Detecting and resolving policy misconfigurations in access-control systems

ABSTRACT

Access-control policy misconfigurations that cause requests to be erroneously denied can result in wasted time, user frustration and, in the context of particular applications (e.g., health care), very severe consequences. In this paper we apply association rule mining to the history of accesses to predict changes to access-control policies that are likely to be consistent with users' intentions, so that these changes can be instituted in advance of misconfigurations interfering with legitimate accesses. Instituting these changes requires consent of the appropriate administrator, of course, and so a primary contribution of our work is to automatically determine from whom to seek consent and to minimize the costs of doing so. We show using data from a deployed access-control system that our methods can reduce the number of accesses that would have incurred costly time-of-access delays by 44%, and can correctly predict 58% of the intended policy. These gains are achieved without increasing the total amount of time users spend interacting with the system.

REFERENCES

• 1: Rakesh Agrawal , Ramakrishnan Srikant, Fast Algorithms for Mining Association Rules in Large Databases, Proceedings of the 20th International Conference on Very Large Data Bases, p.487-499, September 12-15, 1994
• 2: E. S. Al-Shaer and H. H. Hamed. Discovery of policy anomalies in distributed firewalls. In Proceedings of the 23rd INFOCOM, March 2004.
• 3: Andrew W. Appel , Edward W. Felten, Proof-carrying authentication, Proceedings of the 6th ACM conference on Computer and communications security, p.52-62, November 01-04, 1999, Kent Ridge Digital Labs, Singapore [doi>10.1145/319709.319718]
• 4: Y. Bartal, A. J. Mayer, K. Nissim, and A. Wool. Firmato: A novel firewall management toolkit. In Proceedings of the 1999 IEEE Symposium on Security and Privacy, May 1999.
• 5: Lujo Bauer , Lorrie Faith Cranor , Michael K. Reiter , Kami Vaniea, Lessons learned from the deployment of a smartphone-based access-control system, Proceedings of the 3rd symposium on Usable privacy and security, July 18-20, 2007, Pittsburgh, Pennsylvania [doi>10.1145/1280680.1280689]
• 6: L. Bauer, S. Garriss, J. M. McCune, M. K. Reiter, J. Rouse, and P. Rutenbar. Device-enabled authorization in the Grey system. In Information Security: 8th International Conference, ISC 2005 (Lecture Notes in Computer Science 3650), pages 63--81, 2005.
• 7: L. Bauer, S. Garriss, and M. K. Reiter. Efficient proving for practical distributed access-control systems. In Proceedings of the 12th European Symposium on Research in Computer Security (ESORICS), 2007.
• 8: Moritz Y. Becker , Peter Sewell, Cassandra: Flexible Trust Management, Applied to Electronic Health Records, Proceedings of the 17th IEEE workshop on Computer Security Foundations, p.139, June 28-30, 2004 [doi>10.1109/CSFW.2004.7]
• 9: Trust-X: A Peer-to-Peer Framework for Trust Establishment, IEEE Transactions on Knowledge and Data Engineering, v.16 n.7, p.827-842, July 2004 [doi>10.1109/TKDE.2004.1318565]
• 10: Matt Blaze , Joan Feigenbaum , Jack Lacy, Decentralized Trust Management, Proceedings of the 1996 IEEE Symposium on Security and Privacy, p.164, May 06-08, 1996
• 11: Khalid El-Arini , Kevin Killourhy, Bayesian detection of router configuration anomalies, Proceedings of the 2005 ACM SIGCOMM workshop on Mining network data, August 26-26, 2005, Philadelphia, Pennsylvania, USA [doi>10.1145/1080173.1080190]
• 12: N. C. Goffee, S. H. Kim, S. Smith, P. Taylor, M. Zhao, and J. Marchesini. Greenpass: Decentralized, PKI-based authorization for wireless LANs. In Proceedings of the 3rd Annual PKI Research and Development Workshop, 2004.
• 13: Scott Hazelhurst , Adi Attar , Raymond Sinnappan, Algorithms for Improving the Dependability of Firewall and Filter Rule Lists, Proceedings of the 2000 International Conference on Dependable Systems and Networks (formerly FTCS-30 and DCCA-8), p.576-585, June 25-28, 2000
• 14: Trent Jaeger , Xiaolan Zhang , Antony Edwards, Policy management using access control spaces, ACM Transactions on Information and System Security (TISSEC), v.6 n.3, p.327-364, August 2003 [doi>10.1145/937527.937528]
• 15: Trevor Jim, SD3: A Trust Management System with Certified Evaluation, Proceedings of the 2001 IEEE Symposium on Security and Privacy, p.106, May 14-16, 2001
• 16: A. D. Keromytis, S. Ioannidis, M. B. Greenwald, and J. M. Smith. The STRONGMAN architecture. In Third DARPA Information Survivability Conference and Exposition, 2003.
• 17: Martin Kuhlmann , Dalia Shohat , Gerhard Schimpf, Role mining - revealing business roles for security administration using data mining technology, Proceedings of the eighth ACM symposium on Access control models and technologies, June 02-03, 2003, Como, Italy [doi>10.1145/775412.775435]
• 18: Franck Le , Sihyung Lee , Tina Wong , Hyong S. Kim , Darrell Newcomb, Minerals: using data mining to detect router misconfigurations, Proceedings of the 2006 SIGCOMM workshop on Mining network data, p.293-298, September 11-15, 2006, Pisa, Italy [doi>10.1145/1162678.1162681]
• 19: N. Li and J. C. Mitchell. Rt: A role-based trust-management framework. In Proceedings of The Third DARPA Information Survivability Conference and Exposition, 2003.
• 20: Alain Mayer , Avishai Wool , Elisha Ziskind, Fang: A Firewall Analysis Engine, Proceedings of the 2000 IEEE Symposium on Security and Privacy, p.177, May 14-17, 2000
• 21: R. L. Rivest and B. Lampson. SDSI--A simple distributed security infrastructure. Presented at CRYPTO'96 Rumpsession, April 1996.
• 22: Ravi S. Sandhu , Edward J. Coyne , Hal L. Feinstein , Charles E. Youman, Role-Based Access Control Models, Computer, v.29 n.2, p.38-47, February 1996 [doi>10.1109/2.485845]
• 23: Jürgen Schlegelmilch , Ulrike Steffens, Role mining with ORCA, Proceedings of the tenth ACM symposium on Access control models and technologies, June 01-03, 2005, Stockholm, Sweden [doi>10.1145/1063979.1064008]
• 24: Marianne Winslett , Charles C. Zhang , Piero A. Bonatti, PeerAccess: a logic for distributed authorization, Proceedings of the 12th ACM conference on Computer and communications security, November 07-11, 2005, Alexandria, VA, USA [doi>10.1145/1102120.1102144]
• 25: Avishai Wool, Architecting the Lumeta firewall analyzer, Proceedings of the 10th conference on USENIX Security Symposium, p.7-7, August 13-17, 2001, Washington, D.C.
• 26: Lihua Yuan , Jianning Mai , Zhendong Su , Hao Chen , Chen-Nee Chuah , Prasant Mohapatra, FIREMAN: A Toolkit for FIREwall Modeling and ANalysis, Proceedings of the 2006 IEEE Symposium on Security and Privacy, p.199-213, May 21-24, 2006 [doi>10.1109/SP.2006.16]
• 27: Y. Yuan and T. Huang. A matrix algorithm for mining association rules. In International Conference on Intelligent Computing (ICIC), 2005.

INDEX TERMS

Primary Classification:
  D. Software
  D.4 OPERATING SYSTEMS
      D.4.6 Security and Protection
          Subjects: Access controls

Additional Classification:
  H. Information Systems
  H.2 DATABASE MANAGEMENT
      H.2.0 General
          Subjects: Security, integrity, and protection**

  K. Computing Milieux
  K.6 MANAGEMENT OF COMPUTING AND INFORMATION SYSTEMS
      K.6.5 Security and Protection (D.4.6, K.4.2)
          Subjects: Authentication

General Terms:
Human Factors, Performance, Security