Access Control in Web Applications Peter Trommler Faculty of Computer Science Georg Simon Ohm University Nuremberg, Germany U = R I

Prof. Dr. Peter Trommler Faculty of Computer Science Agenda Programming errors and security Access control engineering Metamodel Implementation

Prof. Dr. Peter Trommler Faculty of Computer Science Context Web applications access corporate databases Hundreds if not thousands of vulnerabilities Vulnerabilities are symptoms Few root causes

Prof. Dr. Peter Trommler Faculty of Computer Science Types of Programming Errors [Pfleeger] Buffer Overflow int a[3]; a[3]=1; Incomplete Mediation February 30; 4, code injection (SQL, shell,...) Time-of-Check-Time-of Use back-end identifiers (primary key) no check on parameter returned

Prof. Dr. Peter Trommler Faculty of Computer Science Motivation

Prof. Dr. Peter Trommler Faculty of Computer Science “Solution”

Prof. Dr. Peter Trommler Faculty of Computer Science Challenges Access control decisions everywhere Difficult to check completeness audit for correctness read and understand Dependencies on other code Separate AC from app code

Prof. Dr. Peter Trommler Faculty of Computer Science Protection Mechanisms Reject “illegal” transactions Interception mechanism Web application Application Firewall Filtering Servlet AOP, MDA before/after methods Parameterized Views SQL Screening Internet

Prof. Dr. Peter Trommler Faculty of Computer Science Business Rule or Security Show list of customer’s accounts omit one: business show one too many: security Many business rules have security flavor Challenge: extract security requirements

Prof. Dr. Peter Trommler Faculty of Computer Science Access Control Engineering Identify access control requirements early Refine with refining of functional requirements Automate steps Verify correctness of refinements Manually review rule set (audit)

Prof. Dr. Peter Trommler Faculty of Computer Science Security Requirements Engineering [Giorgini] Object-level modeling re-use requirements framework i*/Tropos, KAOS, UML hard to model more general rules Meta-level modeling add new linguistic constructs UMLSec [Jürjens], Secure UML [Lodderstedt] integration with MDA

Prof. Dr. Peter Trommler Faculty of Computer Science Observation: User’s “Own” Data Navigate relations between tables/classes Restrict access columns/fields methods OO-Views Parameterized Views [Roichman] Anchor entity/object

Prof. Dr. Peter Trommler Faculty of Computer Science Temporal Logic View solution after assignment submitted Can submit assignment only once Temporal Logic of Actions vs. Interval Temporal Logic [Janicke] Traces in database certain object exists AC decision depends on current system state

Prof. Dr. Peter Trommler Faculty of Computer Science Modeling Implementation Level Reachability in relations graph O(n) n: # objects in transitive closure (“own” objects) caching AC method/fields through facades additional call indirection static check Existence of traces O(1): hashes, DB indices

Prof. Dr. Peter Trommler Faculty of Computer Science Implementation specify trace for each temporal quantifier specify navigation graph for each subject role Manual specify object level rules verify correctness [Hu] Automatic generate code

Prof. Dr. Peter Trommler Faculty of Computer Science Conclusion Time-of-Check-Time-of-Use Web application partially untrusted Separate access control from application code Metamodel Efficient implementation Code generation

Prof. Dr. Peter Trommler Faculty of Computer Science References [Pfleeger] C. P. Pfleeger, S. Lawrence Pfleeger: Security in Computing, 4 th ed, Prentice Hall PTR, [Giogini] P. Giorgini, F. Massaci, N. Zannone: Security and Trust Requirements Engineering. [Jürjens] J. Jürjens: Secure Systems Development with UML, Springer Verlag, [Lodderstedt] T. Lodderstedt, D. Basin, J. Doser: A UML-based Modeling Language for Model Driven Security, in Proc. of UML’02, LNCS 2460, Springer Verlag, [Roichman] A. Roichman, E. Gudes: Fine-grained Access Control to Web Databases, in Proc. of SACMAT’07, ACM, [Janicke] H. Janicke, A. Cau, H. Zedan: A note on the formalization of UCON, in Proc. of SACMAT’07, ACM, [Hu] H.Hu, G.-J. Ahn: Enabling Verification and Conformance Testing for Access Control Model, in Proc. of SACMAT’08, ACM, 2008.