Invited Speakers

The Category-Based Approach to Access Control, Obligations and Privacy

The category-based access control metamodel (Barker, SACMAT 2009), provides an axiomatic framework for the specification of access control models. In fact, we have shown that one simple model in this framework (the CBAC model) subsumes popular models such as DAC, MAC, RBAC, ABAC and more. The advantage of having one formal model of which the others are instances is that properties can be proved in the general model and inherited by its instances, and similarly languages, analysis tools and enforcement techniques designed for the general model can be applied to the instances, saving time and effort. It is therefore natural to use a similar approach in related areas such as the specification of privacy policies or obligation policies.

In this talk, we will give an overview of the category-based approach to access control, obligation and privacy policy specification. The notion of obligation is used in a variety of domains, ranging from legal frameworks to cybersecurity. We will describe a category-based model that can be used to specify a general notion of obligation (including as particular cases legal obligations and obligations associated with authorisations). Access control and obligations can be specified within the same policy, which facilitates the analysis of the interaction between authorisations and obligations, for example, to check that any violated obligation is due to negligence and not to lack of appropriate authorisations.

The specification of privacy preferences regarding data collection and data sharing is another area where the category-based approach applies in a natural way. We will show how to define policies that combine privacy and data-sharing specifications, and, using the DataBank (a privacy-preserving cloud-IoT architecture), we will illustrate the use of such policies to ensure that data collected by IoT devices is shared with services according to the data-owner's privacy preferences.

Access control vulnerabilities in networking protocol implementations: how attackers exploit them and what to do about it

Access control mechanisms should ensure that users only act within their intended permissions. However, these mechanisms often have flawed implementations, allowing malicious actors to bypass them. In this talk, I will discuss several findings from our research into vulnerabilities in networking protocol implementations, giving special attention to those stemming from flawed access control. Examples include buffer overflows when processing user credentials, weak cryptography, credentials transmitted in plaintext, hardcoded credentials, authentication bypasses via MAC or IP spoofing, client-side authentication and message parsing before establishing a peer’s identity. These issues were identified in implementations as diverse as embedded TCP/IP stacks, routing suites and engineering protocols for operational technology devices from major vendors. I will also present statistics from a set of honeypots about attacks exploiting authentication bypasses, brute forcing passwords and leaking credentials. After presenting those findings, I will discuss the importance of modern network access control and collaborative threat intelligence to detect and stop attacks.

WebSheets: A Framework for Privacy-Centric Web Applications by Non-Programmers

Spreadsheets are enormously popular because they enable non-programmers to create applications that manipulate tabular data. This success inspired commercial no-code and low-code app development frameworks (e.g., Google AppSheet) for creating apps centered around interacting with tabular data stored in spreadsheets that serve as simple databases and no-code computation engines.

This talk presents the design of WebSheets, a no-code web application framework that provides novel support for security and privacy. The key innovation of WebSheets is that access permissions are first-class. Each data table in WebSheets is paired with a permission table. Using spreadsheet formulas in permission tables, users can associate expressive fine-grained access policies with their data. By automatically filtering out inaccessible rows and columns, WebSheets presents user-customized views that are the hallmark of many web applications. The WebSheets framework guarantees that access policies are enforced during the lifetime of this data, even as it is used throughout the application's code, or passed across applications. While achieving this global privacy guarantee similar to information flow control systems, WebSheets users can continue to work with familiar access control policies.

Additional key features of WebSheets include: a powerful formula language that supports first-class tables and declassification; a new least-privilege evaluation technique that confines WebSheets computations using OS-based access control and sandboxing mechanisms; secure integration with external systems using the least-privilege evaluation technique; and analysis techniques to help users understand and improve policies.

Joint work with R. Sekar and I.V. Ramakrishnan.