Observation-Based Fine Grained Access Control for ... - Google Sites

OFGAC For XML Documents

Observation-Based Fine Grained Access Control for XML Documents Raju Halder, Agostino Cortesi DAIS, Universit` a Ca’ Foscari Venezia, Italy {halder, cortesi}@unive.it

CISIM’2011, Kolkata, India

OFGAC For XML Documents

Outline FGAC Vs. OFGAC Need of OFGAC: Motivating Example Policy Specifications under OFGAC OFGAC Approaches for XML Collusion Attacks Multiple policies/Single abstraction Single policy/Multiple abstraction Multiple policies/Multiple abstraction Conclusions

OFGAC For XML Documents FGAC Vs. OFGAC

FGAC Vs. OFGAC I

Traditional Access Control is coarse-grained and can be applied on file/document level. Problem - Split any XML file containing data with both public and private protection requirements.

I

Fine Grained Access Control (FGAC) can be applied at lower level such as individual attribute/element level.

I

FGAC provides two views to data: private/confidential and public/non-confidential. Problem - Too restrictive and impractical in some real systems where intensional leakage of the information to some extent is allowed.

OFGAC For XML Documents FGAC Vs. OFGAC

Observation-based Fine Grained Access Control (OFGAC) I

Many applications need a partial or relaxed view of some confidential information. Example: Access of Credit Card no. (last 4 digits are non-confidential and remaining digits are confidential) by Customer-Care Personnel

I

We introduced Observation-based Fine Grained Access Control (OFGAC). Aim: Provide accessibility of sensitive information at various levels of abstractions depending on their sensitivity level.

I

OFGAC is based on the Abstract Interpretation framework.

OFGAC For XML Documents Need of OFGAC: Motivating Example

A Motivating Example

140062 John Smith Via Pasini 62 Venezia Italy 30175 +39 3897745774

IT10G 02006 02003 000011115996 Savings 50000 4023 4581 8419 7835 12/15 165

OFGAC For XML Documents Need of OFGAC: Motivating Example

Need of OFGAC: Motivating Example Bank’s Policy for Customer-Care Personnel: I

Credit Card No: “4023 4581 8419 7835”→“xxxx xxxx xxxx 7835”.

I

IBAN No: “IT10G 02006 02003 000011115996”→“ITxxx xxxxx xxxxx xxxxxxxxxxxx”.

I

Expiry dates and Secret Numbers of credit cards→fully-sensitive.

I

Deposited amounts in accounts→fully-sensitive.

FGAC mechanisms are unable to implement this scenario. One possibility: split the partial sensitive element into two sub-elements - one with private privilege and other with public.

OFGAC For XML Documents Policy Specifications under OFGAC

FGAC Policy Specifications I

I

Specified by a 5-tuple: hSubject, Object, Action, Sign, Typei. (Damiani et al., 2002) I

Subject: Identifiers or Locations of the access requests. Example: h Physicians, 159.101.*.*, *.hospital.com i.

I

Object: Uniform Resource Identifier (URI) of the elements or attributes. Example: /BankCustomers/Customer/AccountInfo/IBAN

I

Action: “read” or “write” or both.

I

Sign: “+”→“allow access”, and “-”→“forbid access”.

I

Type: DTD/instance level, local/recursive access, hard/soft etc.

Provides only two choices: either “allow” or “forbid”, we call it Binary-based FGAC Policy for XML.


OFGAC Policy Specifications I

Specified by 5-tuple: hSubject, Object, Action, Abstraction, Typei.

I

Abstraction: Defined by the Galois Connection (℘(Dxcon ), αx , γx , Dxabs ) where αx = ℘(Dxcon ) → Dxabs and γx = Dxabs → ℘(Dxcon ).

Rule R1

Subject customer-care, 159.56.*.*, *.Unicredit.it

Object /BankCustomers/ tomer/ PersInfo

Action read

Abstraction (℘(Dxcon ), id, id, ℘(Dxcon ))

Type R

R2

customer-care, 159.56.*.*, *.Unicredit.it

/BankCustomers/ Customer/ AccountInfo/ IBAN /BankCustomers/ Customer/ AccountInfo/ type /BankCustomers/ Customer/ AccountInfo/ amount

read

con ), α abs (℘(Diban iban , γiban , Diban )

L

R3


read

con ), id, id, ℘(D con )) (℘(Dtype type

L

R4


read

con (℘(Damount ), α> , γ> , {>})

L

R5


/BankCustomers/ Customer/ CreditCardInfo/ CardNo /BankCustomers/ Customer/ CreditCardInfo/ ExpiryDate

read

con abs (℘(DCardNo ), αCardNo , γCardNo , DCardNo )

L

R6


read

con (℘(DExDate ), α> , γ> , {>})

L

Cus-


OFGAC Policy Specifications

Abstraction Function for “IBAN” and “SecretNo”: αCardNo ({di : i ∈ [1 . . . 16]}) = ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ d13 d14 d15 d16 α> (X ) = > X = set of concrete values > = top most element of the corresponding abstract lattice.

OFGAC For XML Documents OFGAC Approaches for XML

Approaches: FGAC Vs. OFGAC Possible FGAC Approaches: View-based, NFA-based, RDBMS-based etc.

OFGACRD(op)

RDBMS

Tunable Access Control

FGACRD(p) Flattening

Mapping OFGACXML(op) XML

FGACXML(p)

Binary (0/1) Access Control


View-based OFGAC approach For each subject, separate views are generated w .r .t. the access rules associated with the subject

140062 John Smith Via Pasini 62 Venezia Italy 30175 +39 3897745774

IT*** ***** ***** ************ Savings > **** **** **** 7835 > >


View-based OFGAC approach

XML Query: Qxml = /BankCusomers/Customer /AccountInfo[@type = “Savings 00 ]

Result of XML query on the view: IT*** ***** ***** ************ Savings >


RDBMS-based OFGAC approach Table: The equivalent relational database representation of the XML code id BC1

pid null

rule -

id C1

(a) “BankCustomers” id PI1

pid C1

pid BC1

rule -

(b) “Customer ”

rule R1

id AI1

(c) “PersInfo”

pid C1

rule -

(d) “AccountInfo”

id CI1

pid C1

rule -

(e) “CreditCardInfo” id IB1

pid AI1

val IT10G 02006 02003 000011115996

rule R2

(f) “IBAN” id TP1

pid AI1

val Savings

rule R3

id AM1

(g) “type” id CN1

pid CI1

val 4023 4581 8419 7835

(i) “CardNo”

pid AI1

val 5000

rule R4

(h) “amount” rule R5

id EX1

pid CI1

val 12/15

(j) “ExpiryDate”

rule R6


RDBMS-based OFGAC approach Query in XML format: Qxml = /BankCusomers/Customer /AccountInfo[@type = “Savings 00 ]/IBAN

Query in SQL format: Qrdb =SELECT Ch No.val FROM IBAN Ch No, type Ch Tp, AccountInfo P AccInfo, Cust P Cust, BankCust P BCust WHERE (Ch No.pid = P AccInfo.id AND Ch Tp.pid = P AccInfo.id AND Ch Tp.val = “Savings 00 ) AND P AccInfo.pid = P Cust.id AND P Cust.pid = P BCust.id

Result (applying SQL query on RDBMS under OFGAC): val IT*** ***** ***** ************

OFGAC For XML Documents Collusion Attacks Multiple policies/Single abstraction



Multiple policies/Single abstraction I

n observers O1 , . . . , On under n different policies op1 , . . . , opn .

I

σopi : Concrete XML database state under policy opi .

I

] σop = α(σopi ): Abstract XML database state. i

Observer O1 Policy op1

α


α


α


Multiple policies/Single abstraction I

I

] ] ] ] 0 Let σop = {σl] , σh] } and σop 0 = {σl 0 , σh0 } under op and op respectively. ] XML database state σop•op 0 under combined policies: ] ] ] ] ] ] ] σop•op 0 = {((σl ∪ σh ) − (σh ∩ σh0 )), (σh ∩ σh0 )}

I

After collusion, observer can infer the values belonging to the public part ((σl ∪ σh ) − (σh ∩ σh0 )). Policy op

Policy op’

op • op’

Figure: Combination of policies

OFGAC For XML Documents Collusion Attacks Single policy/Multiple abstraction



Single policy/Multiple abstraction: I

n different observers O1 , . . . , On under same policy op.

I

Different level of abstraction to different observers Oi .

I

The result of a query for the one with higher abstraction contains less precise information than that with lower abstraction.

α2

Observer O Policy op

Policy op

α1 Observer O Policy op


Single policy/Multiple abstraction I

Suppose D2abs is an abstraction of D1abs .

I

When O1 and O2 collude, O2 can obtain sensitive information with lower abstraction from the result of O1 .

I

But no real collusion may arise: overall information available to O1 and O2 together is at most as precise as to O1 . O1 1

D

abs

Query Q

ξ1 Policy op

Common Part O2 D2abs

Query Q

ξ2


Single policy/Multiple abstraction I

Let the sensitive values in a XML file be h5, 0, 2, 3, 1i.

I

O1 −−−−−→ h[4, 5], [0, 1], [2, 3], [2, 3], [0, 1]i

I

O2 −−−−−→ hODD, EVEN, EVEN, ODD, ODDi.

I

When O1 and O2 collude −−→ h5, 0, 2, 3, 1i , by combining the query results containing the above list.

Abstract

Abstract

infer

EVEN

0

1

ODD

2

[0,1]

3

[2,3]

[4,5]

….

[2n, 2n+1]

2n

2n+1

⊥

Figure: Combined lattice of DOM and PAR


Single policy/Multiple abstraction Definition An OFGAC under Single policy/Multiple level abstraction scenario is collusion-prone, if the OFGAC uses n different abstract domains D1abs , . . . , Dnabs for n different observers and abs abs ∃{d T i , . . . , dj } ∈ Di × · · · × Dj for {i, . . . , j} ⊆ {1, . . . , n} such that k∈{i,...,j} γ(dk ) = {e} while ∀k ∈ {i, . . . , j}, γ(dk ) 6= {e}.

Theorem Consider an OFGAC using n different abstract domains D1abs , . . . , Dnabs for n different observers under the same policy. Let DR be the reduced product of {D1abs , . . . , Dnabs }. If DR is isomorphic to γ(DR ), then the OFGAC is collusion-prone.

OFGAC For XML Documents Collusion Attacks Multiple policies/Multiple abstraction


OFGAC For XML Documents Collusion Attacks Multiple policies/Multiple abstraction

Multiple policies/Multiple abstraction I

n observers O1 , . . . , On under n different policies op1 , . . . , opn .

I

] Abstract XML database state σop = αi (σopi ) for i = 1, . . . , n. i

I

Observers collude and act as the observer under combined policies, or try to infer confidential information by combining query results. Observer O1 Policy op1

α1


α2


α3

OFGAC For XML Documents Conclusions

Conclusions

I

We extended the notion of Observation-based Fine Grained Access Control (OFGAC), on top of fine grained access control, to the context of XML documents.

I

Confidential information are abstracted by their observable properties.

I

The traditional FGAC can be seen as a special case of our OFGAC.


Suggestions Please !!!!


Thank you for your attention !