Preventing Information Leakage in C Applications Using RBAC-Based Model

Transcription

1 Proceedgs of the 5th WSEAS It. Cof. o Software Egeerg Parallel ad Dstrbuted Systems Madrd Spa February (pp69-73) Prevetg Iformato Leakage C Applcatos Usg RBAC-Based Model SHIH-CHIEN CHOU Departmet of Computer Scece ad Iformato Egeerg Natoal Dog Hwa Uversty Secto 2 Da-Hsueh Road Shoufog Huale 974 TAIWAN Abstract - Whe a applcato s beg executed users ca read the applcato s output. If sestve formato s maaged by a applcato formato should be preveted from beg leaked to uauthorzed users durg applcato executo. The preveto ca be acheved through formato flow cotrol. Sce the procedural C laguage s stll use heavly we developed a model based o role-based access cotrol (RBAC) for C applcatos. Ths paper descrbes the model. Key-words: Iformato securty formato flow cotrol role-based access cotrol (RBAC). Itroducto Whe a applcato s beg executed users play roles. A user playg a role ca access the applcato s output. If a applcato maages sestve formato prevetg formato leakage durg applcato executo s mportat. Iformato leakage refers to leakg hgh securty level formato to low securty level users. To prevet formato leakage formato flow cotrol models ca be used []. Sce the C laguage s stll use heavly we developed a formato flow cotrol model CRBAC for C based o role-based access cotrol (RBAC) [2]. CRBAC cotrols both read ad wrte access ad offers the followg addtoal features: a. Prevetg drect formato leakage. Ths leakage refers to leakg formato through the thrd oe(s). Geerally ths leakage ca be preveted usg jo operatg [3]. b. Maagg user relatoshps. User relatoshps may affect permssos whe users play roles a applcato. For example suppose freds ca read oe aother s geeral formato such as age. Also suppose that Mary ad Joh are freds. The Mary ad Joh ca read each other s geeral formato. Whe they break fredshp they ca o loger read oe aother s geeral formato. Sce user relatoshps may chage durg rutme user permssos should be chaged accordg to user relatoshp chage. c. Correctg permssos valdated by user relatoshp chage. User relatoshp chage may affect the preveto of drect formato leakage. For example suppose Tom ad Mary are tally ot freds. The Tom caot read Mary s geeral formato. Suppose at ths tme the formato ageset s derved from Mary s age ad others ages that ca be read by Tom. The accordg to the jo operato Tom s ot allowed to read ageset. If Tom ad Mary become freds after a certa tme (user relatoshp chage occurs ths case) Tom ca read Mary s age ths tme. I ths case should Tom be allowed to read the formato ageset produced before? The aswer should be yes because: () Tom ca read Mary s age after the user relatoshp chage ad (2) ageset s derved from Mary s age ad others ages that ca be read by Tom. Sce Tom ca read all the ages that derved ageset after the user relatoshp chage Tom should be allowed to read ageset after the chage. Allowg Tom to read ageset valdates the prevous jo operato because the prevous jo operatos dsallowed Tom to read ageset. The valdato requres prevous jo operatos to be corrected. d. Avodg mproper fucto call. Dfferet fuctos a C applcato may be dfferet securty levels ad therefore should be protected depedetly. Ths paper presets CRBAC ad ts evaluato. 2. Related Work RBAC s useful access cotrol. Nevertheless sce the orgal desg of RBAC s ot for formato flow cotrol most features metoed secto are ot offered by the geeral cases of RBAC. The model [4] uses

2 Proceedgs of the 5th WSEAS It. Cof. o Software Egeerg Parallel ad Dstrbuted Systems Madrd Spa February (pp69-73) RBAC to cotrol formato flows wth object-oreted systems. It classfes object methods ad derves a flow graph from method vocatos. From the graph o-secure formato flows ca be detfed. The model [5] uses access cotrol lsts (ACLs) of objects to compute ACLs of executos (whch are composed of oe or more methods). A message flter s used to flter out possbly o-secure formato flows. Flexblty s added by allowg exceptos durg or after method executo [6]. More flexblty s added usg versos [7]. The decetralzed label approach [3] marks the securty levels of ables usg labels. A label s composed of oe or more polces whch should be smultaeously obeyed. A polcy a label s composed of a ower ad zero or more readers that are allowed to read the data. Jo operato s used to prevet drect formato leakage. Wrte access s cotrolled. CACL [8] s our prevous work. It caot maage user relatoshps ad adjust permssos valdated by user relatoshp chage. 3. CRBAC The major problem we ecoutered developg CRBAC s What should be regarded as roles a C program? A C fucto s a caddate for a role. Nevertheless a C fucto may allow more tha oe type of users to access ad the users may be dfferet securty levels. If a fucto s regarded as a role users dfferet securty levels ca access formato maaged by the fucto whch may result formato leakage. For example suppose the fucto getifo gets a user s formato. The the followg two cases of formato leakage may happe (suppose a patet s allowed to retreve hs ow formato oly). Frst a patet ca use the fucto to retreve a doctor s formato. Secod a patet ca use the fucto to retreve aother patet s formato. Although formato may be leaked whe regardg fuctos as roles CRBAC stll regards fuctos as roles. Nevertheless the followg requremets should be fulflled for a C program: RleReq. Every fucto a C program s allowed to access by oly oe type of users. Ths solves the problem resulted by the frst case metoed above. RleReq 2. Costrats should be establshed for users to access formato wth a fucto. For example accouts ad passwords should be gve to patets that wll access formato through the fucto getifo. Ths solves the problem resulted by the secod case metoed above. 3. Defto A C applcato Cap embedded wth CRBAC s defed below: Defto. Cap = (USR RLE PER DSR CSG A RPA VFC JH) whch a. USR s the set of users that operate Cap. b. RLE s a set of roles. A role rle correspods to a fucto Cap. c. s a set of user relatoshps. A user relatoshp ur (2 USR - φ ). d. PER s a set of permssos. A permsso s a access rght. CRBAC attaches access rghts to ables because ables carry formato maaged by a applcato. We mplemeted a permsso as a access cotrol lst (ACL). A ACL s composed of a read access cotrol lst (RACL) ad a wrte access cotrol lst (WACL). The ACL ACL assocated wth the able s defed as ACL = (RACL WACL ) whch: () RACL 2 USRxRLE whch x represets Cartesa product. Sce multple users may play the same role RACL has ths defto to dstgush users. A user playg a role RACL s allowed to read. (2) WACL 2 USRxRLE. A user playg a role WACL s allowed to wrte. (3) ( 2 φ ). RACL ad WACL are vald a user relatoshp ur f ur. e. DSR s a set of data sources (DSOCE). The DSOCE of a able records the fuctos that wrote the able s data. f. CSG s a set of CRBAC segmets. A C applcato may have blocks ad the same able ames ca be used dfferet blocks. CRBAC offer CSG to dfferetate ables wth the same ames. g. A s a set of user-role assgmets RLE whch s defed as USR 2. h. RPA s a set of role-permsso assgmets PER whch s defed as RLE 2.. VFC s a set of vald fucto calls. If the fucto f s allowed to voke f2 the elemet (f f2) belogs to VFC. j. JH records jo hstores. It facltates

3 Proceedgs of the 5th WSEAS It. Cof. o Software Egeerg Parallel ad Dstrbuted Systems Madrd Spa February (pp69-73) redog jo operatos to correct permssos (see secto 3.3 for detals). 3.2 Iformato flow securty CRBAC A formato flow occurs whe the result of a computato s assged to a able. To esure secure formato flows both drect ad drect formato flows should be secure. Drect formato flows clude those amog fuctos ad those wth fuctos. Those amog fuctos are duced by fucto calls. If the fucto f vokes f2 a vfc (f f2) should exst. Suppose the vocato s allowed. The the ACLs ad DSOCEs of argumets should be coped to the correspodg parameters. Ths copyg s ecessary because a parameter recevg a argumet herts the securty level of the argumet. Whe the value derved from ables the set { s a able ad s betwee ad } s assged to the able d_ the formato flow duced by the dervato s cosdered secure oly whe both the followg two secure flow codtos are true. To defe the codtos we let: (a) The ACL ad DSOCE of d_ be respectvely (RACL d_ WACL d_ d_ ) ad DSOCE d_. (b) The ACL ad DSOCE of be respectvely ( RACL ) ad DSOCE. WACL Frst secure flow codto: sub ( RACL d_ = = RACL d_ ) so that Secod secure flow codto: sub ( WACL d_ = = DSOCE d_ ) so that The frst codto cotrols read access. The codto RACL d_ RACL = requres that d_ should be the same restrcted as or more restrcted tha the ables the set { s a able ad s betwee ad }. Sce RACLs ad WACLs are vald uder certa user relatoshps the ACL of d_ ad those of the ables the able set metoed above should be vald certa user relatoshp(s). Ths results the requremet sub ( = d_ ). The secod secure flow codto cotrols wrte access. It requres that the data sources of the ables dervg the value assged to d_ should be wth WACL d_ because the data derved from the ables are wrtte to d_. After assgg the derved value to d_ the ACL of d_ should be chaged by the jo operato to prevet drect formato leakage. We use the symbol to represet the operato ad chage ACL d_ to ACL. = Defto 2. WACL = = = ACL = ( ) = RACL I addto to jog ACLs the DSOCE of d_ wll be adjusted to DSOCE. = 3.3 Redog jo operatos ACLs valdated by user relatoshp chage should be corrected by redog jo operatos. Suppose a able d_ s derved from the ables the set VAR. Sce a able may be derved from other ables we suppose that the ables dervg the ables VAR costtute the set VAR 2 the ables dervg the able VAR 2 costtute the set VAR 3 ad so o. The dervato process results rpple effects. The effects ed whe VAR m VAR k whch k < m. We let UVAR be the set = VAR d_ ad suppose that the earlest tme the able beg a derved able s t whch UVAR. From t dow to the curret tme every jo operato whch s a derved able should be redoe. Whe redog jo operatos the curret user relatoshps should be used as a referece because ACLs should be correct uder the curret user relatoshps. The redog should use the compoet JH. Defto 3. A elemet jh of JH Defto s defed below: jh = (t d_ {( ACL ) s a able 2

4 Proceedgs of the 5th WSEAS It. Cof. o Software Egeerg Parallel ad Dstrbuted Systems Madrd Spa February (pp69-73) that derves d_ ad ACL s the ACL of at the tme t} tag) whch a. t s the tme that a jo operato s doe. b. d_ s the derved able. c. {( ACL )} s the set of able ad ther ACLs that derve d_. d. If tag s set t s the earlest tme that d_ s a derved able. Wth the above descrpto the redog of jo operatos s acheved usg Algorthm. Algorthm. Jo operato redog algorthm. Iput data:.. VAR = { s a able to derve d_}.2. d_: the able derved from the able the set VAR 2. Algorthm: 2.. Backtrack JH to detfy VAR 2 through VAR followg the procedure descrbed the frst paragraph of ths secto Let UVAR be the set = VAR d_ For each UVAR do Backtrack JH to detfy the earlest tme t that s a derved able. The tags JH (see Defto 3) facltate the detfcato From the tme t dow to the curret tme mark the jo operatos JH whch s a derved able Ed do 2.5. Redo the marked jo operatos from the earlest tme a jo operato s marked dow to the curret tme. 4. Features Cotrollg both read ad wrte access s acheved by the secure flow codtos. Below we prove that CRBAC offers other features. Lemma : CRBAC prevets drect formato leakage. Proof: Idrect formato leakage results whe a role f2 leaks to f3 the formato retreved from f whch f2 s allowed to read the formato of f whereas f3 ot. To prove that drect formato leakage s avoded we let be a able f that ca be read by the roles s RACL RACL. Accordg to the above assumpto f2 s RACL but f3 ot. We also let 2 be a able f2 whose value s derved from. After the dervato 2 s RACL RACL 2 s modfed by the jo operato (see Defto 2). Suppose drect formato leakage exsts amog f f2 ad f3. Wthout loss of geeralty we assume that f3 ca read 2 after 2 s derved from. Wth ths assumpto f3 s wth RACL 2. However accordg to the jo operato RACL 2 s the tersecto of RACL ad other RACLs after 2 s derved from. Sce f3 s ot RACL f3 s ot RACL 2. # Lemma 2. CRBAC maages user relatoshps. Proof: To prove that CRBAC maages user relatoshps we have to prove that: (a) CRBAC chages role permssos whe user relatoshp chages ad (b) CRBAC corrects permssos valdated by user relatoshp chage. The proof for tem b s Lemma 3. Below we prove that CRBAC chages role permssos whe user relatoshp chages. The followg cases ca be regarded as user relatoshp chage: (a) a system possesses dfferet user relatoshps at dfferet tme say t ad t2 ad (b) a system possesses the same user relatoshps at t ad t2 but at least oe user relatoshp at dfferet tme possesses dfferet roles. Case a: Let t2 = t {ur} whch ur s a user relatoshp ad ur t. I ths case PER t PER t2 whch PER t ad PER t2 are respectvely the permsso sets of the executg system at t ad t2. PER t PER t2 because PER ur PER t2 but PER ur PER t whch PER ur cossts of permssos of users the user relatoshp ur. Case b: Assume that: () ur t ad ur t2 are the same user relatoshp cotag dfferet users at tme t ad t2 ad (2) ur t2 = ur t {u} whch u s a user ad u ur t. I ths case PER t PER t2 because u s the user relatoshp at tme t2 but ot at t whch makes PER t2 to possess more permssos tha PER t. The extra permssos of PER t2 are offered by u. # Lemma 3. CRBAC corrects permssos valdated by user relatoshp chage (.e. Algorthm s correct). Proof. Suppose oly oe able d_ s wth UVAR le 2.2 of Algorthm. The d_ ever plays the role of a derved able. I ths case d_ s ACL s uchaged durg applcato executo. A uchaged ACL s correct because a ACL may be valdated oly whe user relatoshps chage ad the ACL s chaged by jo operato. Suppose Algorthm s correct whe there are (k-) elemets the set UVAR whch 3

5 Proceedgs of the 5th WSEAS It. Cof. o Software Egeerg Parallel ad Dstrbuted Systems Madrd Spa February (pp69-73) UVAR = { s a able s betwee ad (k-) ad (k-) > }. The correctess of Algorthm uder the above assumpto mples that before the able d_ s derved usg the ables UVAR Algorthm corrects ACLs assocated wth the ables UVAR by referrg to the curret user relatoshps. Let s add a able k to the orgal UVAR (we let NewUVAR = UVAR { k }). Accordg to the assumpto the prevous paragraph the ACLs assocated wth the ables NewUVAR excludg k are correct after jo redog. Moreover the ACL assocated wth k s correct because les 2.3 through 2.5 of Algorthm corrects the ACL of k. # Lemma 4. CRBAC avods mproper fucto calls. Proof. A mproper fucto call from the fucto f to f2 may occur whe: (a) f s ot allowed to voke f2 ad (b) f passes mproper argumets to f2. If codto a s true the VFC defed Defto wll block the fucto call. If codto b s true the two secure flow codtos wll block the statemet. # 5. Evaluato A C applcato embedded wth CRBAC model should frst be processed by the CRBAC preprocessor. The output of the preprocessor s a pure C program. The C program geerated by the CRBAC preprocessor s composed of the orgal program ad a securty motor to check formato flow securty durg rutme. We traed studets to use CRBAC. We the requred them to program a smplfed lbrary maagemet system ad a smplfed vetory maagemet system of a supermarket. Durg the programmg we requred the studets to ject user relatoshp chages ad o-secure statemets (o-secure statemets are those that cause o-secure formato flows). We the requred the studets to ru ther programs. The expermets showed that every jected o-secure statemet was detfed. 6. Cocluso Iformato flow cotrol wth a applcato durg ts executo prevets formato leakage. Sce the C laguage s stll use heavly we developed a RBAC-based model CRBAC to cotrol formato flows wth C applcatos. It offers the followg features: a. Cotrollg both read ad wrte accesses usg the two secure flow codtos. b. Prevetg drect formato leakage usg jo operato. c. Maagg user relatoshps. CRBAC uses user relatoshps to lmt permssos so that chagg user relatoshps wll chage user permssos. d. Correctg permssos valdated by user relatoshp chage. CRBAC records jo hstores ad redoes jo operatos to correct permssos usg Algorthm. e. Avodg mproper fucto calls by recordg vald calls. Refereces [] A. Sabelfeld ad A. C. Myers Laguage-Based Iformato-Flow Securty IEEE Joural o Selected Areas Commucatos vol. 2 o. pp [2] R. S. Sadhu E. J. Coye H. L. Feste adc. E. Youma Role-Based Access Cotrol Models IEEE Computer vol. 29 o. 2 pp [3] A. Myers ad B. Lskov Protectg Prvacy usg the Decetralzed Label Model ACM Tras. Software Eg. Methodology vol. 9 o. 4 pp [4] K. Izak K. Taaka ad M. Takzawa frmato Flow Cotrol Role-Based Model for Dstrbuted Objects Proc. 8 th Iteratoal Cof. Parallel ad Dstrbuted Systems pp [5] P. Samarat E. Berto A. Campchett ad S. Jajoda frmato Flow Cotrol Object-Oreted Systems IEEE Tras. Kowledge Data Eg. vol. 9 o. 4 pp Jul./Aug [6] E. Berto Sabra de Capta d Vmercat E. Ferrar ad P. Samarat Excepto-based Iformato Flow Cotrol Object-Oreted Systems ACM Tras. Iformato System Securty vol. o. pp [7] A. Maamr ad A. Fellah Addg Flexblty Iformato Flow Cotrol for Object-Oreted Systems Usg Versos Iteratoal Joural of Software Egeerg ad Kowledge Egeerg vol. 3 o. 3 pp [8] Shh-Che Chou ad Ch-Y Chag A Iformato Flow Cotrol Model for C Applcatos Based o Access Cotrol Lsts Joural of Systems ad Software vol. 78 o. pp Oct