Mandatory Access Control Research Articles

Specifying and Verifying Information Flow Control in SELinux Configurations

Security Enhanced Linux (SELinux) is a security architecture for Linux implementing Mandatory Access Control. It has been used in numerous security-critical contexts ranging from servers to mobile devices. However, its application is challenging as SELinux security policies are difficult to write, understand, and maintain. Recently, the intermediate language CIL was introduced to foster the development of high-level policy languages and to write structured configurations. Despite CIL’s high level features, CIL configurations are hard to understand as different constructs interact in non-trivial ways. Moreover, there is no mechanism to ensure that a given configuration obeys desired information flow policies. To remedy this, we enrich CIL with a formal semantics, and we propose IFCIL, a backward compatible extension of CIL for specifying fine-grained information flow requirements. Using IFCIL, administrators can express confidentiality, integrity, and non-interference properties. We also provide a tool to statically verify these requirements and we experimentally assess it on ten real-world policies.

Data Protection in Healthcare Information Systems Using Cryptographic Algorithm with Base64 512 bitsAgnes

Recent advancement in technology in Healthcare Information Systems has led to a rise in cyber-attacks and data leakages at the data level. Existing data-level protection techniques that are developed to ensure data-level protection in Healthcare Information Systems lack integration of key security models such as Mandatory Access Controls, Role Based Access Controls and database security approaches in the design and development of data protection methods. In this study, science research methodology was used to design and develop a cryptographic algorithm with Base64 512 bits to enhance data protection at the data level. The algorithm was tested in a healthcare information system through experiments and simulations. The performance of the algorithm was tested to evaluate encryption and decryption process, strength on brute force attack and plain text vulnerability. The results of the observations showed that the developed algorithm with Base64, AES with fixed length of 512 bits, achieved optimal performance.

Basic Security Mechanisms in Linux

The article provides an overview of the key security aspects of the Linux operating system. The relevance of this work lies in the fact that in light of the rapid development of technology and increased threats in the field of information security, special attention is paid to mechanisms that ensure stable protection of data and system resources. The article begins by reviewing basic security principles such as the principle of least privilege and need-based access. Next, we look at modern authentication and authorization mechanisms, including the role of Pluggable Authentication Modules (PAM) and Security-Enhanced Linux (SELinux) multi-user rules. Particular attention is paid to access control systems, including mechanisms for managing access rights to files through the Discretionary Access Control (DAC) and Mandatory Access Control (MAC). The iptables and firewalld firewalls are analyzed as key tools for ensuring the security of network interactions. The article also covers current Linux security trends and challenges, as well as an overview of the latest kernel and software updates. Ultimately, the reader will gain a comprehensive understanding of Linux security mechanisms, allowing him to make informed decisions to effectively protect his systems and data.

Zero Trust-Based Blockchain Based IoT Security with Consensus and Access Control Framework

As the Internet and computer technology develop, more gadgets are linked wirelessly, expanding the Internet of Things (IoT). IoT is a huge network of sensors and gateways that links them. IoT devices generate images, music, video, digital signals, and more by interacting with their surroundings. To exchange resources and information, all IoT equipment and apps may connect to the Internet. Everything is connected in our world. Due to the broad deployment and massive size of IoT devices, access control of device resources is problematic. Obtaining IoT device resources unlawfully will have major implications since they include personal and sensitive information. Many systems and situations employ access control technologies to secure resources. Discriminatory, identity-based, and MAC access control schemes are traditional (mandatory access control). However, these centralized methods have single-point failure, scalability issues, poor dependability, and low throughput. IoT devices may belong to several organizations or people, be mobile, and function badly, making centralized access management problematic. Another innovative data management solution is blockchain, which uses distributed storage to stabilize data. A transaction writes the data reading or modification record into a block, and the blocks are connected as a chain using a hash to maintain data integrity. It synchronizes data between nodes via a peer-to-peer network and consensus process, assuring data consistency for blockchain network participants. Zero Trust-Based Blockchain, an open source blockchain development platform, offers more efficient consensus methods, larger throughputs, smart contracts, and support for different organizations and ledgers. Proposed work build the fabric-IoT access control system using Zero Trust-Based Blockchain to apply blockchain technology to IoT access control in this study. Distributed processing and storage for IoT data may solve these critical issues with blockchain. Thus, developing distributed IoT-based e-healthcare services using blockchain technology may have been feasible. FabricIoT can keep records, handle dynamic access control, and solve the IoT access control problem using distributed architecture.

Security label and attribute-based access control in service-oriented environments

Compared with traditional systems, service-oriented environments are more dynamic and distributed. Although traditional access control is able to fulfill the security of requirements of closed systems on the whole, it can no longer meet the requirements of service-oriented environments. To deal with the issues that access control in the service-oriented environment needs to cross the boundary of the security domain, the high distribution, and heterogeneity of environmental characteristics, and how to establish efficient and guaranteed access to resources, access control based on security label and attribute is proposed for fine-grained resource information and rich policy security requirements. By using a CP-ABE mechanism, distributed fine-grained access control can be realized in the company of solving the issue of policy privacy leakage; By using the security label technology, the multi-level security mandatory access control is realized, and the security flow of information is achieved, thus protecting the service and its methods from unauthorized users. Finally, the proposed scheme has been verified to have reliable security through security analysis. The experimental outcomes indicate this proposed scheme is available and effective in terms of performance.

Access Security Policy Generation for Containers as a Cloud Service

The rapid development of containerization technology comes with remarkable benefits for developers and operation teams. Container solutions allow building very flexible software infrastructures. Although lots of efforts have been devoted to enhancing containerization security, containerized environments still have a huge attack surface. Completely avoiding severe security issues have so far not been possible to achieve. However, the security problems due to vulnerabilities in for instance kernels, can be largely reduced if the container privileges are as restricted as possible. Mandatory access control is an efficient way to achieve this using for instance AppArmor. As manual AppArmor generation is tedious and error prone, automatic generation of protection profile is necessary. In previous research, a new tool for tight AppArmor profile generation was presented. In this paper we show how, in a system setting, such tool can be combined with container service testing, to provide a cloud based container service for automatic AppArmore profile generation. We present solutions for profile generation both for centrally collected and generated container logs and for log collection through a local agent. To evaluate the effectiveness of the profile generation service, we enable it on a widely used containerized web service to generate profiles and test them with real-world attacks. We generate an exploit database with 11 exploits harmful to the tested web service. These exploits are sifted from the 56 exploits of Exploit-db targeting the tested web service’s software. We launch these exploits on the web service protected by the profile. The results show that the proposed profile generation service improves the test web service’s overall security a lot compared to using the default Docker security profile. This together with the very user friendly and robust principle for setting up and running the service, clearly indicates that the approach is an important step for improving container security in real deployments.

XFilter: An Extension of the Integrity Measurement Architecture Based on Fine-Grained Policies

The Integrity Measurement Architecture subsystem on the Linux platform is a critical security component in the kernel to ensure the integrity of the running system. However, the default Integrity Measurement Architecture policy mechanisms based on options such as file owner and FSMAGIC cannot achieve a file-level configuration. Although Integrity Measurement Architecture supports the Linux Security Module policy rules to be close to the goal of fine-grained configuration, it is not easy to be managed because the Linux Security Module was not originally designed for integrity measurement. Moreover, the Linux Security Module-based policy does not apply in some use cases considering the type of Mandatory Access Control tools chosen by users. This paper presents a new policy configuration option, named XFilter, that achieves a fine-grained policy configuration method. The XFilter includes two policy matching mechanisms, XLabel and XList, which share the same policy token created for XFilter exclusively. XLabel marks the files for measurement using a label in the file’s extended attribute (xattr). By contrast, XList stores the measurement information in a list of file paths. To simplify the deployment, an automatic configuration process is implemented for integrating into the package management system. The evaluation results suggest that both mechanisms satisfy the requirements of file-level IMA policy control and create a performance burden for system operation in the acceptable range. They also reveal a positive correlation between the increment of the system latency and the growth of the length of file paths list for the XList mechanism.

Improving the efficiency of intrusion detection in information systems

Abstract Policy Interaction Graph Analysis is a Host-based Intrusion Detection tool that uses Linux MAC Mandatory access control policy to build the licit information flow graph and uses a detection policy defined by the administrator to extract illicit behaviour from the graph. The main limitation of this tool is the generation of a huge signature base of illicit behaviours; hence, this leads to the use of huge memory space to store it. Our primary goal in this article is to reduce this memory space while keeping the tool’s efficiency in terms of intrusion detection rate and false generated alarms. First, the interactions between the two nodes of the graph were grouped into a single interaction. The notion of equivalence class was used to classify the paths in the graph and was compressed by using a genetic algorithm. Such an approach showed its efficiency compared to the approach proposed by Pierre Clairet, by which the detection rate obtained was 99.9%, and no false-positive with a compression rate of illicit behaviour signature database reached 99.44%. Having these results is one of the critical aspects of realizing successful host-based intrusion detection systems.

Mandatory Access Control Method for Windows Embedded OS Security

The Windows Embedded operating system (OS) adopts a discretionary access control (DAC)-based policy, but underlying vulnerabilities exist because of external hacker attacks and other factors. In this study, we propose a system that improves the security of the Windows Embedded OS by applying a mandatory access control (MAC) policy in which the access rights of objects, such as files and folders, and subjects’ privileges, such as processes, are compared. We conducted access control tests to verify whether the proposed system could avoid the vulnerabilities of DAC-based systems. Our results indicate that the existing DAC-based security systems could be neutralized if a principal’s security policy is removed. However, in the proposed MAC-based Windows Embedded OS, even if the clearance and category values of a subject’s files are given the highest rating, all accesses are automatically denied. Therefore, the execution of all files that were not previously registered on the whitelist was denied, proving that security was improved relative to DAC-based systems.

Lic-Sec: An enhanced AppArmor Docker security profile generator

Along with the rapid development of cloud computing technology, containerization technology has drawn much attention from both industry and academia. In this paper, we perform a comparative measurement analysis of Docker-sec, which is a Linux Security Module proposed in 2018, and a new AppArmor profile generator called Lic-Sec, which combines Docker-sec with a modified version of LiCShield, which is also a Linux Security Module proposed in 2015. Docker-sec and LiCShield can be used to enhance Docker container security based on mandatory access control and allows protection of the container without manual configurations. Lic-Sec brings together their strengths and provides stronger protection. We evaluate the effectiveness and performance of Docker-sec and Lic-Sec by testing them with real-world attacks. We generate an exploit database with 40 exploits effective on Docker containers selected from the latest 400 exploits on Exploit-DB. We launch these exploits on containers spawned with Docker-sec and Lic-Sec separately. Our evaluations show that for demanding images, Lic-Sec gives protection for all privilege escalation attacks for which Docker-sec and LiCShield failed to give protection.

Using formal security models in secure databases

The paper contains key provisions (requirements) that should be followed when building secure databases using the capabilities of the main formal access control models, such as discretionary access control models, mandatory access control models, role-based access control models. At the same time, it is noted that any security model does not provide protection but only provides the principle of building a secure database, the implementation of which should ensure the security properties inherent in the model. The security of the database is equally determined by: the properties of the model itself (one or more), its (their) adequacy to the threats affecting the system, and how it (they) is correctly implemented(s). The decisive factor in making a decision is always an assessment of a specific situation, which will allow you to make the right choice, including the complex use of formal models.

TRUST- BASED MODELING MAC-TYPE ACCESS CONTROL THROUGH ACCESS AND ACTIONS CONTROL POLICIES

In recent decades, the number of researches on access control and user actions in computer systems has increased. Over time, there have been two models of implementing Mandatory Access Control (MAC) policies for government institutions and Discretionary Access Control (DAC) for the business environment, policies that various access control modeling solutions seek to implement. Among the access control modeling solutions developed are Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC), presented in the U.S.A. by the National Institute of Standard and Technology (NIST). In Romania, in 2010, the access control solution based on trust was presented. This paper presents Mandatory Access Control policy modeling using the trust-based access and actions control modeling solution.

Kepatuhan Functional Requrements Hak Akses pada Electronic Records Management System Arteri.

This Research discusses the compliance of the Electronic Records Management System (ERMS) on the Principles and Functional Requirements for Records in Electronic office environments (ICA-REQ) Module Two related to access control functions in one of the main categories is maintain. One of the ERMS management records, namely Arsip Elektronik Terintegrasi (Arteri ) is based on open-source. Arteri is the ERMS for managing web-based electronic records to facilitate records management. Therefore, this research aims to determine whether the arteries meet the ERMS standard on the ICA-REQ regarding access control. So, the results of the analysis can be used as input for developers and users to conduct further evaluation and improvement. This research used a qualitative approach with literature study and made observations on Arteri as the object. On analysis it was found that Arteri only fulfilled 12 of the 17 mandatory access control function requirements .

Fine-grained access control model based on sensitivity calculation by fuzzy mathematics

Access control regulates the behavior of legitimate users in the security domain to access and operate resources, and ensures that resources are not used by unauthorized users, in order to protect resources. With the maturity of security label technology, new requirements are put forward for access control of multi-level security network. In this paper, a fine-grained access control model based on sensitivity calculation by fuzzy mathematics is proposed. Fuzzy mathematics is used to comprehensively calculate the sensitivity level of users and files based on their security label attributes. On this basis, the mandatory access control policies are set to make the access control mechanism between users and files more reasonable.

Многоуровневая модель политики безопасности управления доступом операционных систем семейства Windows

The purpose of research – development of a more advanced Windows NT family access control mechanism to protect against information leakage from memory by hidden channels. The method of research – analysis of Windows NT family models of mandatory access control and integrity control, modeling of access control security policy for specified security properties, automatic verification of models. The Lamport Temporal Logic of Actions (TLA +) used to describe the model and its specification is used. TLA+ allows automatic verification of the model with the specified security properties. The result of research – revealed the main limitations of the existing mandatory integrity control of operating systems of the Windows NT family. A set of structures of a multilevel model has been developed, reflecting the attributes that are significant for modeling the process of access of subjects to objects. The key mechanisms of access control in the operating system are modeled: management of users, groups, subjects, objects, roles, rights, discretionary and mandatory access control, mandatory integrity control - multilevel control of subjects’ access to objects. The model defines a mechanism for controlling the creation of subjects based on executable files to organize an isolated software environment. The values of the attributes of the model variables for the initialization stage are determined. The invariants of variables correctness in the process of verification and subjects to objects safe access are developed. The model was specified using the TLA + modeling language and verified.

Mitigation of Kernel Memory Corruption Using Multiple Kernel Memory Mechanism

Operating systems adopt kernel protection methods (e.g., mandatory access control, kernel address space layout randomization, control flow integrity, and kernel page table isolation) as essential countermeasures to reduce the likelihood of kernel vulnerability attacks. However, kernel memory corruption can still occur via the execution of malicious kernel code at the kernel layer. This is because the vulnerable kernel code and the attack target kernel code or kernel data are located in the same kernel address space. To gain complete control of a host, adversaries focus on kernel code invocations, such as function pointers that rely on the starting points of the kernel protection methods. To mitigate such subversion attacks, this paper presents multiple kernel memory (MKM), which employs an alternative design for kernel address space separation. The MKM mechanism focuses on the isolation granularity of the kernel address space during each execution of the kernel code. MKM provides two kernel address spaces, namely, i) the trampoline kernel address space, which acts as the gateway feature between user and kernel modes and ii) the security kernel address space, which utilizes the localization of the kernel protection methods (i.e., kernel observation). Additionally, MKM achieves the encapsulation of the vulnerable kernel code to prevent access to the kernel code invocations of the separated kernel address space. The evaluation results demonstrated that MKM can protect the kernel code and kernel data from a proof-of-concept kernel vulnerability that could lead to kernel memory corruption. In addition, the performance results of MKM indicate that the system call overhead latency ranges from 0.020 μs to 0.5445 μs, while the web application benchmark ranges from 196.27 μs to 6, 685.73 μs for each download access of 100,000 Hypertext Transfer Protocol sessions. MKM attained a 97.65% system benchmark score and a 99.76% kernel compilation time.

Analysis of the features of the protection system of the domestic special-purpose operating system

The paper considers the task of studying the features of the protection system of the operating system Astra linux 1.6 SE (Further OS Astra 1.6 SE). The basic principles of access control, functional features of protection modules, settings of some configuration files of the operating system, as well as types and features of classification marks are revealed. The result of this work is the proposal for the implementation of the possibility of configuring the basic access control mechanisms without using a graphical shell, the study of the principle of operation of these mechanisms, as well as the use of the features of kernel modules, configuration files for the design of a security system for computer facilities by information protection units. This operating system has a specific feature of the structure of the security system, since it includes mechanisms for mandatory access control, allowing access to be denied or allowed depending on the user's authority. The exchange and processing of information occurs with the use of classification labels, which make it possible to delimit information flows of different mandated contexts. These labels are written in accordance with GOST R 58256-2018 “Information security. Information flow control in the information system. Format of classification marks”. The paper analyzes traffic in different mandated sessions, and also considers the behavior of information flows regarding interaction in a network of computers with the installed OS Astra linux 1.6 SE and the security system configured on it. In this case, the exchange of data will occur both with users in the same sessions and in different ones that differ between computers.

SLR-SELinux: Enhancing the Security Footstone of SEAndroid with Security Label Randomization

The root privilege escalation attack is extremely destructive to the security of the Android system. SEAndroid implements mandatory access control to the system through the SELinux security policy at the kernel mode, making the general root privilege escalation attacks unenforceable. However, malicious attackers can exploit the Linux kernel vulnerability of privilege escalation to modify the SELinux security labels of the process arbitrarily to obtain the desired permissions and undermine system security. Therefore, investigating the protection method of the security labels in the SELinux kernel is urgent. And the impact on the existing security configuration of the system must also be reduced. This paper proposes an optimization scheme of the SELinux mechanism based on security label randomization to solve the aforementioned problem. At the system runtime, the system randomizes the mapping of the security labels inside and outside the kernel to protect the privileged security labels of the system from illegal obtainment and tampering by attackers. This method is transparent to users; therefore, users do not need to modify the existing system security configuration. A tamper-proof detection method of SELinux security label is also proposed to further improve the security of the method. It detects and corrects the malicious tampering behaviors of the security label in the critical process of the system timely. The above methods are implemented in the Linux system, and the effectiveness of security defense is proven through theoretical analysis and experimental verification. Numerous experiments show that the effect of this method on system performance is less than 1%, and the success probability of root privilege escalation attack is less than 10−9.

Blockchain Platforms and Access Control Classification for IoT Systems

The Internet of Things paradigm is growing rapidly. In fact, controlling this massive growth of IoT globally raises new security and privacy issues. The traditional access control mechanisms provide security to IoT systems such as DAC (discretionary access control) and mandatory access control (MAC). However, these mechanisms are based on central authority management, which raises some issues such as absence of scalability, single point of failure, and lack of privacy. Recently, the decentralized and immutable nature of blockchain technology integrated with access control can help to overcome privacy and security issues in the IoT. This paper presents a review of different access control mechanisms in IoT systems. We present a comparison table of reviewed access control mechanisms. The mechanisms’ scalability, distribution, security, user-centric, privacy and policy enforcing are compared. In addition, we provide access control classifications. Finally, we highlight challenges and future research directions in developing decentralized access control mechanisms for IoT systems.

A Design of MAC Model Based on the Separation of Duties and Data Coloring: DSDC-MAC

Among the access control methods for database security, there is Mandatory Access Control (MAC) model in which the security level is set to both the subject and the object to enhance the security control. Legacy MAC models have focused only on one thing, either confidentiality or integrity. Thus, it can cause collisions between security policies in supporting confidentiality and integrity simultaneously. In addition, they do not provide a granular security class policy of subjects and objects in terms of subjects' roles or tasks. In this paper, we present the security policy of Bell_LaPadula Model (BLP) model and Biba model as one complemented policy. In addition, Duties Separation and Data Coloring (DSDC)-MAC model applying new data coloring security method is proposed to enable granular access control from the viewpoint of Segregation of Duty (SoD). The case study demonstrated that the proposed modeling work maintains the practicality through the design of Human Resources management System. The proposed model in this study is suitable for organizations like military forces or intelligence agencies where confidential information should be carefully handled. Furthermore, this model is expected to protect systems against malicious insiders and improve the confidentiality and integrity of data