Heuristic safety analysis of access control models

Abstract

Model-based security engineering uses formal security models for specifying and analyzing access control systems. Tool-based model analysis encounters a fundamental difficulty here: on the one hand, real-world access control systems generally are quite large and complex and require models that have high expressive power. On the other hand, analysis of such models is often pestered by computational complexity or even non-decidability, making it difficult to devise algorithms for automated analysis tools.One approach to this problem is to limiting the expressive power of the modeling calculus, resulting in restrictions to the spectrum of application scenarios that can be modeled. In this paper we propose a different approach: a heuristic-based method for analyzing the safety properties of access control models with full expressive power. Aiming at generality, the paper focuses on the lineage of HRU-style, automaton-based access control models that are fundamental for modeling the dynamic behavior of contemporary rolebased or attribute-based access control systems.The paper motivates a heuristics-based approach to model analysis, describes in detail a heuristic model safety analysis algorithm, and discusses its computational complexity. The algorithm is the core of a security model analysis tool within the context of a security policy engineering workbench; a formal description of major components of its heuristic-based symbolic model execution engine is given, and its capacity to analyze complex real-world access control systems is evaluated.

Automated and efficient analysis of administrative temporal RBAC policies with role hierarchies

“…Proof: [Lemma 1] For the left-to-right implication, let a H = (ty, C a , ts rule , C, ts r , r) and ty = can_assign. 4 Since (RS , TUA, TRH , t) → a H (RS , TUA , TRH , t) and recalling Definition 17 of → AT RBACH , we have the following:…”

“…To overcome this issue, two alternative approaches are available: either (a) identify a fragment of the access control policies admitting a decision procedure for a restricted version of the safety problem or (b) consider unrestricted policies and design heuristic (albeit incomplete) methods capable of solving practically relevant instances of the general safety problem. For instance, several techniques for alternative (a) have been proposed for administrative models of Role-Based Access Control (RBAC) policies [33] as witnessed by a long stream of papers, e.g., [21,3,38,24,39,6,1,7,18,15,31,28,44]; whereas alternative (b) has been less investigated (see, e.g., [4,5]).…”

Towards a Uniform Framework for Dynamic Analysis of Access Control Models

“…This enables tractability of the original, merely semi-decidable safety property and naturally yields an approximate solution. 1 Our most promising approach to heuristic analysis, DepSearch [3], is therefore generalized in this paper to fit any core-based entity labeling model. The notion of safety used in our approach is based on Tripunitara's and Li's [33] precise and meaningful revisions of the original safety-definition.…”

“…In this section, we discuss the basic idea of heuristic safety analysis. We will outline one of the most successful algorithmic approaches to this problem, DepSearch, presented for the HRU access control model in [3,4]. On this basis, we will later introduce a systematic generalization of DepSearch.…”

“…Contributions of this work include 1. a generalization of the DepSearch heuristic for model safety analysis [3], with the goal to be adaptable to every core-based/EL access control model, 2. a partially automatable workflow of tailoring both a formal safety property and an appropriate heuristic to a specific model, 3. a demonstration of this process for SELX, resulting in a specialized safety analysis algorithm for SELinux security policies.…”