Automated reverse engineering of role-based access control policies of web applications

Abstract

Access control (AC) is an important security mechanism used in software systems to restrict access to sensitive resources. Therefore, it is essential to validate the correctness of AC implementations with respect to policy specifications or intended access rights. However, in practice, AC policy specifications are often missing or poorly documented; in some cases, AC policies are hard-coded in business logic implementations. This leads to difficulties in validating the correctness of policy implementations and detecting AC defects.In this paper, we present a semi-automated framework for reverse-engineering of AC policies from Web applications. Our goal is to learn and recover role-based access control (RBAC) policies from implementations, which are then used to validate implemented policies and detect AC issues. Our framework, built on top of a suite of security tools, automatically explores a given Web application, mines domain input specifications from access logs, and systematically generates and executes more access requests using combinatorial test generation. To learn policies, we apply machine learning on the obtained data to characterize relevant attributes that influence AC. Finally, the inferred policies are presented to the security engineer, for validation with respect to intended access rights and for detecting AC issues. Inconsistent and insufficient policies are highlighted as potential AC issues, being either vulnerabilities or implementation errors.We evaluated our approach on four Web applications (three open-source and a proprietary one built by our industry partner) in terms of the correctness of inferred policies. We also evaluated the usefulness of our approach by investigating whether it facilitates the detection of AC issues. The results show that 97.8% of the inferred policies are correct with respect to the actual AC implementation; the analysis of these policies led to the discovery of 64 AC issues that were reported to the developers.

Overview of security access control mechanisms

“…We also introduce a new approach to analyze the presence of heterogeneous access control policies in RAMHAC by modeling the policies with Datalog facts and using the μz tool. The management model includes a wide range of management relationships, commands, antecedent constraints, and postecedent constraints.Le et al in [4] proposed a semi-automated reverse engineering access control policy framework for learning and recovering role-based access control (RBAC) policies from web applications to verify the correctness of implemented policies and detect access control issues. The framework is based on a set of security tools that automatically explore a given Web application, mine domain input specifications from access logs, and use combinatorial test generation to systematically generate and execute additional access requests.Spanaki et al [5] proposed the concept of Data Sharing Agreements (DSAs) as an important path and template for AI applications for data management between parties.…”

Lessons Learned: Enterprise Information System Project on Education Institution

“…The integration spanned four key domains: new student admissions, academics, finance, and human resources. A notable feature of this system is the implementation of role-based access control (RBAC) [1] with Single Sign-On (SSO) capabilities, enhancing security and efficiency.…”