Access rights analysis for Java

Abstract

Java™ 2 has a security architecture that protects systems from unauthorized access by mobile or statically configured code. The problem is in manually determining the set of security access rights required to execute a library or application. The commonly used strategy is to execute the code, note authorization failures, allocate additional access rights, and test again. This process iterates until the code successfully runs for the test cases in hand. Test cases usually do not cover all paths through the code, so failures can occur in deployed systems. Conversely, a broad set of access rights is allocated to the code to prevent authorization failures from occurring. However, this often leads to a violation of the "Principle of Least Privilege." This paper presents a technique for computing the access rights requirements by using a context sensitive, flow sensitive, interprocedural data flow analysis. By using this analysis, we compute at each program point the set of access rights required by the code. We model features such as multi-threading, implicitly defined security policies, the semantics of the Permission.implies method and generation of a security policy description. We implemented the algorithms and present the results of our analysis on a set of programs. While the analysis techniques described in this paper are in the context of Java code, the basic techniques are applicable to access rights analysis issues in non-Java-based systems.

Combining Static and Dynamic Analysis for Automatic Identification of Precise Access-Control Policies

“…ACE performs minimization automatically by instantiating all the Permission objects detected, and by then executing the implies method of each Permission object against all the other Permission objects. If p and q are Permission objects required by p, and p.implies(q) returns true, then only p needs to be added to the policy for p. Unlike previous, unsafe policy-minimization approaches [20], ACE prevents potentially-malicious code embedded into implies methods from harming the system by executing implies only under the system SecurityManager.…”

“…As such, they were considerably easier to attack than UNIX setuid programs because they lacked the usual separate process/separate address space protections, as shown by Koegel, et al [19]. Koved, et al [20] and Pistoia, et al [26] automate static security analysis for Java authorization and privilege assertion. Zhang, et al [37] enhance those works with an automated native-code model generator to reduce the number of false negatives.…”

“…In essence, neither dynamic analysis nor static analysis can independently guarantee the identification of a policy sufficient to execute a program and yet not too permissive. This paper presents a novel combination of static and dynamic analysis extending previous work that was completely based on static analysis [20,26,37]. The contribution of this paper is to achieve precise identification of authorization and privilege-assertion requirements in SBAC systems.…”

Visualization of Permission Checks in Java Using Static Analysis

“…Koved et al [11] presents a technique for computing the access rights requirements by using a context sensitive, flow sensitive, interprocedural data flow analysis. This analysis computes at each program point the set of access rights required by the code.…”

“…Most static analyses approximate stack inspection in terms of permissions [4,5,1,2,11]. Our proposed analysis is unique in that it compute success or fail information in terms of permission checks.…”