Dynamic mandatory access control for multiple stakeholders

In this paper, we present a mandatory access control system that uses input from multiple stakeholders to compose policies based on runtime information. In the emerging ubiquitous environment, many devices run software whose access permissions depends on multiple stakeholders, such as the device owner, the service provider, the application owner, etc., rather than a single system administrator. However, current access control administration remains as either discretionary, allowing the running and perhaps compromised process to administer, or mandatory, requiring all permissions to be known by load-time. A key problem is that users may download arbitrary programs to their devices, requiring that the system contain such programs while allowing some reasonable functionality. However, such programs may need access to resources that can lead to attacks, such as implementing voice-over-IP calls, but that may also be needed for benign operations. In our approach, we use a “soft” sandbox...

• Type: Conference
• Year: 2009
• Where: SACMAT
• Authors: Vikhyath Rao, Trent Jaeger
• Keywords: Access Control, Multiple Stakeholders, Proxy Policy Server, SACMAT 2009, Security Privacy