which provide mechanism to prevent sensitive resources against unauthorized users. In access control models, the administration of access control policies is a task ...
DW-RBAC: A formal security model of delegation and revocation in workflow systems
One reason workflow systems have been criticized as being inflexible is that they lack support for delegation. This paper shows how delegation can be introduced in a workflow system by extending the role-based access control (RBAC) model. The current ...
A logic for state-modifying authorization policies
Administering and maintaining access control systems is a challenging task, especially in environments with complex and changing authorization requirements. A number of authorization logics have been proposed that aim at simplifying access control by ...
Comments