1. Ashish Kamra, Elisa Bertino Purdue University Presenter: Ashish Kundu 1

2. The Real Authors 2 bertino@cs.purdue.edu akamra@purdue.edu

3. Motivation  Databases  Anomaly Detection  Anomaly Response  Access Control 3

4. 4

5. Access Control Decision Semantics 5 Request Reference Monitor Allow Deny

6. Extended Decision Semantics 6 Request Reference Monitor Allow Deny Taint Suspend

7. Primary Contribution Mechanism to enhance the decision semantics of an access control implementation 7

8. Why do we want to do that? 8

9. Support for fine-grained intrusion response 9 Request Detection engine Response engine Anomaly Drop Request Log Request 2nd factor of authentication Passive Monitoring

10. Mapping 10 Passive Monitoring Taint decision semantic 2 nd factor of authentication Suspend decision semantics

11. Privilege States - glue for the mapping  Assign states to privileges  Response system changes privilege state  fine-grained response actions  Response : access control decision semantics 11

12. Privilege States 12  “state” to every privilege  a user or role  Five privilege states DENY SUSPEND TAINT GRANT UNASSIGN

13. Privilege State Semantics 13  “DENY”: negative authorizations  “SUSPEND”: request suspension  “TAINT”: request tainting  “GRANT”: standard SQL GRANT  “UNASSIGN”: standard SQL REVOKE

14. Example  U1 is a member of role R1  DBA assigns  SELECT privilege in DENY on T1 to user U1  SELECT privilege in TAINT on T1 to role R1  Privilege state of SELECT on T1 for U1 ??? 14

15. Privilege State Dominance 15 X means ‘X’ overrides ‘Y’ DENY SUSPEND TAINT UNASSIGN GRANT Y

16. Privilege State Transitions + / + + ? ? ? / / / + / + grant deny ? suspend / unassign taint ? + TAINT SUSPEND DENY GRANTREVOKE ? 16

17. Formal model 17 For details, please refer to the paper …

18. Considering Role Hierarchies  Role hierarchy based on privilege inheritance  What about privileges in “deny”, “suspend” and “taint” states? R_parent {insert} R_child {select} 18

19. Privilege Orientation Modes 19 up down neutral unassign, grant deny, taint, suspend

20. Privilege Propagation R8R8 R5R5 R6R6 R7R7 R2R2 R3R3 R4R4 R1R1 20 {select,grant} {insert,deny,down} Recursive Propagation

21. Implementation in PostgreSQL  New SQL commands  TAINT, SUSPEND  Enhanced Access Control Lists  To support privilege states and orientation modes  Re-authentication procedure for a privilege in “suspend” state 21

22. Access Control Check Overhead No Role Hierarchy 22 ACL Size

23. 23 ACL Size Access Control Check Overhead With Role Hierarchy

24. Conclusions  Fine-granular access control in databases  Anomaly response mechanisms  Facilitates policy development  Formal model and experimental evaluation 24