Automatic Generation of History-Based Access Control from Information Flow Specification

Abstract

Abstract. This paper proposes a method for automatically inserting check statements for access control into a given recursive program according to a given security specification. A history-based access control (HBAC) is assumed as the access control model. A security specification is given in terms of information flow. We say that a program π satisfies a specification Γ if π is type-safe when we consider each security class in Γ as a type. We first define the problem as the one to insert check statements into a given program π to obtain a program π that is type-safe for a given specification Γ . This type system is sound in the sense that if a program π is type-safe for a specification Γ , then π has noninterference property for Γ . Next, the problem is shown to be co-NP-hard and we propose an algorithm for solving the problem. The paper also reports experimental results based on our implemented system and shows that the proposed method can work within reasonable time.