The stack-based access control mechanism plays a fundamental role in the security architecture of Java and Microsoft CLR (common language runtime). It is enforced at runtime by inspecting methods in the current call stack for granted permissions before the program performs safety-critical operations. Although stack inspection is well studied, there is relatively little work on automated generation of access control policies, and most existing work on inferring security policies assume the permissions to be checked at stack inspection points are known beforehand. Practiced approaches to generating access control policies are still manually done by developers based on domain-specific knowledges and trial-and-error testing. In this paper, we present a systematic approach to automated generation of access control policies for Java programs that necessarily ensure the program to pass stack inspection. The techniques are abstract interpretation based context-sensitive static program analyses. Our analysis models the program by combining a context-sensitive call graph with a dependency graph. We are hereby able to precisely identify permission requirements at stack inspection points, which are usually ignored in previous study.
To the best of our knowledge, the modular permission analysis proposed in @cite_3 is the most relevant to our work . On one hand, it was also concerned with automatically generating security polices for any given program, with particular attention on the principle of least privilege. On the other hand, they were the first to attempt to reflect the effects of string analysis in access rights analysis in terms of slicing. A modular analysis algorithm is proposed to achieve the practical scalability, and the authors developed a tool Automated Authorization Analysis (A3) to assess the precision of permission requirements for stack inspection. However, their algorithms are based on a context-insensitive call graph and the analysis results can be polluted by invalid call paths. Moreover, their slicing algorithms are also context-insensitive.
@cite_3
2129626531
In modern software systems, programs are obtained by dynamically assembling components. This has made it necessary to subject component providers to access-control restrictions. What permissions should be granted to each component? Too few permissions may cause run-time authorization failures, too many constitute a security hole. We have designed and implemented a composite algorithm for precise static permission analysis for Java and the CLR. Unlike previous work, the analysis is modular and fully integrated with a novel slicing-based string analysis that is used to statically compute the string values defining a permission and disambiguate permission propagation paths. The results of our research prototype on production-level Java code support the effectiveness, practicality, and precision of our techniques, and show outstanding improvement over previous work.