Enforcing Access Control Over Data Streams

Size: px

Start display at page:

Download "Enforcing Access Control Over Data Streams"

Erin Hart
5 years ago
Views:

1 Enforcing Access Control Over Data Streams Barbara Carmina8, Elena Ferrari, and Kian Lee Tan Presented by: Mehmud Abliz

2 Mo8va8on Data stream management systems have been increasingly used to support a wide range of real 8me applica8ons. E.g. bahlefield, network monitoring, financial monitoring, sensor networks etc. Streaming data needs protec8on Access control in tradi8onal DBMS does not directly apply to DSMS: Access control is triggered as data arrive Temporal constraints Checking each tuple against policy is not efficient.

3 Outline Aurora query model and algebra Access control model for Aurora Secure operators Access control enforcement Strength and weaknesses Conclusion

4 Aurora query model Stream: append only sequence of tuples with the same schema plus 8mestamp ts Query: loop free direct graph of opera8ons (boxes), tuples flow through all the opera8ons.

5 Aurora Algebra Consists of set of operators to be applied on data streams. Filter: Filter(P 1,, P n )(S), result n+1 streams Map: Map(A i =F i,, A j =F j )(S), F i, F j func8ons Bsort: sorts tuples, Aggregate: Aggregate(Op, s, i)(s), Op = (F,A) Join: Join(P)(S 1,S 2 ) Resample: align pairs of stream Union: merge streams with common schema

6 Privileges Two privileges for two classes of opera8ons read: if user has read on streams S 1,S 2, she can apply Filter, Map, Bsort on S 1 or S 2 ; or, do Join(S 1,S 2 ), Union(S 1,S 2 ), Resample(S 1,S 2 ) aggregate: grants a user the authority to perform aggregate opera8ons w/o accessing all the tuples Supported SQL func8ons: mix, max, count, avg, sum Privileges can be specified for whole stream or a subset of their ahributes.

7 Protec8on Object & Constraint Protec8on Objects objects to which access control policies apply. p_obj = (STRs, ATTs, EXPs), where STRS stream iden8fiers/names {S 1,..., S n } ATTs set of ahributes belongs to (S 1 S n ) EXPs boolean expressions of the form A i value, or A i A j, where is a comparison operator of Aurora algebra, val is a value compa8ble with the domain of A i Time Constraint General Time Constraint (gtc): [begin, end] Window Time Constraint (wtc): [size, step]

8 Access Control Policy An access control policy acp is a tuple of the form acp = (sbj, obj, priv, gtc, wtc), where sbj is a role; obj is a protec8on object Priv {read, min, max, count, avg, sum} Example

9 Secure Operators Prunes not accessible data from Aurora opera8on results on a stream S, based on ACP. Secure view

10 Secure Operators (2) Secure read Pol(S,u) = {acp SysAuth acp.obj.strs = S, acp.sbj Role(u), acp.priv = read}. Secure join

11 Secure Aggregate Secure Operators (3) Pol agg (S,u)={acp SysAuth acp.obj.strs = S, Op.A acp.obj, acp.sbj Role(u), acp.priv = Op.F}

12 Access Control Enforcement Enforcing access control in the Aurora query model implies regula8ng whether a user can insert an opera8on (box) into the query graph. When a user asks to apply a box to stream(s) Generate protecfon object like representa8on of the streams Reference monitor takes a set of protec8on objects, the requested opera8on, and returns a set of views or Access denied based on SysAuth.

13 Access Requests Aurora query request: (u, STRs, p) STRs: a or set of input streams or internal streams An access request is modeled as R = (u, Objs, p) Where Objs is set of (STRs, ATTs, EXPs) tuples. Generate protec8on object representa8on Collect all ahributes specified in the Map boxes into Obj.ATTs Collect all predicates specified in Filter, Join, and Resample boxes into Obj.EXPs Collect all input streams in all boxes into Obj.STRs

14 Generate protec8on object example Output of evaluate proc_objc() on above ({Health}, {Heart, SID}, {Health.Platoon=X ^ Heart>160})

15 Access control enforcement Scenario: (Rick, ({Health},*,null), (Filter, Hearth>160)) Policies that applies: The authoriza8on view generated: Filter(Heart>160)(Map(Heart,SID) (Filter(Health.Platoon=X)(Health)))

16 Strength Access control only needs to be performed once for each user request. Allows the op8miza8on process in the DSMS to merge seman8cally equivalent parts of queries of different users. The access control algorithm proposed is fairly simple. The paper formally proves the correctness of the access control algorithm.

17 Weaknesses The proposed access control mechanism does not address the revoca8on of privileges. The proposed framework only addresses the access control for the "consumer" of the data streams. Extra privileges are necessary to make to mechanism less suscep8ble to denial of service ahacks.

18 Weaknesses Proposed enforcement mechanism is designed specifically for Aurora, it is not clear how it applies to DSMS in general. Query rewri8ng has the same problem of causing confusion at the user. Paper does not provide any performance evalua8on of the proposed access control framework.

19 Conclusion An enforcement mechanism is introduced based on the role based access control model the authors proposed in the earlier work. Enforces access control by controlling whether a user can insert an opera8on into the query graph. Simpler and more efficient mechanism, but covers only part of the system. Also lacks certain privileges and privilege revoca8on.

Specifying Access Control Policies on Data Streams

Specifying Access Control Policies on Data Streams Barbara Carminati 1, Elena Ferrari 1, and Kian Lee Tan 2 1 DICOM, University of Insubria, Varese, Italy {barbara.carminati,elena.ferrari}@uninsubria.it