Composite Decentralized Access Control Petar Tsankov , Srdjan - PowerPoint PPT Presentation

Composite Decentralized Access Control Petar Tsankov , Srdjan Marinovic, Mohammad Torabi Dashtj, David Basin Instjtute of Informatjon Security ETH Zurich

Example: SweGrid Goal Provides computatjonal and storage resources to researchers Access Control Requirements – A project leader delegates his authority over resources to principals – A project leader composes the principals' policies (e.g., using permit-override)

Delegatjon Multjple principals can issue access rights delegatjons Project Leader Project leader Dave Bob access rights access rights Researchers Researchers

Delegatjon Multjple principals can issue access rights delegatjons Project Leader Project leader Dave Bob access rights access rights Researchers Researchers Decentralized Access Control

Compositjon Policy decisions in large-scale systems – Grant, Deny, Not-applicable, Confmict Compositjon operators, e.g.: ● Permit-override Project + leader ● Deny-override ● Confmict-override + Bob Dave

Compositjon Policy decisions in large-scale systems – Grant, Deny, Not-applicable, Confmict Compositjon operators, e.g.: ● Permit-override Project + leader ● Deny-override ● Confmict-override + Bob Dave Composite Access Control

System Model Resources Subjects

System Model Requirements Principals control access Resources Subjects

System Model Requirements Principals PDP Policies control access PEP Resources Subjects

Related Work Systems and standards Formal foundatjons

Related Work Delegatjon Systems SecPAL for Grid and KeyNote PDP standards (RFC 2704) RT ('01) Formal foundatjons DKAL ('08) ...

Related Work Compositjon Delegatjon Systems SecPAL for Grid XACML v2.0 and KeyNote PDP standards (RFC 2704) PBel ('08) RT ('01) Formal D-Algebra ('09) DKAL ('08) foundatjons ... PTaCL ('12) ...

Related Work Delegatjon Compositjon + Compositjon Delegatjon SweGrid Systems SecPAL for Grid XACML v2.0 and XACML v3.0 ('13) KeyNote PDP standards (RFC 2704) WSO2 ID Server PBel ('08) RT ('01) Formal D-Algebra ('09) DKAL ('08) foundatjons ... PTaCL ('12) ...

Related Work Delegatjon Compositjon + Compositjon Delegatjon SweGrid Systems SecPAL for Grid XACML v2.0 and XACML v3.0 ('13) KeyNote PDP standards (RFC 2704) WSO2 ID Server PBel ('08) RT ('01) Formal BelLog D-Algebra ('09) DKAL ('08) foundatjons ... PTaCL ('12) ...

How to Build Access Control Systems Verify Construct Specify Policy PDP Policy ➔ Formal semantjcs ➔ Analysis language ➔ Effjcient evaluatjon algorithm ➔ Support for ➔ Decision algorithms delegatjon ➔ Support for compositjon

How to Build Access Control Systems Verify Construct Specify Policy PDP Policy ➔ Formal semantjcs ➔ Analysis language ➔ Effjcient evaluatjon algorithm ➔ Support for ➔ Decision algorithms delegatjon ➔ Support for compositjon

Belnap Logic + Datalog = BelLog Belnap Logic (stratjfjed) Datalog Truth ordering (Program) (rule) (literal) (atom) Knowledge ordering

Belnap Logic + Datalog = BelLog Belnap Logic (stratjfjed) Datalog Truth ordering (Program) (rule) (literal) (atom) Knowledge ordering

Belnap Logic + Datalog = BelLog Belnap Logic (stratjfjed) Datalog Truth ordering (Program) (rule) (literal) (atom) Knowledge ordering

Belnap Logic + Datalog = BelLog Belnap Logic (stratjfjed) Datalog Truth ordering (Program) (rule) (literal) (atom) Knowledge ordering BelLog (Program) Negatjon on truth (rule) Negatjon on knowledge (literal) (atom)

Belnap Logic + Datalog = BelLog Belnap Logic (stratjfjed) Datalog Truth ordering (Program) (rule) (literal) (atom) Knowledge ordering Semantjcs Extend stratjfjed Datalog to four- BelLog valued fjxed-point semantjcs (Program) Negatjon on truth (rule) Negatjon on knowledge (literal) (atom)

BelLog Examples

BelLog Examples Transitjve delegatjon

BelLog Examples Transitjve delegatjon Policy targets

BelLog Examples Transitjve delegatjon Policy targets Agreement

BelLog Examples Transitjve delegatjon Policy targets Agreement Confmict-override

BelLog Examples Transitjve delegatjon Policy targets Other idioms? Agreement Confmict-override

How to Build Access Control Systems Verify Construct Specify Policy PDP Policy ➔ Formal semantjcs ➔ Analysis language ➔ Effjcient evaluatjon algorithm ➔ Support for ➔ Decision algorithms delegatjon ➔ Support for compositjon

Policy Analysis Does the policy meet its requirements? Policy Requirements

Policy Analysis Does the policy meet its requirements? Policy Requirements Questjons

Policy Analysis Does the policy meet its requirements? Policy Requirements Questjons Analyzer

Policy Analysis Does the policy meet its requirements? Policy Requirements Questjons Fix Analyzer Counter- Policy example checked

Policy Analysis Does the policy meet its requirements? Policy Requirements How do we Questjons write this? Fix Analyzer Counter- Policy example checked

Policy Analysis Does the policy meet its requirements? Policy Requirements How do we Questjons write this? Fix Decidability? Analyzer Complexity? Counter- Policy example checked

Analysis Questjons Syntax (questjon) (conditjon) – Is policy P2 more permissive than P1 for all inputs that satjsfy the conditjon c ?

Analysis Questjons Syntax (questjon) (conditjon) – Is policy P2 more permissive than P1 for all inputs that satjsfy the conditjon c ? For a given input: Requests granted by P1 Requests All requests granted by P2

Analysis Questjons Syntax (questjon) (conditjon) – Is policy P2 more permissive than P1 for all inputs that satjsfy the conditjon c ? For a given input: Requests granted by P1 Requests All requests granted by P2

Analysis Questjons Syntax (questjon) (conditjon) – Is policy P2 more permissive than P1 for all inputs that satjsfy the conditjon c ? Check for all inputs that For a given input: satjsfy the conditjon Requests granted by P1 Requests All requests granted by P2

Example: Analysis Questjon Policy Requirement If the requester is a project leader, then grant access.

Example: Analysis Questjon Policy Requirement If the requester is a project leader, then grant access. Analysis Questjon

Analysis

Analysis Theorem 1 Policy containment is undecidable

Analysis Theorem 1 Policy containment is undecidable Theorem 2 Policy containment for unary-input policies* is in CO-NEXP-COMPLETE *Unary-input policies – Example:

Analysis Theorem 1 Policy containment is undecidable Theorem 2 Policy containment for unary-input policies* is in CO-NEXP-COMPLETE Theorem 3 Policy containment for a fjnite universe is in CO-NP-COMPLETE *Unary-input policies – Example:

How to Build Access Control Systems Verify Construct Specify Policy PDP Policy ➔ Formal semantjcs ➔ Analysis language ➔ Effjcient evaluatjon algorithm ➔ Support for ➔ Decision algorithms delegatjon ➔ Support for compositjon

Constructjng PDPs Theorem 4 Policy entailment is in PTIME Policy Interpreter htup://bellog.org GitHub htups://github.com/ptsankov/bellog/

Limitatjons – Analysis of administratjve changes – Analysis complexity and tool support – Usability

BelLog Contributjons A foundatjon for Policy analysis composite decentralized framework access control BelLog PDP (www.bellog.org)