Cooperative Secondary Authorization Recycling Qiang Wei, Matei - PowerPoint PPT Presentation

Cooperative Secondary Authorization Recycling Qiang Wei, Matei Ripeanu, Konstantin Beznosov Laboratory for Education and Research in Secure Systems Engineering (lersse.ece.ubc.ca) University of British Columbia

Typical Authorization Architecture protected application objects (request, allow) application authorization response response Policy Policy Decision Enforcement subject Point Point application authorization (PDP) (PEP) request request client (subject, authorization application object, read) server server Also known as request-response paradigm e.g. IBM Access Manager, EJB, XACML 2 Laboratory for Education and Research in Secure Systems Engineering (lersse.ece.ubc.ca)

Motivation Problems PEP reduced availability reduced PDP scalability PEP PEP 3 Laboratory for Education and Research in Secure Systems Engineering (lersse.ece.ubc.ca)

Secondary and Approximate Authorization Model (SAAM) PEP SDP PDP Secondary Authorization PEP SDP Recycling Secondary Decision Point (SDP) PEP SDP 1. reuse cached responses 2. infer approximate responses 4 Laboratory for Education and Research in Secure Systems Engineering (lersse.ece.ubc.ca)

Cooperative Secondary Authorization Recycling SDP Discovery SDP Service each SDP serves only its own PEP! SDP all SDPs cooperate to serve all PEPs 5 Laboratory for Education and Research in Secure Systems Engineering (lersse.ece.ubc.ca)

A Simplified Example new request allow Alice’s subject (an approximate response) SDP id= Alice role= preferred customer Discovery SDP Service previous request allow SDP Bob’s subject id= Bob role= customer 6 Laboratory for Education and Research in Secure Systems Engineering (lersse.ece.ubc.ca)

Contributions SDP � Proposed • the concept of Discovery SDP Service cooperative secondary authorization recycling • system architecture & SDP detailed design � Evaluated • availability • performance 7 Laboratory for Education and Research in Secure Systems Engineering (lersse.ece.ubc.ca)

Key Design Features 8 Laboratory for Education and Research in Secure Systems Engineering (lersse.ece.ubc.ca)

Consistency: Support Critical Policy Changes Critical (t) Policy Store Policy Changes Security SDP Administrator Policy Change Detect Manager SDP propagate policy changes to affected 1. find affected SDPs SDPs immediately 2. find affected caches SDP 9 Laboratory for Education and Research in Secure Systems Engineering (lersse.ece.ubc.ca)

Consistency : Support Time-sensitive Policy Changes Time-sensitive Policy Store Policy Changes Security SDP Administrator Policy Change A TTL approach: Detect Manager delete expired SDP responses periodically SDP 10 Laboratory for Education and Research in Secure Systems Engineering (lersse.ece.ubc.ca)

Support Untrusted Remote SDPs Trusts Trusts Trusted by PDP PEP SDP all SDPs Verify responses made by Does NOT remote SDPs Trust 1. verify the authenticity and integrity Malicious SDP SDP SDP 2. verify the correctness of inference 11 Laboratory for Education and Research in Secure Systems Engineering (lersse.ece.ubc.ca)

Configurability � Three decision points • local SDP & remote SDPs & the PDP � To reduce network traffic & PDP’s load • sequential authorization 1 2 remote PEP SDP PDP SDPs 3 � To reduce the response time • concurrent authorization 1 1 remote PEP SDP PDP SDPs 1 12 Laboratory for Education and Research in Secure Systems Engineering (lersse.ece.ubc.ca)

Evaluation Results via simulation & prototype implementation 13 Laboratory for Education and Research in Secure Systems Engineering (lersse.ece.ubc.ca)

Simulation-based Evaluation � Metrics • cache hit rate training set � Methodology simulation engine testing set � Affecting factors |cached requests without replacement| • cache warmness = |total possible requests| • number of cooperating SDPs SDP1 SDP2 |R 12 | • overlap rate O 12 = |R 1 | R – resource space 14 Laboratory for Education and Research in Secure Systems Engineering (lersse.ece.ubc.ca)

Hit Rate Dependence on Cache Warmness 5 SDPs High hit rate is achieved even when cache warmness is low 15 Laboratory for Education and Research in Secure Systems Engineering (lersse.ece.ubc.ca)

Hit Rate Dependence on Number of SDPs 10% cache warmness at each SDP Increasing the number of cooperating SDPs leads to higher hit rates Additional SDPs provide diminishing returns 16 Laboratory for Education and Research in Secure Systems Engineering (lersse.ece.ubc.ca)

Prototype-based Evaluation � Metrics • average client-perceived response time • hit rate PEP SDP � Methodology JAVA RMI discovery PDP test service driver � Affecting factors PEP SDP • number of requests • response verification • frequency of policy change 17 Laboratory for Education and Research in Secure Systems Engineering (lersse.ece.ubc.ca)

Response Time Dependence on Number of Requests 4 SDPs (CSAR), 100% overlap, 40ms RTT between PDP and each SDP 1. Cooperation can contribute to reduced response time 2. The impact of response verification is small 18 Laboratory for Education and Research in Secure Systems Engineering (lersse.ece.ubc.ca)

How will regular policy changes affect hit rate? 1 SDP 2. Cumulative effect of policy changes is significant 1. Hit-rate drop caused by each policy change is small 2. More frequent policy changes lead to lower hit rates 1. The hit rates stabilize after the knee 19 Laboratory for Education and Research in Secure Systems Engineering (lersse.ece.ubc.ca)

How does cooperation help? 100% overlap, policy changes at 100 requests/change Cooperation improves hit rates when policy changes 20 Laboratory for Education and Research in Secure Systems Engineering (lersse.ece.ubc.ca)

Related Work Collaborative security CSAR ( Locasto et al. 2006, Costa et al. 2005 ) Secondary and Approximate Collaborative Authorization Model (SAAM) web caching ( Crampton et al. 2006, Beznosov 2005 ) ( Lyer et al. 2002, Wolman et al. 1999, Chankhunthod et al. 1996 ) Authorization recycling ( Bauer et al. 2005, Borders et al. 2005 ) 21 Laboratory for Education and Research in Secure Systems Engineering (lersse.ece.ubc.ca)

Summary SDP PE P reduced availability reduced Discovery PD SDP Service scalability P PE P PE SDP P 22 Laboratory for Education and Research in Secure Systems Engineering (lersse.ece.ubc.ca)

lersse.ece.ubc.ca 23 Laboratory for Education and Research in Secure Systems Engineering (lersse.ece.ubc.ca)