Types for Role-based Access Control of Dynamic Web Data

Transcription

1 Types for Role-based Access Control of Dynamic Web Data Mariangiola Dezani-Ciancaglini 1 Silvia Ghilezan 2 Svetlana Jakšić 2 Jovanka Pantović 2 1 Università di Torino 2 University of Novi Sad SVARM 2010, Edinburgh

2 Outline 1 Motivation Related Work Access control - RXdπ-calculus 2 RXdπ-calculus Syntax Semantics 3 Types Types Safety

4 Distributed systems - decentralised peer-to-peer networks management of semi-structured and distributed data processes with different roles have different access rights different access policies in different locations exchange between data and processes preserving access control dynamic changes of access rights One solution - typed models control of access control of movements rights

5 Distributed systems - decentralised peer-to-peer networks management of semi-structured and distributed data processes with different roles have different access rights different access policies in different locations exchange between data and processes preserving access control dynamic changes of access rights One solution - typed models control of access control of movements rights

6 Related work Xdπ calculus - extension of Active XML - Gardner, Maffeis localised mobile processes distributed, dynamic, semi-structured web data Variety of type systems for dπ and related calculi controlling the use of accesses and mobility of processes Security types for Xdπ Dezani, Ghilezan, Pantovic, Varacca, 2008 partially ordered set (with bottom) as security levels control of movements rights network invariant and initial network

7 Distributed Network Location l T R Location A peer or a location is represented with data and a process.

8 Access Rights l l T R T S m T R Security conditions not all data is visible to all processes different locations with different access policies

9 Roles st pr CLASSROOM PUBLIC login {st} login {st} enable(st) login pr pr connection {pr} connection {st}

13 Locations, Networks l T R Each location consists of data in a form of a tree and a process A well-formed network is a parallel composition ( ) of locations with different names. N ::= 0 N N l[t R] (νc Tv )N

14 Data CLASSROOM PUBLIC login {st} login {st} a {st} conncetion {pr} a {st} connection {st} p@λ R p@λ R R-scripted process p-path p@λ-pointer run, read, change dynamic changes of access rights

15 Data CLASSROOM PUBLIC login {st} login {st} a {st} conncetion {pr} a {st} connection {st} p@λ R p@λ R R-scripted process p-path p@λ-pointer run, read, change dynamic changes of access rights

16 Processes π-calculus P ::= 0 the nil process P P composition of processes c Tv v output value v on a channel c c Tv (x).p input parameterized by a variable x!c Tv (x).p replication of an input process

17 Processes π-calculus P ::= 0 the nil process P P composition of processes c Tv v output value v on a channel c c Tv (x).p input parameterized by a variable x!c Tv (x).p replication of an input process dπ-calculus P ::= go λ.r migrate to location λ, continue as R Xdπ-calculus P ::= run p run command read p(χ).p read command change p (χ, V ).P change command

18 Processes RXdπ-calculus P ::= enable(r) p.p gives permission to the role r to access data on the path p disable(r) p.p removes the role rfrom roles that are allowed to access data on the path p R ::= P ρ single process with roles ρ R R parallel composition of processes with roles (νc Tv )R restriction of channel name c

19 Interactions in the System Communication Movement Interaction with local data Permission change Reduction rules formally describe interactions in the system.

20 Interactions in the System Communication l T P ρ Q σ Movement Interaction with local data Permission change Reduction rules formally describe interactions in the system.

21 Interactions in the System Communication Movement l m T P ρ T Q σ Interaction with local data Permission change Reduction rules formally describe interactions in the system.

22 Interactions in the System Communication Movement Interaction with local data l T P ρ Permission change Reduction rules formally describe interactions in the system.

23 Interactions in the System Communication Movement Interaction with local data Permission change l T P ρ Reduction rules formally describe interactions in the system.

24 Operational Semantics - Example a α b c ρ b β dγ (read a α (y (σ,e,d) ).change a α (y (β) 1.go x.enable(r) y ρ ) (σ,e,d), R) 1 l

25 Operational Semantics - Example a α b c ρ b β dγ (read a α (y (σ,e,d) ).change a α (y (β) 1.go x.enable(r) y ρ ) (σ,e,d), R) 1 l

26 Operational Semantics - Example a α b c ρ b β dγ (change a α (y (β) (σ,e,d), R).go l.enable(r) 1 b β ρ ) ρ l

27 Operational Semantics - Example a α b c ρ b β dγ (change a α (y (β) (σ,e,d), R).go l.enable(r) β 1 b ρ ) ρ l

28 Operational Semantics - Example R a α c ρ b β dγ (go l.enable(r) b β ρ ) ρ l

29 Operational Semantics - Example R a α c ρ b β dγ (go l.enable(r) b β ρ ) ρ l

30 Operational Semantics - Example R a α c ρ b β dγ enable(r) b β ρ l

31 Operational Semantics - Example R a α c ρ b β dγ enable(r) b β ρ l

32 Operational Semantics - Example R a α c ρ b β dγ {r} l

34 Type System Main goals to control communication of values to control migration and activation of processes to control access to data and their modification Location Policy (σ, E, D) σ: set of minimal roles which can access data E: policy for role enabling D: policy for role disabling

35 Type System Main goals to control communication of values to control migration and activation of processes to control access to data and their modification Location Policy (σ, E, D) σ: set of minimal roles which can access data E: policy for role enabling D: policy for role disabling

36 Type System - Example st st i as prof dean where i I.

37 Type System - Example st st i as prof dean where i I. FACULTY : (σ F, E F, D F ) σ F = {st i } E F = ({prof}, as) D C = ({dean}, st i ) FACULTY

38 Type System - Example st st i as prof dean where i I. FACULTY : (σ F, E F, D F ) σ F = {st i } E F = ({prof}, as) D C = ({dean}, st i ) FACULTY service {st i} records {pr} booklet {st i} mark mark

39 Type System - Example st st i as prof dean where i I. FACULTY : (σ F, E F, D F ) σ F = {st i } E F = ({prof}, as) D C = ({dean}, st i ) FACULTY service {st i} records {pr} booklet {st i} enable(as) service pr pr mark mark

40 Type System - Example st st i as prof dean where i I. FACULTY : (σ F, E F, D F ) σ F = {st i } E F = ({prof}, as) D C = ({dean}, st i ) FACULTY service {st i} records {pr} booklet {st i} disable(st i ) service pr dean mark mark

41 Type System - Example st st i as prof dean where i I. FACULTY : (σ F, E F, D F ) σ F = {st i } E F = ({prof}, as) D C = ({dean}, st i ) FACULTY service {st i} records {pr} booklet {st i} enable(st i ) service pr pr mark mark

42 Safety properties (Subject reduction) If N : Net and N N, then N : Net. Properties of location policies and communication: P0 All trees and processes in a location agree with the location policy; P1 A process with roles can communicate only values with characteristic roles accessible to the process. Properties of migration between locations: P2 A process with roles can migrate to another location only if it is well typed for that location. Properties of access of processes to local data trees: P3 A process with roles looks for a path in the local tree only if the path is accessible to the process.

43 Safety properties Properties of manipulation of local data trees by processes: P4 A script is activated in a location only if the corresponding process with roles can stay in that location; P5 A process with roles generated by a read command in a location can stay in that location; P6 A process with roles can erase a subtree of data only if it can access all data; P7 A tree built by a change command in a location can stay in that location; P8 A process with roles can add a role to an edge in the local tree only if this is allowed by the location policy; P9 A tree built by an enable command in a location can stay in that location; P10 A process with roles can erase a role from an edge in the local tree only if this is allowed by the location policy; P11 A tree built by a disable command in a location can stay in that location.

44 May 29 to June 3, 2011 Novi Sad, Serbia RDP 2011 Announcement