Access Control Enforcement via Principal Influence Sets
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current access-control and information-flow integrity policies in computing systems are inadequately enforced, as they fail to account for influences from code or subjects that are not active on the current stack of execution and are difficult to define and enforce, especially in systems handling untrusted inputs like Web application servers, where implicit information flows can occur.
Innovation Solution
The integration of access-control and information-flow integrity policy enforcement through program analysis to detect security-sensitive sinks, assign permission labels to variables, and calculate overall access permissions by intersecting permissions from influencing principals, ensuring that only authorized principals can influence security-sensitive operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If access-control enforcer only traverses current stack of execution, then enforcement is simple and fast, but it fails to capture codes or subjects that have influenced security-sensitive operations outside the current stack
Solution Approach 1:
The patent transitions from single-dimension stack traversal to multi-dimensional influence tracking by maintaining separate influence sets for each principal that capture all codes and subjects influencing security-sensitive operations, regardless of current stack state. This allows comprehensive enforcement without being constrained to only currently active stack frames.
Solution Approach 2:
The system performs preliminary tracking of principal influences on security-sensitive operations by maintaining influence sets that record all codes and subjects that have influenced operations. This preliminary action ensures that when access control decisions are made, the complete influence history is already captured and can be enforced without requiring complex real-time stack analysis.
2Reliability
If information-flow integrity policies track all sources of influence, then integrity enforcement is comprehensive, but it becomes difficult to define and enforce due to complexity in detecting all influences
Solution Approach 1:
The patent segments the influence tracking system into distinct principal-specific influence sets, where each principal maintains its own set of influencing codes and subjects. This segmentation simplifies the overall complexity by allowing independent tracking and management of influences from each principal rather than requiring a monolithic tracking system.
Solution Approach 2:
The system introduces principal influence sets as intermediary structures that mediate between security-sensitive operations and the access-control enforcer. These influence sets act as intermediaries that capture and organize influence information in a manageable format, making it easier to define and enforce integrity policies without directly complex tracking of all influences.
3Measurement precision
If permission labels are assigned to all variables influenced by principals, then access control decisions are accurate, but the overhead of tracking and labeling increases
Solution Approach 1:
The patent applies local quality by assigning permission labels selectively to variables based on their specific influence relationships with principals. Rather than uniformly labeling all variables, the system assigns labels only to variables that are actually influenced by principals, optimizing the precision-efficiency tradeoff by focusing resources on critical variables.
Solution Approach 2:
The system changes the parameter of permission labeling from a static all-or-nothing approach to a dynamic principal-specific approach. Permission labels are assigned based on the specific parameters of which principals influence which variables, allowing the system to adapt the labeling overhead to the actual security requirements of each variable.
Data Source
AI summary
Access-control and information-flow integrity policies are enforced in a computing system by detecting security-sensitive sinks in software code for an application running on the computing system and retrieving an access-control policy from a database accessible to the computing system. The access-control policy maps a set of access permissions within the computing system to each one of a plurality of principals. For each detected security-sensitive sink, all principals that influence that security-sensitive sink are detected and an overall access permission is assigned to each security-sensitive sink by taking the intersection of the access permission sets for all influencing principals of that security-sensitive sink. If this permission set is inadequate, an integrity violation is reported. In addition, permission labels are assigned to each value of variables used in the security-sensitive sinks. Each permission label is a set of permissions.