Mandatory Access Research Articles

Thin Hypervisor-Based User Authentication Mechanism for Linux Security Modules

LSM (Linux Security Modules) has been developed as a lightweight, general purpose, access control framework for the mainstream Linux kernel, many tools employ LSM to implement mandatory access control of processes. However, when administrators intend to employ LSM to control a user’s behavior instead of just a process’s, things become more complicated. Since a user’s behavior is reflected by a variety of processes, the control of a user turns into the control of processes associated with the user, which needs the ability to match up a process’s identity to a particular user. Unfortunately, without a strong user authentication mechanism, malicious users can easily bypass the behavior control framework by juggling the identity of a process. In this paper, a practical, efficient, secure mechanism, namely RTA (Real-Time Authentication) is proposed to add real-time user authentication support for traditional LSM. The proposed mechanism employs the ID management framework in a thin hypervisor, BitVisor. At last, a new security module called EWL (Executable White List) is designed and implemented based on RTA and LSM, the experimental results show that EWL ensures security and has small system overhead.

Hails: Protecting data privacy in untrusted web applications

Many modern web-platforms are no longer written by a single entity, such as a company or individual, but consist of a trusted core that can be extended by untrusted third-party authors. Examples of this approach include Facebook, Yammer, and Salesforce. Unfortunately, users running third-party have little control over what the apps can do with their private data. Today's platforms offer only ad hoc constraints on app behavior, leaving users an unfortunate trade-off between convenience and privacy. A principled approach to code confinement could allow the integration of untrusted code while enforcing flexible, end-to-end policies on data access. This paper presents a new framework, Hails, for building web platforms, that adds mandatory access control and a declarative policy language to the familiar MVC architecture. We demonstrate the flexibility of Hails by building several platforms, including GitStar, a code-hosting website that enforces robust privacy policies on user data even while allowing untrusted apps to deliver extended features to users.

Towards a multilayered permission‐based access control for extending Android security

SummaryThis paper discusses security issues on the user equipment, which is the “last mile” of social networks. One of the main Achilles' heel of social networks is not the organization of networks themselves, but the user devices, typically Android ones. The existing system of privileges makes it easy to infiltrate the network via applications installed on users' devices. Conventional signature‐based and static analysis methods are vulnerable. Access to privacy‐ and security‐relevant parts of the application programming interface is controlled by the corresponding permission in a manifest file. While requesting access to permissions, it may offer opportunities to malicious codes, which will cause security issues. Few works among permission analysis, however, pay attention to the prevention of permission leakage on both hardware and software frameworks. In this paper we tackle the challenge of providing our multilayered permission‐based security extension scheme on Android platforms. We propose a usage and access control model and an effective method of preventing permission leakage based on ARM TrustZone security extension mechanism. In contrast to previous work, the proposed security architecture provides a permission‐based mandatory access control on Android middleware, Linux kernel, and hardware layers. The evaluation results demonstrate the effectiveness of the proposed scheme in mitigating permission leakage vulnerabilities.

Mandatory Bank Disclosures and Credit Access

We employ the European Central Bank’s Loan-level Reporting Initiative as a shock to banks’ asset disclosures. We find that, after the regulation, treatment banks raise more capital at cheaper rates and increase lending. Using novel survey data on small businesses, we also document that, in regimes with heightened bank disclosures, borrowers receive greater funding, conditional on their demand for credit. Furthermore, companies whose relationship banks provide asset disclosures start to borrow and invest more, relative to other firms from the same country and industry. Collectively, our inferences suggest that asset disclosures alleviate the capital market frictions that banks face and allow them to supply more credit to the real economy.

AndroidBLP for Confidentiality Management in Android Environments

Users employ smartphones and tablets to manage and store personal information as well as corporate information. However, storing different types of information in the same device may lead to information leakage. Users need tools to define different confidentiality requirements over their data, and to enforce different access policies according to those requirements. Android is the most used mobile operating system, and although it implements various mechanisms to protect user information, it does not have any tool to meet the mentioned needs. This paper presents AndroidBLP, a tool based on the Bell-LaPadula confidentiality model that implements a predefined mandatory access control policy, enables users to define confidentiality requirements, and enforces a confidentiality policy based on those requirements.

Current Research and Open Problems in Attribute-Based Access Control

Attribute-based access control (ABAC) is a promising alternative to traditional models of access control (i.e., discretionary access control (DAC), mandatory access control (MAC), and role-based access control (RBAC)) that is drawing attention in both recent academic literature and industry application. However, formalization of a foundational model of ABAC and large scale adoption is still in its infancy. The relatively recent emergence of ABAC still leaves a number of problems unexplored. Issues like delegation, administration, auditability, scalability, hierarchical representations, and the like, have been largely ignored or left to future work. This article provides a basic introduction to ABAC and a comprehensive review of recent research efforts toward developing formal models of ABAC. A taxonomy of ABAC research is presented and used to categorize and evaluate surveyed articles. Open problems are identified based on the shortcomings of the reviewed works and potential solutions discussed.

Distribution of cryptographic keys in systems with a hierarchy of objects

An algorithm for the distribution of cryptographic keys is presented, which is based on the hierarchical structure of objects in the system. The performance of the algorithm for some types of the graph of the object hierarchy is substantiated. A mechanism for setting mandatory and discretionary access differentiation is proposed using the algorithm.

VmOS: A virtualization-based, secure desktop system

Centralized management is typically applied in modern operating system (OS) architecture; however, such systems are prone to crash when any certain component of the OS is explicitly damaged. The basic reason is that these OSes can rarely support a thoroughly secure or isolated environment either between OS kernel-mode components or between user-mode softwares. To mitigate this issue, we propose vmOS, an operating system that aims at improving the security of desktop computing environment. vmOS applies isolation technique to reduce attack surface, virtualization and mandatory access control to provide isolated environment among system components, application software and user privacy. We implement vmOS by adopting hardware-supported virtualization technology and modifying several well-known open source softwares, which aim to provide run-time efficiency of integrated system. Finally, we evaluate the security and performance by some vulnerability exploits and benchmark tools, showing that vmOS is capable of assuring the overall security of users' desktop computing with less overhead.

A protective mechanism for the access control system in the virtual domain

In traditional framework, mandatory access control (MAC) system and malicious software are run in kernel mode. Malicious software can stop MAC systems to be started and make it do invalid. This problem cannot be solved under the traditional framework if the operating system (OS) is comprised since malwares are running in ring0 level. In this paper, we propose a novel way to use hypervisors to protect kernel integrity and the access control system in commodity operating systems. We separate the access control system into three parts: policy management (PM), security server (SS) and policy enforcement (PE). Policy management and the security server reside in the security domain to protect them against malware and the isolation feather of the hypervisor can protect them from attacks. We add an access vector cache (AVC) between SS and PE in the guest OS, in order to speed up communication between the guest OS and the security domain. The policy enforcement module is retained in the guest OS for performance. The security of AVC and PE can be ensured by using a memory protection mechanism. The goal of protecting the OS kernel is to ensure the security of the execution path. We implement the system by a modified Xen hypervisor. The result shows that we can secure the security of the access control system in the guest OS with no overhead compared with modules in the latter. Our system offers a centralized security policy for virtual domains in virtual machine environments.

A Novel Reference Security Model with the Situation Based Access Policy for Accessing EPHR Data.

Electronic Patient Health Record (EPHR) systems may facilitate a patient not only to share his/her health records securely with healthcare professional but also to control his/her health privacy, in a convenient and easy way even in case of emergency. In order to fulfill these requirements, it is greatly desirable to have the access control mechanism which can efficiently handle every circumstance without negotiating security. However, the existing access control mechanisms used in healthcare to regulate and restrict the disclosure of patient data are often bypassed in case of emergencies. In this article, we propose a way to securely share EPHR data under any situation including break-the-glass (BtG) without compromising its security. In this regard, we design a reference security model, which consists of a multi-level data flow hierarchy, and an efficient access control framework based on the conventional Role-Based Access Control (RBAC) and Mandatory Access Control (MAC) policies.

Convergence Interaction for Communication

Welcome to this special issue of Wireless Personal Communications. This issue contains a collection of the best papers out of various authors who have been submitted to this issue. The main goal for this issue is to be a timely vehicle for publishing selected research papers from practitioners and academia in convergence industries on this emerging topic. This issue covers some of the hottest topics in Convergence Interaction for Communication, including: convergence; interactive applications; cloud service; P2P architectures and wireless protocols; data and index structures; motion recognition; future communication system; hybrid networking system; spectrum resource allocation; personal networking and architectures; multiple access techniques; multicasting and computer communications. The paper by Mun et al. [1] proposes the injecting of a subject policy into access control to strengthen the protection of personal information. This study provides two confidential access control models that apply individually established policies to the role-based access control model (RBAC) and the mandatory access control model (MAC) technologies. In the SpRBAC model, a user’s right to access would follow organizational policy, and accessing personal information would be restricted by the subject policy. In the SpMAC model, users would have to satisfy the subject policy established by the provider of the information, in addition to the requirements of the normal MAC policy. The paper by Lee et al. [2] presents variability change management using orthogonal variability model-based traceability. The proposed method is an approach to tracing variability based on explicit

What Theory and the Empirical Evidence Tell Us About Proxy Access

Traditionally, the default rules of corporate and securities law have provided the Board with exclusive authority to decide whether shareholder proposals on proxy access are to be included in a public company’s proxy solicitation materials. However, the SEC has recently amended its rules to allow such proposals to be included whether or not a Board approves. This Article recommends that the SEC return to its traditional approach to proxy access and furthermore urges the SEC not to put mandatory proxy access back on its agenda absent consistent empirical evidence showing shareholder-initiated proxy access is value enhancing. These recommendations are efficiency based as the Board, the locus of authority with the expertise and access to information that is not accessible to shareholders, is in the best position to determine whether or not proxy access is wealth enhancing for shareholders, not the shareholders themselves. This Article makes three primary arguments. First, the SEC’s current regime of proxy access, by no longer allowing companies to exclude shareholder proposals on proxy access from their proxy solicitation materials, should not be understood as an enhancement to the “private ordering” of a company’s governance arrangements. Rather, this regime acts as a federal barrier to the more efficient approach of Board initiated proxy access. Second, the superiority of Board decision making in the context of proxy access creates a presumption that mandatory proxy access is an inefficient and unnecessary means of nominating and electing directors. Third, this presumption can be rebutted with empirical evidence that consistently shows, at a high level of statistical significance, that mandatory proxy access to be wealth enhancing for shareholders. This is required as the null hypothesis to be tested can be stated as follows: the “preservation of managerial discretion” in the nomination of directors is wealth enhancing for shareholders. However, the empirical evidence does not currently exist to reject the null hypothesis. As a result, it would not be unreasonable for the SEC to keep mandatory proxy access off its agenda.

클라우드 융합을 위한 MAC 정책 기반 접근통제 메커니즘

Cloud computing technology offers function that share each other computer resource, software and infra structure based on network. Virtualization is a very useful technology for operation efficiency of enterprise`s server and reducing cost, but it can be target of new security threat when it is used without considering security. This paper proposes access control mechanism based on MAC(Mandatory Access Control) for cloud convergence that solve various problem that can occur in cloud environment. This mechanism is composed of set of state rules, security characteristics and algorithm. Also, we prove that the machine system with access control mechanism and an initial secure state is a secure system. This policy module of mechanism is expected to not only provide the maintenance but also provide secure resource sharing between virtual machines.

Android Access Control Extension

The main objective of this work is to analyze and extend security model of mobile devices running on Android OS. Provided security extension is a Linux kernel security module that allows the system administrator to restrict program's capabilities with per-program profiles. Profiles can allow capabilities like network access, raw socket access, and the permission to read, write, or execute files on matching paths. Module supplements the traditional Android capability access control model by providing mandatory access control (MAC) based on path. This extension increases security of access to system objects in a device and allows creating security sandboxes per application.

Неинвазивная реализация мандатного управления доступом в веб-приложениях на уровне СУБД

Неинвазивная реализация мандатного управления доступом в веб-приложениях на уровне СУБД

Is Mandatory Access to the Postal Network Desirable and If so at What Terms?

Access to the network is one of the key tools used by regulators to stimulate competition in network industries. For instance, incumbents in the telecommunications sector, in the European Union and elsewhere, are typically mandated to grant access to their network to their rivals. Third-party access to the network requirements can also be found in the energy (gas and electricity) and rail sectors. The questions this paper seeks to address are (i) whether postal incumbents should be mandated to give access to their network and, if that is the case, (ii) at what terms. These questions are addressed by reference to the specific features of the postal sector. Mandatory access to the postal network is generally not necessary since the postal network is not a monopolistic bottleneck and end-to-end competition is generally possible. However, should public authorities decide to mandate access, the regulator should allow the incumbent to set the prices for access to its network. This will not amount to laissez faire considering that, with respect to the setting of its access prices, the incumbent is typically subject to tight regulatory and competition law constraints. If the regulator nevertheless wants to set the access prices, it should calculate these prices on the basis of the ECPR methodology. This methodology presents the advantages that it promotes efficient entry, and has no impact on the profits of the incumbent and its ability to perform its missions of universal service. The regulator should, however, be concerned by the cream-skimming risks that may occur when rivals use a mixed by-pass strategy whereby they provide an end-to-end service in low cost areas and rely on the network of the incumbent to deliver mail destined to high cost areas. In such cases, the regulator should vary access prices depending on the incremental costs of the incumbent to deliver mail in different areas (“zonal pricing”). Given the transaction costs that are generated by the adoption of a mandatory access regime at regulated prices and the risks it presents for universal service, it is questionable whether such a regime is worth it. That is especially the case considering that access-based policies only expose a relatively small amount of costs to competition (competition at the margin) and therefore the price reductions it will trigger will generally be small and only profit to large postal users.

Is a fine-tuning approach sufficient for EU NGA policy? A global review around the long-lasting debate

In this paper, regulatory policies with regard to Next Generation Access (NGA) networks are analysed through a four-part categorisation: (i) conventional type (i.e., copper-based) regulation, (ii) no imposition of mandatory access, (iii) regulatory holiday, and (iv) full deregulation. While EU’s regulatory policy towards NGA originally has been falling somewhere between the first two, the recent developments affirm the influence of long-standing conventional approach over the emerging NGA platforms, and related competition and investment strategies. While US experience clearly exhibits full deregulation, some other countries’ (e.g., Turkey, Brazil) NGA policy decisions represent an approach corresponding to the third category in general. This study mainly focuses on the EU’s regulatory history from the beginning till its current NGA strategy under the light of 2010 and 2013 Recommendations with an emphasis on recent pricing policy adopted by the latter. In the paper, after examining EU regulatory perspective and broadband market indicators in general, ‘ladder of investment’ theory which has driven growth of EU investment policies, was found having limited success and stuck to LLU rung. This study, putting an emphasis to 2020 Digital Agenda targets, focuses on price-based investment trade-offs, and in lieu of such trade-off policies proposes larger scale optimisation displacing the historical regulatory access and pricing schemes that are vulnerable and exposed to regulatory commitment and dynamic consistency problems. It is considered that rather than 2013 Recommendation’s way of fine-tuning over conventional wisdom of regulation, an overhaul consisting of some elements derivable from regulatory holiday – as is found preferable to full deregulation – is applicable under certain conditions, particularly symmetric obligations for sharing civil engineering infrastructure.

Collaboration Supported Mandatory Access Control Model

Collaboration Supported Mandatory Access Control Model

Injecting Subject Policy into Access Control for Strengthening the Protection of Personal Information

To protect stored personal information, many organizations and information systems adopt the role-based access control model (RBAC) or the mandatory access control model (MAC). Although individuals want to control their personal information, an individual-needs-based access control system is difficult to adopt in the existing environment. Recent proposals have included privacy-enhancing technologies such as communication anonymizers, shared bogus online accounts, and access to personal data. However, these systems cannot satisfy users' privacy requirements. In this paper we propose two confidential access control models that apply individually established policy to existing RBAC and MAC technologies. In the SpRBAC model, a user's right to access would follow organizational policy and accessing personal information would be restricted by subject policy. In the SpMAC model, users would have to satisfy the subject policy established by the provider of information in addition to the requirements of normal MAC policy. In the proposed models, it is possible to restrict access by authorized users according to the subject policy, that is, the policy defined by the subject (or informant--the one providing the personal information), and personal information can thus be protected.

Is mandatory access to the postal network desirable and if so at what terms?

Access to the network is one of the key tools used by regulators to stimulate competition in network industries. For instance, incumbents in the telecommunications sector, in the European Union and elsewhere, are typically mandated to grant access to their network to their rivals. Third-party access to the network requirements can also be found in the energy (gas and electricity) and rail sectors. The questions this paper seeks to address are (i) whether postal incumbents should be mandated to give access to their network and, if that is the case, (ii) at what terms. These questions are addressed by reference to the specific features of the postal sector.