Dynamic mandatory access control for multiple stakeholders

Abstract

In this paper, we present a mandatory access control system that uses input from multiple stakeholders to compose policies based on runtime information. In the emerging ubiquitous environment, many devices run software whose access permissions depends on multiple stakeholders, such as the device owner, the service provider, the application owner, etc., rather than a single system administrator. However, current access control administration remains as either discretionary, allowing the running and perhaps compromised process to administer, or mandatory, requiring all permissions to be known by load-time. A key problem is that users may download arbitrary programs to their devices, requiring that the system contain such programs while allowing some reasonable functionality. However, such programs may need access to resources that can lead to attacks, such as implementing voice-over-IP calls, but that may also be needed for benign operations. In our approach, we use a "soft" sandboxing mechanism to first contain such processes, request the stakeholder to authorize operations outside the sandbox that are not prohibited by policy, and maintain a runtime execution role for the process to identify its access state to the stakeholders. We define a proxy policy server that caches and combines stakeholder policies to make such access decisions. Our framework was implemented by modifying the SELinux module and using a remote proxy policy server, although a local proxy policy server is also possible. We incur a 0.288 µs performance overhead only when stakeholders need to be consulted, and new permissions are cached.

Semantically Rich Application-Centric Security in Android

“…Muthukumaran et al [15] applied SELinux security policies to Openmoko to ensure the integrity of the phone and trusted applications. In a related work, Rao et al [16] developed a mandatory access control (MAC) system for smartphones which uses input from multiple stakeholders to dynamically create the policies run-time permission assignment. The Windows Mobile .NET compact framework uses security-by-contract [17] that binds each application to a behavioral profile enforced at runtime.…”

Practical and lightweight domain isolation on Android

“…The work further shows how unique features of mobile devices can be leveraged to identify the borderline between trusted/untrusted domains and to simplify the policy specification, while maintaining a high level of platform integrity. The authors of [35] show how policies in the context of multiple mobile platform stakeholders can be created dynamically and present a prototype based on SELinux. Low-level mandatory access control is an essential building block in our design (see Section 4).…”

Android security framework

“…Android, for instance, implements currently a quadruplepolicy approach consisting of Permissions, SE Android type enforcement, AppOps, and Linux capabilities-each being responsible for a different aspect of the overall access control strategy. Multiple policies will naturally conflict and thus require the security framework to support different policy composition and reconciliation strategies (e.g., consensus or priority based) [32,27]. However, supporting fully generic policy composition is quite a challenge and has been shown to be intractable [18].…”