1. Miklós Zoltán Technical University of Vienna Distributed Systems Group
Towards an Access Control Mechanism for Wide-area Publish/Subscribe Systems
Miklós Zoltán
Technical University of Vienna
Distributed Systems Group

2. Overview Threats related to lack of access control
Design of a control mechanism
Policy rules
Related work
Conclusion and future work

3. Distributed Publish/Subscribe system
subscriber
publisher
subscriber
Distributed, Content based
publisher
subscriber
Event dispatching network

4. Threats related to lack of access control
Bogus publications
Flood the network with bogus data.
Fake subscriptions
Initiate high network traffic.
Fake advertisements
Initiates updates of the routing tables.
...

5. Design of the control mechanism
Actions: publish, subscribe
How to identify the subjects of authorization?
Digital credentials
Policy
Resources: also content-based
Access control filters: similar to the filters used in the pub/sub infrastructure
Notation: Siena, covering relation

6. Control infrastructure
Access
control
Policy list
Msg+credentials
publisher
Processing
Event dispatcher host

7. Relation: subscription covers a notification (Siena)
The subscription (string message new_product) covers the notification (string message new_product, integer price 10)
The subscription (string message new_product, string color blue) does not cover the notification (string message new_product, integer price 10)

8. Relation: advertisement covers a notification (Siena)
The advertisement (string message new_product, integer price any) covers the notification (string message new_product)
The advertisement (string message new_product, string color blue) does not cover the notification (string message new_product, integer price 10)

9. Controlling of publishers
Publisher has knowledge on available new products
(string message new_product)
(string message new_product, integer price 10)
(string message new_product, integer price 10, integer size 123)
(string message new_product, string quality_class A, integer size 123)
(string message new_product, string quality_class A, integer size 123, integer price 10)

10. Control rules for publishers 1/2
Control publishers to publish only in certain topics
(string message new_product) upper bound filter
For allowed publication the upper bound filter has to cover the notification (as a subscription filter)
allowed publication
(string message new_product, integer price 10)
NOT allowed publication
(string weather sunny, integer temperature 27)

11. Control rules for publishers 2/2
(string message new_product, integer price<100) lower bound filter
allowed publication
(string message new_product, integer price 10, string color blue)
NOT allowed publication
(string weather sunny, integer temperature 27)
For allowed publication the lower bound filter has to cover the notification (as an advertisement filter)
Strict lower bound filters: protects publishing ‘always in a new topic’

12. Control rules for subscribers
Upper bound filter (string message new_product)
For allowed subscriptions the upper bound filter has to cover the notification (as a subscription filter)
allowed subscription
(string message new_product, integer price 10)
NOT allowed subscription
(string weather sunny, integer temperature > 25)

13. Information confidentiality for subscribers
Screening (at the last dispatching host in the route)
Filter (string message any, integer price any)
Subscription: (string message new_product, integer price<100)
Notification: (string message new_product, integer price 23, string color red)
Screened notification: (string message new_product, integer price 23)

14. Related Work
A. Carzaniga, D. S. Rosenblum, A. L. Wolf. Design and Evaluation of a wide-area event-notification service. ACM Transactions on Computer Systems, 19(3): , Aug
C. Wang, A. Carzaniga, D. Evans, A. L. Wolf. Security issues and requirements for Internet-scale publish-subscribe systems. In Proceedings of Thirtyfifth Hawaii International Conference on System Sciences (HICSS-35), Hawaii, Jan
J. Bacon, K. Moody, W. Yao. Access control and trust in the use of widely distributed services. In Proceedings of Middleware 2001., pages , Heidelberg, Germany, Nov
L. Opyrchal, A. Prakash. Secure distribution of events in content-based publish/subscribe systems. In Proceedings of the Tenth USENIX Security Symposium, 2001.

15. Conclusion and future work
Need for a control mechanism
Technique to define access control policies using an existing filtering mechanism
Only one part of a security infrastructure
Future task: if the user has more credentials -> policy language
Risk analysis