On the design of access control to prevent sensitive information leakage in distributed obj.pdf

On the design of access control to prevent sensitive information leakage in distributed object systems: a Colored Petri Net based model Panagiotis Katsaros 1 1 Department of Informatics, Aristotle University of Thessaloniki, 54124 Thessaloniki, Greece katsaros@csd.auth.gr http://delab.csd.auth.gr/~katsaros/index.html Abstract. We introduce a Colored Petri Net model for simulating and verifying information flow in distributed object systems. Access control is specified as prescribed by the OMG CORBA security specification. An insecure flow arises when information is transferred from one object to another in violation of the applied security policy. We provide precise definitions, which determine how discretionary access control is related to the secure or insecure transfer of in- formation between objects. The model can be queried regarding the detected in- formation flow paths and their dependencies. This is a valuable mean for the design of multilevel mandatory access control that addresses the problem of en- forcing object classification constraints to prevent undesirable leakage and in- ference of sensitive information. 1 Introduction For a secure application it is not enough to control access to objects, without taking into account the information flow paths implied by a given, outstanding collection of access rights. The problem is faced by the use of multilevel mandatory policies, where users have no control and therefore they cannot be bypassed. Access to objects is granted on the basis of classifications (taken from a partially ordered set) assigned to objects and subjects requesting access to them. The rigidity of these policies implies the need for a systematic design approach. In the design of mandatory access control we aim to enforce object classification con- straints to prevent undesirable leakage and inference of sensitive information, while at the same time guaranteeing that objects will not be overclassified (to maxim