HBAC: A Model for History-Based Access Control and Its Model Checking

Abstract

Stack inspection is now broadly used as dynamic access control infrastructure in such runtime environments as Java virtual machines and Common Language Runtime. However, stack inspection is not sufficient for security assurance since the stack does not retain security information on the invoked methods for which execution is finished. To solve this problem, access control models based on execution history have been proposed. This paper presents a formal model for programs with access control based on execution history, which are called HBAC programs. Their expressive power is shown to be strictly stronger than programs with stack inspection. It is also shown that the verification problem for HBAC programs is EXPTIME-complete, while the problem is solvable in polynomial time under a reasonable assumption. Finally, this paper presents a few optimization techniques used in the implementation of a verification tool for HBAC programs. The results of experiments show that the tool can verify practical HBAC programs within a reasonable time.

Automatic Generation of History-Based Access Control from Information Flow Specification

“…Below we informally describe the HBAC [1,26], the access control mechanism assumed in this paper. (Formal definition is given in Section 2.3.)…”

“…(Formal definition is given in Section 2.3.) HBAC is proposed to resolve the weakness of the stack inspection such that it ignores the execution history of functions of which execution is finished [1,4,26]. (See [1] for the design principles of HBAC.)…”

“…Pottier et al [23] and Besson et al [7] proposed type systems such that type safety implies no violation against runtime access control in an SBAC program. Also safety verification method and its implementation for HBAC programs were reported [26]. Information flow analysis has a long history stemming from [8,9] and has been extensively studied for recursive programs using Hoare logic [2], abstract interpretation [21], and type systems [14,17,25].…”

Securing Java with Local Policies.

“…a policy requiring that no socket connections can be opened after a local file has been read. Wang, Takata and Seki [37] propose a model for history-based access control. They use control-flow graphs enriched with permissions and a primitive to check them, similarly to [5].…”

“…The model-checking technique can decide if all the permitted traces of the graph respect a given regular property on its nodes. Unlike our local policies, that can enforce any regular policy on traces, the technique of [37] is less general, because there is no way to enforce a policy unless it is encoded as a suitable assignment of permissions to nodes. Pandey and Hashii [33] enhance the access control model of Java, by specifying fine-grained constraints on the execution of mobile code.…”