License: 
Creative Commons Attribution 3.0 Unported license (CC BY 3.0)
When quoting this document, please refer to the following
DOI: 10.4230/LIPIcs.ECOOP.2015.222
URN: urn:nbn:de:0030-drops-52249
URL: http://dagstuhl.sunsite.rwth-aachen.de/volltexte/2015/5224/
Centonze, Paolina ;
Pistoia, Marco ;
Tripp, Omer
Access-rights Analysis in the Presence of Subjects
Abstract
Modern software development and run-time environments, such as Java and the Microsoft .NET Common Language Runtime (CLR), have adopted a declarative form of access control. Permissions are granted to code providers, and during execution, the platform verifies compatibility between the permissions required by a security-sensitive operation and those granted to the executing code. While convenient, configuring the access-control policy of a program is not easy. If a code component is not granted sufficient permissions, authorization failures may occur. Thus, security administrators tend to define overly permissive policies, which violate the Principle of Least Privilege (PLP).
A considerable body of research has been devoted to building program-analysis tools for computing the optimal policy for a program. However, Java and the CLR also allow executing code under the authority of a subject (user or service), and no program-analysis solution has addressed the challenges of determining the policy of a program in the presence of subjects.
This paper introduces Subject Access Rights Analysis (SARA), a novel analysis algorithm for statically computing the permissions required by subjects at run time. We have applied SARA to 348 libraries in IBM WebSphere Application Server - a commercial enterprise application server written in Java that consists of >2 million lines of code and is required to support the Java permission- and subject-based security model. SARA detected 263 PLP violations, 219 cases of policies with missing permissions, and 29 bugs that led code to be unnecessarily executed under the authority of a subject. SARA corrected all these vulnerabilities automatically, and additionally synthesized fresh policies for all the libraries, with a false-positive rate of 5% and an average running time of 103 seconds per library. SARA also implements mechanisms for mitigating the risk of false negatives due to reflection and native code; according to a thorough result evaluation based on testing, no false negative was detected. SARA enabled IBM WebSphere Application Server to receive the Common Criteria for Information Technology Security Evaluation Assurance Level 4 certification.
BibTeX - Entry
@InProceedings{centonze_et_al:LIPIcs:2015:5224,
author = {Paolina Centonze and Marco Pistoia and Omer Tripp},
title = {{Access-rights Analysis in the Presence of Subjects}},
booktitle = {29th European Conference on Object-Oriented Programming (ECOOP 2015)},
pages = {222--246},
series = {Leibniz International Proceedings in Informatics (LIPIcs)},
ISBN = {978-3-939897-86-6},
ISSN = {1868-8969},
year = {2015},
volume = {37},
editor = {John Tang Boyland},
publisher = {Schloss Dagstuhl--Leibniz-Zentrum fuer Informatik},
address = {Dagstuhl, Germany},
URL = {http://drops.dagstuhl.de/opus/volltexte/2015/5224},
URN = {urn:nbn:de:0030-drops-52249},
doi = {10.4230/LIPIcs.ECOOP.2015.222},
annote = {Keywords: Static Analysis, Security, Access Control}
}
|
Keywords: |
|
Static Analysis, Security, Access Control |
|
Collection: |
|
29th European Conference on Object-Oriented Programming (ECOOP 2015) |
|
Issue Date: |
|
2015 |
|
Date of publication: |
|
29.06.2015 |
