Secure Context-sensitive Authorization Kazuhiro Minami and David Kotz Dartmouth College

Context-sensitive Authorization Projector Smart Meeting Room Request Guest Speaker I cannot verify your identity.

Context-sensitive Authorization Projector Smart Meeting Room Request Guest Speaker Location Information Since you are in the room, I authorize you to control me. Location Sensor

Centralized Approach Resource Authorization Server Information Servers Requester Request Authorization Query Granting Decision Context Information Location Server Integrity (make correct decisions) Confidentiality (not to disclose confidential information) Role Server

Smart Room Scenario Speaker Projector Location Server Request Location Query WIFI Location Server GPS Location Server Access Point Query GPS Coordinate Query

Distributed Rule-based Authorization Central server Proof Tree Authorization Query Host A Host B Host C Sub-Proof Tree Sub-Proof Tree Sub-Proof Tree Authorization Query Logical Query

Goals Confidentiality –Preserve each principal’s confidentiality policies Integrity –Each principal receives a proof that satisfies its integrity policies Scalability –Offload work from a central server

Outline Rule-based authorization Security model Distributed query processing Enforcement algorithm Summary

Rule-based Authorization Inference Engine Knowledge Base grant(P, projector)  location(P, room112) location(P,L)  owner(P,D)  location(D,L) owner(Bob, badge15) location(badge15, room112) Authorization Server ?grant(Bob, projector) Proof Tree Rules Facts

Example Proof Tree ?grant(Bob, projector) grant(Bob)  location(Bob, meeting_room) location(Bob,meeting_room)  owner(Bob, badge15)  location(badge15, room112)) owner(Bob, badge15) location(badge15, room112)

Example Proof Tree ?grant(Bob, projector) grant(Bob)  location(Bob, meeting_room) location(Bob,meeting_room)  owner(Bob, badge15)  location(badge15, room112)) owner(Bob, badge15) location(badge15, room112)

Security Model Resource Authorization Policies / Facts Confidentiality / Integrity Policies

Security Model Host A (Alice)Host B (Dave) grant(P, projector)  location(P, room112) owner(Bob, pda15) location(pda15, room112) location(P,L)  owner(P,D)  location(D,L) ?location (Bob, room112) Confidentiality Policies acl(location(P,L)) = {Alice} acl(owner(P,D)) = {Dave} Integrity Policies trust(location(P,L)) = {Dave} TRUE

Assumptions Policies apply only to facts –Each principal issues a query to a principal that satisfies its integrity policies Integrity policies are public knowledge Public key infrastructure is available

Outline Rule-based authorization Security model Distributed query processing Enforcement algorithm Summary

Architectural Overview Use r Resource Request Host Authorization Query Host Logical Query

Decomposition of Proof Tree Principal p 0 p1p1 p2p2 Query A handler principal only returns a query result (true or false) T0T0 n0n0 T1T1 n1n1 q0q0 T2T2 q1q1

Decomposition of Proof Tree Principal p 0 p1p1 p2p2 T0T0 T1T1 T2T2 n0n0 n1n1 All the nodes except for the root node are not disclosed. q0q0 q1q1 Query

Enforcement of Confidentiality Policies Principal p 0 p1p1 p2p2 T0T0 T1T1 T2T2 n0n0 A handler principal chooses a receiver principal from its upstream principals. K0K0 K0K0 K0K0 acl(q 1 ) = {p 0 } Confidentiality policy q0q0 q1q1 Query

Enforcement of Confidentiality Policies Principal p 0 p1p1 p2p2 T0T0 T1T1 T2T2 n0n0 A handler principal chooses a receiver principal from its upstream principals. K0K0 K0K0 acl(q 1 ) = {p 0 } Confidentiality policy q0q0 q1q1 Query

Outline Rule-based authorization Security model Distributed query processing Enforcement algorithm Summary

Enforcement Algorithm p0p0 p1p1 p2p2 p3p3 q0q0 q1q1 q2q2

p0p0 p1p1 p2p2 p3p3 q0q0 q1q1 q2q2 acl(q 2 ) = {p 0,p 1 } Security Policies

Enforcement Algorithm p0p0 p1p1 p2p2 p3p3 q0q0 q1q1 q2q2 acl(q 2 ) = {p 0,p 1 } Security Policies

Enforcement Algorithm p1p1 p2p2 p3p3 q0q0 q1q1 q2q2 p4p4 p5p5 (p 1, ((pf 4 )(pf 5 )) K1 )) (p 1,((pf 4 )(pf 5 )) K1 ) (p 0,(pf 4 ) K0 ) p0p0 p0p0 TRUE pf 4  (P 0, (TRUE) K0 ) pf 5  (P 1, (TRUE) K1 ) q3q3 q4q4

p1p1 Enforcement Algorithm p0p0 p2p2 p3p3 q0q0 q1q1 q2q2 p4p4 p5p5 pf 4  (P 0, (TRUE) K0 ) q3q3 pf 5  (P 1, (TRUE) K1 ) pf 3  (p 0, ((pf 4 )(pf 5 )) K0 )) (p 1,(pf 3 ) K1 )(p 0,(pf 3 ) K0 ) p1p1 pf 5 cannot be decrypted!

Attack by Colluding Principals p1p1 p2p2 p3p3 (q 0, [p 0 ]) (q 1,[p 0,p 1 ]) p4p4 p5p5 p0p0 p0p0 p0p0

Attack by Colluding Principals p1p1 p2p2 p3p3 (q 0, [p 0 ]) (q 1,[p 1,p 0 ]) p4p4 p5p5 p0p0 p0p0 p0p0

Attack by Colluding Principals p1p1 p2p2 p3p3 (q 0, [p 0 ]) (q 1,[p 1,p 0 ]) p4p4 p5p5 p0p0 p0p0 (q 2,[p 1,p 0,p 2 ]) p0p0

Attack by Colluding Principals p1p1 p2p2 p3p3 (q 0, [p 0 ]) (q 1,[p 1,p 0 ]) p4p4 p5p5 (p 0, ((pf 4 )(pf 5 ))))(p 1,((pf 4 )(pf 5 ))) p0p0 p0p0 (q 2,[p 1,p 0,p 2 ]) q 2 ’s result is FALSE acl(q 2 ) = {p 0 } Security Policies q3q3 pf 4  (P 0, (TRUE) K0 ) pf 5  (P 1, (FALSE) K1 ) q4q4 p0p0

Related Work Rule-based Authorization –Cerberus [Al-Muhtadi, Ranganathan, Cambell, Mickunas] PerCom 2003 –[Myles, Friday, Davies] IEEE Pervasive Computing 2003 Role-based Access Control –Generalized RBAC [Covington, Ahamad, Srinivasan] SACMAT 2001 –OASIS [Bacon, Moody, Yao] SACMAT 2002 Trust Management System –SD3 [Jim] IEEE S&P 2001

Summary Distributed authorization system that addresses the issue of confidential rules and facts Proof decomposition based on integrity policies Recursive encryption facilitates information sharing among principals Future work includes the evaluation of the performance and scalability

Questions

Trusted Proof Tree A handler principal only returns a proof subtree that satisfies the querier’s integrity policies Querier Handler Query Proof

Trusted Proof Tree A handler principal only returns a proof subtree that satisfies the querier’s integrity policies Querier Handler Query Proof

Trusted Proof Tree A handler principal only returns a proof subtree that satisfies the querier’s integrity policies Querier Handler Query Proof

First-Responder Scenario First Responder Situation Monitor Server Role Server of Fire Department Location Server Role Server of Incident Management System Request Role Membership Query Role membership query Location Query Responder Assistance Integrity Confidentiality

Current Status and Future Work Prototype implementation based on XProlog Evaluation of the performance and scalability User feedback mechanism