Empowering mobile code using expressive security policies

ABSTRACT

Existing approaches for mobile code security tend to take a conservative view that mobile code is inherently risky, and hence focus on confining it. Such confinement is usually achieved using access control policies that restrict mobile code from taking any action that can potentially be used to harm the host system. While such policies can be helpful in keeping "bad applets" in check, they preclude a large number of useful applets. We therefore take an alternative view of mobile code security, one that is focused on empowering mobile code rather than disabling it. We propose an approach wherein highly expressive security policies provide the basis for such empowerment, while greatly mitigating the risks posed to the host system by such code. Our policies are represented as extended finite state automata, (a generalization of the finite-state automata to permit the use of variables) that can enforce these policies efficiently. We have built a prototype implementation of our approach for Java. Our implementation is based on rewriting Java byte code so that security-relevant events are intercepted and forwarded to the policy enforcement automata before they are executed. Early experimental results indicate that such expressive, enabling policies can be supported with low overheads.

REFERENCES

• 1: BCEL APl Documentation available at http://bcel.sourceforge.net/docs/index.html.
• 2: M. Dahm. Byte code engineering. In Proceedings of JIT 99, 1999.
• 3: Guy Edjlali , Anurag Acharya , Vipin Chaudhary, History-based access control for mobile code, Proceedings of the 5th ACM conference on Computer and communications security, p.38-48, November 02-05, 1998, San Francisco, California, United States [doi>10.1145/288090.288102]
• 4: Úlfar Erlingsson , Fred B. Schneider, SASI enforcement of security policies: a retrospective, Proceedings of the 1999 workshop on New security paradigms, p.87-95, September 22-24, 1999, Caledon Hills, Ontario, Canada [doi>10.1145/335169.335201]
• 5: Ulfar Erlingsson , Fred B. Schneider, IRM Enforcement of Java Stack Inspection, Proceedings of the 2000 IEEE Symposium on Security and Privacy, p.246, May 14-17, 2000
• 6: D. Evans and A. Tywman. Flexible policy directed code safety. In Proceedings of the 1999 IEEE conference on Security and Privacy, 1999.
• 7: Li Gong, Inside Java 2 platform security architecture, API design, and implementation, Addison-Wesley Longman Publishing Co., Inc., Boston, MA, 1999
• 8: L. Gong, M. Mueller, H. Prafullchandra, and R. Schemers. Going beyond the sandbox: An overview of the new security architecture in the java development kit 1.2. In Proceedings of the USENIX Symposium on lnternet Technologies and Systems, 1997.
• 9: Manfred Hauswirth , Clemens Kerer , Roman Kurmanowytsch, A secure execution framework for Java, Proceedings of the 7th ACM conference on Computer and communications security, p.43-52, November 01-04, 2000, Athens, Greece [doi>10.1145/352600.352608]
• 10: J. Hoagland, R. Pandey, and K. Levitt. Specifying security policies using a graphical approach. Technical report, University of California, 1999.
• 11: Andrew C. Myers , Barbara Liskov, Protecting privacy using the decentralized label model, ACM Transactions on Software Engineering and Methodology (TOSEM), v.9 n.4, p.410-442, Oct. 2000 [doi>10.1145/363516.363526]
• 12: Fred B. Schneider, Enforceable Security Policies, Cornell University, Ithaca, NY, 1998
• 13: R. Sekar , C. R. Ramakrishnan , I. V. Ramakrishnan , S. A. Smolka, Model-Carrying Code (MCC): a new paradigm for mobile-code security, Proceedings of the 2001 workshop on New security paradigms, September 10-13, 2001, Cloudcroft, New Mexico [doi>10.1145/508171.508175]
• 14: R. Sekar and P. Uppuluri. Synthesizing fast intrusion prevention/detection systems from high-level specifications. In Proceedings of the USENIX Security Symposium, 1999.
• 15: P. Uppuluri. Pattern matching based intrusion detection systems. Tech report, Computer Science, StonyBrook, 2001.
• 16: D. S. Wallach and E. W. Felten. Understanding java stack inspection. In 1998 IEEE Symposium on Security and Privacy, 1998.

INDEX TERMS

General Terms:
Security

Keywords:
code transformation, mobile code security, security policies