On Comparing the Expressing Power of Access Control Model Frameworks Workshop on Logical Foundations of an Adaptive Security Infrastructure (WOLFASI) A sub-workshop of the LICS Foundations of Computer Security (FCS'04) Workshop, LICS '04 July 12-13, 2004 Turku, Finland Elisa Bertino Purdue University Barbara Catania DISI Università degli Studi di Genova Elena Ferrari DSCFM Università degli Studi dell’Insubria Paolo Perlasca DICO Università degli Studi di Milano

Summary ASI and policy framework Frameworks comparison Conclusions and future work

ASI Adaptive Security Infrastructure (ASI) –Collect information about security environments –Analyze the collected data –Perform efficient compensating actions according to security relevant detected events ASI strictly depends on the underlying security policy

Security Policy Issues How formally representing the semantics of security policies ? In distributed environments –Compensating actions can involve different environments and must agree with the respective underlying security policies

Framework Strategy: framework for representation, analysis, and usage of security policies Useful in –Performing security analysis –Identifying strategies –Producing compensating actions –Representing in a uniform way the heterogeneity of the access control policies and formalisms We focus on one of the most relevant classes of security policies: access control policies

Access Control (AC) Policies An access control policy determines the operations and rights that subjects can exercise on the protected objects Access control policies can be specified through authorization rules –Rules able to establish for each subject s which actions such subject can perform on which object of the system

General Access Control System General Access Control System Access Control Policy Data1Data2 Access Request ACP Answer

Which AC framework ? A variety of access control frameworks have been so far defined Each framework provides a formalism for specifying access control policies and a semantics for computing authorizations Different frameworks support the representation of different sets of policies No comparison of the expressive power of the proposed frameworks has been investigated

LAMP LAMP is based on the C-Datalog language C-Datalog supports: –classical object-oriented concepts, such as classes, objects and inheritance (used to represent subjects, objects, privileges, sessions,…) –typical logic-based concepts, such as deductive rules (used to represent authorization and constraint rules) Each instance of an ACM is a logical program composed of C-Datalog rules defined against a C- Datalog schema

LAMP An Access Control Model Schema (ACMS) defines the structural components upon which the model is based Access Control Model Instance (ACMI) provides information concerning the component instances, that is, the “actual” subjects, objects, privileges and sessions, and the authorizations and constraint rules used to instantiate the model

ACMI DC DSC AC PC CC Domain Component Domain Structure Component Authorization Component Propagation Component Constraint Component Object(self:#8,name:Salaries,access_class:Secret) g1g1 g2g2 g3g3 g4g4 g5g5 SubG(G 1 :g 5,G 2 :g 4 ) InSubG(G 1 : g 4,G 2 : g 1 )  InSubG(G 1 : g 5,G 2 : g 1 ) InSubG(G 1 :X,G 2 :Y)  SubG(G 1 :X,G 2 :Y) InSubG(G 1 :X,G 2 :Y)  SubG(G 1 :X,G 2 :Z), InSubG(G 1 :Z,G 2 :Y) ACMS object(self:object,name:string,access_class:string) group(self:group,name:string) SubG(G 1 :group,G 2 :group) Object(self:,name:,access_class: )

Jajodia et al. Jajodia et al. framework represents access control models by stratified logic programs constructed over a given logical language The basic elements used to represent an ACM are: –OTH, UGH, RH, A, Rel –Authorizations (o,s, a)

Jajodia et al. An AS is a set of stratified rules satisfying some syntactic restrictions Authorizations are specified through predicates: –cando(o,s, a) –dercando(o,s, a) –do(o,s, a)

RBAC NIST RBAC is defined by four levels of increasing complexity Roles are powerful and easy to use SSD and DSD constraints Policy free

R1R1 R2R2 R3R3 R4R4 P Permission-role Assignments Constraints (SSD, DSD) User-role Assignments U RBAC COMPONENT O

Result All the ACMs that can be represented by the Jajodia et al. framework can be represented by the Lamp framework All the ACMs that can be represented by the four NIST levels can be represented by the Lamp framework

ACMI DC DSC AC PC CC ACMS Auth Base ACM Auth Base

Result The set of the ACMs that can be represented by LAMP is greater than the one representable by the Jajodia et al. framework Locally stratified logic programs generates a unique set of authorizations vs more general formalism supporting the generation of more than one set of consistent authorizations

Result The set of the ACMs that can be represented by LAMP is greater than the one representable by the NIST framework SSD and DSD constraints vs broader set of constraints (conditioned separation of duty depending on specific values of basic elements)

Conclusions Given a distributed system based on ASI our analysis will help in the selection of a specific ac framework for such environment

Future work Definition of new dimensions and comparison according to them –Mapping complexity –Spatial complexity –Temporal complexity Development of a set of tools for specifying and analyzing ac policies using LAMP as a core system