Compositional Typed Analysis of ARBAC Policies

Abstract

Model-checking is a popular approach to the security analysis of ARBAC policies, but its effectiveness is hindered by the exponential explosion of the ways in which different users can be assigned to different role combinations. In this paper we propose a paradigm shift, based on the observation that, while verifying ARBAC by exhaustive state search is complex, realistic policies often have rather simple security proofs, and we propose to use types as an effective tool to leverage this simplicity. Concretely, we present a static type system to verify the security of ARBAC policies, along with a sound and complete type inference algorithm used to automate the verification process. We then introduce compositionality results, which identify sufficient conditions to preserve the security guarantees obtained by the verification of different sub-policies when these sub-policies are combined together: this compositional reasoning is crucial when policy administration is highly distributed and naturally supports the security analysis of evolving ARBAC policies. We evaluate our approach by implementing TAPA, a static analyser for ARBAC policies based on our theory, which we test on a number of relatively large, publicly available policies from the literature

IFCIL: An Information Flow Configuration Language for SELinux (Extended Version)

“…Calzavara et al [33] continue this line of research by proposing a security type system for verifying information flow in ARBAC policies. In particular, their type system can address the role reachability problem and offers a compositional technique.…”

Automated and efficient analysis of administrative temporal RBAC policies with role hierarchies

“…There is a long line of works on the safety analysis of access control policies that started with the seminal paper [17]. To the best of our knowledge, Li and Tripunitara [23] were the first to introduce security analysis in the context of ARBAC, followed by many papers, e.g., [21,3,38,24,39,6,1,7,18,15,31,28,44,10]. The idea underlying such works is to reduce safety analysis to graph manipulation [21,3,38] or fix-point computation performed either by Logic Programming (as in [24]) or model checking (as in [39,6,1,7,18,15,31,28,44]).…”