Introduction Modeling Distributed Systems RBAC Administration in Distributed Systems Policy Distribution Concluding Remarks Marnix Dekker, Jason Crampton, Sandro Etalle Questions Distributed and Embedded Systems groep (DIES), Universitity of Twente Information Security Group (ISG), Royal Holloway University of London Security Group (SEC), University of Eindhoven SACMAT 2008
Introduction 1 Introduction Modeling Distributed Systems Policy Distribution 2 Modeling Distributed Systems Concluding Remarks Questions 3 Policy Distribution 4 Concluding Remarks 5 Questions
Motivation Introduction Modeling Distributed Systems Modern distributed computer systems require sophisticated Policy Distribution access control policies Concluding • Statutory and enterprise requirements Remarks Questions • RBAC is a flexible and widely used form of access control Access control policies need to be administered simply and effectively • Policy requirements change Existing RBAC literature does not provide a model for administration in distributed systems
Role-based access control Introduction Modeling Distributed Systems Policy Distribution “Standard RBAC” (RBAC96, ANSI-RBAC) defines Concluding Remarks • Users U , roles R , actions A and objects O Questions • Permissions P ⊆ A × O • UA ⊆ U × R , PA ⊆ P × R , RH ⊆ R × R • An RBAC policy φ is defined by ( UA , RH , PA )
Role-based access control Introduction Modeling Distributed We treat φ as a directed graph ( U ∪ R ∪ P , UA ∪ RH ∪ PA ) Systems • We write v → φ v ′ to indicate that there exists a path from Policy Distribution v to v ′ in φ Concluding Remarks • We assume all paths are directed (from users to roles to Questions permissions) • u → φ r , for example, means that u is authorized (by φ ) for role r
Role-based access control Introduction Modeling Distributed We treat φ as a directed graph ( U ∪ R ∪ P , UA ∪ RH ∪ PA ) Systems • We write v → φ v ′ to indicate that there exists a path from Policy Distribution v to v ′ in φ Concluding Remarks • We assume all paths are directed (from users to roles to Questions permissions) • u → φ r , for example, means that u is authorized (by φ ) for role r • The upper closure of v , denoted ↑ φ v , is the sub-graph comprising all paths in φ in which v is the last node • The downward closure of v , denoted ↓ φ v , is the sub-graph comprising all paths in which v is the first node
Administration of RBAC Introduction Modeling What administrative actions may be requested? Distributed Systems • We only model changes to UA , RH and PA Policy Distribution • A user may add or delete a tuple from one of these Concluding relations Remarks Questions • � u ( v , v ′ ) denotes a request by u to add tuple ( v , v ′ ) • � u ( v , v ′ ) denotes a requests by u to delete tuple ( v , v ′ )
Administration of RBAC Introduction Modeling What administrative actions may be requested? Distributed Systems • We only model changes to UA , RH and PA Policy Distribution • A user may add or delete a tuple from one of these Concluding relations Remarks Questions • � u ( v , v ′ ) denotes a request by u to add tuple ( v , v ′ ) • � u ( v , v ′ ) denotes a requests by u to delete tuple ( v , v ′ ) What administrative permissions are required? • � ( v , v ′ ) denotes a permission to add tuple ( v , v ′ ) • ♦ ( v , v ′ ) denotes a permission to delete tuple ( v , v ′ ) • We extend PA to include permissions of the form � ( , ) and ♦ ( , )
Introduction 1 Introduction Modeling Distributed Systems Policy Distribution 2 Modeling Distributed Systems Concluding Remarks Questions 3 Policy Distribution 4 Concluding Remarks 5 Questions
Distributed system model Introduction Modeling Distributed Systems Policy We assume that a distributed system comprises a number of Distribution components (or sub-systems) S Concluding Remarks • Each sub-system s ∈ S has its own reference monitor and Questions its own policy for deciding access requests • There is a centralized reference monitor for deciding administrative access requests • The centralized reference monitor has policy φ
Permissions and policies Introduction Modeling Distributed Systems Policy Distribution We define a privilege mapping pm and a policy mapping ψ Concluding Remarks • pm ( s ) ⊆ P is the set of permissions handled by Questions sub-system s • ψ ( s ) denotes the RBAC policy that sub-system s uses to evaluate requests We model the distributed system as a tuple ( S , pm , φ, ψ )
Soundness Introduction Modeling Distributed Systems Policy ψ is sound (with respect to the central policy φ ) iff Distribution Concluding � Remarks ψ ( s ) ⊆ φ Questions s ∈ S • ψ is sound if any request granted by s ∈ S would also be granted by a centralized reference monitor using policy φ • Soundness is a safety criterion
Completeness Introduction Modeling Distributed Systems Policy ψ is complete (with respect to the central policy φ ) iff for any Distribution s ∈ S and any p ∈ pm ( s ) Concluding Remarks Questions u → φ p implies u → ψ ( s ) p • ψ is complete if any request granted by φ for a permission for which s is responsible is also granted by s • Completeness is an availability criterion
Leanness Introduction Modeling Distributed Soundness and completeness are minimum requirements of a Systems policy distribution ψ Policy Distribution • Trivial distribution ψ ( s ) = φ for all s ∈ S is sound and Concluding complete Remarks Questions • More economical distributions are desirable
Leanness Introduction Modeling Distributed Soundness and completeness are minimum requirements of a Systems policy distribution ψ Policy Distribution • Trivial distribution ψ ( s ) = φ for all s ∈ S is sound and Concluding complete Remarks Questions • More economical distributions are desirable • It can be shown that the most economical sound and complete distribution is defined by � ψ ( s ) = ↑ φ p p ∈ pm ( s ) • We call this the lean distribution
Example Introduction φ Modeling Distributed Systems (ernurse, dbusr) erstaff orstaff (ernurse,sqanusr) (ornurse, sqanusr) Policy Distribution sqanadmin ornurse ernurse Concluding (job,halt) Remarks (print,black) (print,color) sqanusr dbusr Questions (ehrtable,insert) (ehrtable,view) (job,start) ψ (Sqan) ψ (Sqil) orstaff ψ (Inq) orstaff erstaff erstaff ornurse sqanadmin ernurse (job,halt) dbusr (print,color) (print,black) sqanusr (ehrtable,insert) (ehrtable,view) (job,start)
Introduction 1 Introduction Modeling Distributed Systems Policy Distribution 2 Modeling Distributed Systems Concluding Remarks Questions 3 Policy Distribution 4 Concluding Remarks 5 Questions
Policy updates Introduction When an administrative request is granted by the central Modeling Distributed reference monitor (CRM), policy updates need to be sent to Systems one or more sub-systems Policy Distribution • It is important that soundness and completeness are Concluding Remarks preserved Questions
Policy updates Introduction When an administrative request is granted by the central Modeling Distributed reference monitor (CRM), policy updates need to be sent to Systems one or more sub-systems Policy Distribution • It is important that soundness and completeness are Concluding Remarks preserved Questions We propagate policy updates to sub-systems using message commands • A message command is parameterized by a sub-system, a policy graph and an action (add or delete) • ⊕ s ( φ ) (respectively ⊖ s ( φ )) denotes a message for sub-system s to add (delete) φ to (from) its policy The operational semantics of our model are defined using a queue and a transition relation
Queues and transitions Introduction Administrative requests and message commands are placed on Modeling the queue Distributed Systems • Processing an item in the queue – defined by the Policy Distribution transition relation – yields a new queue Concluding Remarks Questions
Queues and transitions Introduction Administrative requests and message commands are placed on Modeling the queue Distributed Systems • Processing an item in the queue – defined by the Policy Distribution transition relation – yields a new queue Concluding Given ( S , pm , φ, ψ ), the transition relation Remarks Questions • Transforms administrative requests into message commands and updates to φ • If � u ( v , v ′ ) is authorized then create message command ⊕ s ( { ( v , v ′ ) } ∪ ( ↑ φ v )) for each s such that ↓ φ v ∩ pm ( s ) � = ∅ • Transforms message commands into updates to ψ • The transition relation preserves soundness and completeness
Introduction 1 Introduction Modeling Distributed Systems Policy Distribution 2 Modeling Distributed Systems Concluding Remarks Questions 3 Policy Distribution 4 Concluding Remarks 5 Questions
Recommend
More recommend
