Conflict detection in security policies using Semantic Web technology

The evolution of information systems sees an increasing need of flexible and sophisticated approaches for the automated detection of anomalies in security policies. One of these anomalies is redundancy, which may increase the total cost of management of the policies and may reduce the performance of access control mechanisms and of other anomaly detection techniques.We consider three approaches that can remove redundancy from access control policies, progressively reducing the number of authorizations in the policy itself. We show that several problems associated with redundancy are NPhard. We propose exact solutions to two of these problems, namely the Minimum Policy Problem, which consists in computing the minimum policy that represents the behaviour of the system, and the Minimum Irreducible Policy Problem, consisting in computing the redundancy-free version of a policy with the smallest number of authorizations. Furthermore we propose heuristic solutions to those problems. We also present a comparison between the exact and heuristics solutions based on experiments that use policies derived from bibliographical databases.

show abstract

“…An interest in anomaly detection for access control policies has grown also in the computer security community [4,[8][9][10].…”

Section: Related Workmentioning

confidence: 99%

On the notion of redundancy in access control policies

Guarnieri

Neri

Magri³

et al. 2013

Proceedings of the 18th ACM Symposium on Access Control Models and Technologies

Self Cite

View full text Add to dashboard Cite

show abstract

“…The risks are then greater and different from those of classical operating systems [2]. The frequent installation of external code creates an important threat.…”

Section: Introductionmentioning

confidence: 98%

AppPolicyModules

Bacis

Mutti

Paraboschi

2015

Proceedings of the 10th ACM Symposium on Information, Computer and Communications Security

Self Cite

View full text Add to dashboard Cite

Android has recently introduced the support for Mandatory Access Control, which extends previous security services relying on the Android Permission Framework and on the kernel-level Discretionary Access Control. This extension has been obtained with the use of SELinux and its adaptation to Android (SEAndroid). Currently, the use of the MAC model is limited to the protection of system resources. All the apps that are installed by users fall in a single undifferentiated domain, untrusted app. We propose an extension of the architecture that permits to associate with each app a dedicated MAC policy, contained in a dedicated appPolicyModule, in order to protect app resources even from malware with root privileges.A crucial difference with respect to the support for policy modules already available in some SELinux implementations is the need to constrain the policies in order to guarantee that an app policy is not able to manipulate the system policy. We present the security requirements that have to be satisfied by the support for modules and show that our solution satisfies these requirements. The support for appPolicyModules can also be the basis for the automatic generation of policies, with a stricter enforcement of Android permissions. A prototype has been implemented and experimental results show a minimal performance overhead for app installation and runtime.

show abstract

“…Analyzing inconsistent and conflicting situations in security policies is an important area of research and many proposals exist. Several approaches are focused on detecting specific kinds of problems [7,9,11,10,2], while others are interested in fixing these problems [8,5,14,6,12]. We consider inconsistencies, or conflicts, or undefined requests, called problems here, as they lead to bugs or security leaks.…”

Section: Introductionmentioning

confidence: 99%

Removing Problems in Rule-Based Policies

Cheng

Royer

Tisi

2019

ICT Systems Security and Privacy Protection

View full text Add to dashboard Cite

Analyzing and fixing problems of complex rule-based policies, like inconsistencies and conflicts, is a well-known topic in security. In this paper, by leveraging previous work on enumerating all the problematic requests for an inconsistent system, we define an operation on the policy that removes these problems. While the final fix remains a typically manual activity, removing conflicts allows the user to work on unambiguous policies, produced automatically. We prove the main properties of the problem removal operation on rule-based systems in firstorder logic. We propose an optimized process to automatically perform problem removal by reducing time and size of the policy updates. Finally we apply it to an administrative role-based access control (ARBAC) policy and an attribute-based access control (ABAC) policy, to illustrate its use and performance.

show abstract

Conflict detection in security policies using Semantic Web technology

Cited by 9 publications

References 12 publications

On the notion of redundancy in access control policies

On the notion of redundancy in access control policies

AppPolicyModules

Removing Problems in Rule-Based Policies

Contact Info

Product

Resources

About