論理プログラミングを基礎とした認可ポリシ記述言語

IPSJ

Bibliographic Information

Other Title
  • Policy Description Language for Authorization Using Logic-based Programming

Search this article

Abstract

近年の情報システムでは脆弱性を完全に排除するのが難しいため，多層防御によってセキュリティ・インシデントの発生に備える必要がある．多層防御を効果的に実現するためには，細粒度の強制アクセス制御を行うための膨大なアクセス制御規則をポリシとして記述する必要があるが，既存の記述方式は可読性や保守性に問題がある．本研究では，論理プログラムとしてアクセス制御規則を記述することで，属性の継承や頻出する認可手順のサブルーチン化をサポートするポリシ記述言語を提案し，この問題を解決する．本稿では，認可判定の妥当性と表現力を評価して，本言語の有用性を実証し，期待される効果を考察する．

Recently, with the impossibility of eradicating the vulnerabilities of information systems, we must prepare for the occurrence of the security incident by the multi-layer defense called Defense-in-Depth strategy. In the multi-layer defense, it is important to authorize accesses in fine-grained granularity to compose each layer effectively and many access control models are proposed to follow them. However, policy description languages proposed so far cannot express the models appropriately in proper granularity. In this paper, we propose a policy description language which can designate many kinds of conditions for access control like dynamic status of application process as an element of decision data, and implement it in Datalog. Using the proposed language, we compose the policy of SELinux which is a major implementation achieving the multi-layer defense, and we confirm the advantages of the proposed language by evaluating the validity and the expressiveness.

Journal

Related Projects

See more

Keywords

Details 詳細情報について

Report a problem

Back to top