Static analysis of role-based access control in J2EE applications

Abstract

This work describes a new technique for analysis of Java 2, Enterprise Edition (J2EE) applications. In such applications, Enterprise Java Beans (EJBs) are commonly used to encapsulate the core computations performed on Web servers. Access to EJBs is protected by application servers, according to role-based access control policies that may be created either at development or deployment time. These policies may prohibit some types of users from accessing specific EJB methods.We present a static technique for analyzing J2EE access control policies with respect to security-sensitive fields of EJBs and other server-side objects. Our technique uses points-to analysis to determine which object fields are accessed by which EJB methods, directly or indirectly. Based on this information, J2EE access control policies are analyzed to identify potential inconsistencies that may lead to security holes.

Access Control Configuration for J2EE Web Applications: A Formal Perspective

“…Related work on J2EE access control configurations analysis [13,14] stems from premises analogous to ours. However these approaches rather focus on checking the consistency of programmatic access control configurations w.r.t.…”

“…However these approaches rather focus on checking the consistency of programmatic access control configurations w.r.t. the implementation of J2EE components of the business tier [13] or both business and web tiers [14], in order, e.g., to detect accesses to EJB fields or methods inconsistent with the access control policy. Our work focusing on declarative security is complementary: our formalization supports other reasoning tasks, such as the comparison of different configurations.…”

Roles in information security – A survey and classification of the research area

“…Another research topic of interest during the last years is Java EE 31 as a software architecture for the transaction-based execution of applications programmed in Java. In 2004, Naumovich and Centonze (2004) focused on EJBs inside the J2EE middleware framework. Another approach for combining roles and Java EE is provided in Sun et al (2008) where the authors presented a role-based proposal for automatic generation of J2EE access control configurations.…”

Symbolic security analysis of ruby-on-rails web applications

“…In comparison, the other kinds of attacks we consider in this paper have received far less attention; notable exceptions include [24,50] on access control and authentication, [37] on session integrity, and [9,47] on CSRF. Some recent work studies new kinds of attacks that we do not consider in this paper; they include clickjacking [6] and XCS (cross-channel scripting) [15] in particular.…”