Efﬁcient Heuristic Safety Analysis of Core-based Security Policies

Peter Amthor

Ilmenau University of Technology, Germany

Keywords:

Security Engineering, Security Policies, Access Control Systems, Access Control Models, Safety, Heuristic

Analysis, SELinux.

Abstract:

Being of paramount importance for the correctness of a security policy, the property of safety has received

decades of attention in the ﬁeld of model-based security engineering. To analyze the safety of a security model,

heuristic approaches are used to avoid restrictions of the model calculus while accepting semi-decidability of

this property. Within this ﬁeld, this paper addresses three open problems concerning the DEPSEARCH heuristic

safety analysis framework: Inefﬁcient state-space exploration, static veriﬁcation of unsafety-unsatisﬁability,

and parameter dependency analysis. We describe these problems on a formal basis, specify solution proposals,

and implement these in the current, model-independent f DS framework. A practical evaluation based on

SELinux is performed to study effectiveness and future optimization of the framework.

1 INTRODUCTION

While security requirements of IT systems have be-

come of paramount importance, the tasks of rigor-

ous speciﬁcation, veriﬁcation, and implementation

of security properties have received increasing atten-

tion (Sandhu, 1988; Kleiner and Newcomb, 2007;

Stoller et al., 2011; Ranise et al., 2014; Shahen et al.,

2015). The problems of systems security speciﬁcation

and implementation have found a solution in policy-

controlled systems: Here, a security policy is a pre-

cise and unambiguous deﬁnition of rules, e. g. related

to isolation, access control, or information ﬂow con-

trol mechanisms, which forms the backbone for re-

liable and correct enforcement of these rules. Conse-

quently, solving the problem of veriﬁcation inevitably

requires to formally analyze precisely that backbone

(a security model) for properties such as policy con-

sistency, information ﬂow leaks, or potential prolifer-

ation of privileges.

Considering the importance of such security prop-

erties, the fundamental safety undecidability result

has been relevant since its ﬁrst presentation in (Har-

rison et al., 1976). The seminal HRU model for

dynamic access control systems is introduced there,

along with the safety property describing potential

proliferation (also known as leakage) of privileges.

Informally, a snapshot of an access control system

is considered safe with respect so some privilege if

and only if no future modiﬁcation to that snapshot is

able to allow an access using the privilege in question,

which was not allowed in the initial snapshot.

Given its critical nature, the proof of undecid-

ability of this problem in (Harrison et al., 1976) led

to massive efforts in reducing a model’s complexity

and thus expressive power in a least-obstructive way

(Sandhu, 1988; Sandhu, 1992; Stoller et al., 2011;

Ferrara et al., 2013; Ranise et al., 2014; Shahen et al.,

2015). Most related work in this area features models

decidable with respect to a restricted ﬂavor of HRU

safety which, being constructed with a speciﬁc appli-

cation domain in mind, completely satisﬁes the se-

mantic needs of that domain’s policies. However,

since all these models signiﬁcantly differ in their se-

mantics, analysis algorithms derived for them are usu-

ally not applicable to other policy domains, which in

turn need to be built from scratch. Because of the

huge semantic gap between an informal policy and

the formalized model, this is an error-prone process.

Our current work aims at overcoming this prob-

lem. Instead of restricting a model’s expressive

power to achieve a decidable ﬂavor of safety, our

approach accepts the impossibility of conﬁrming a

safe model. We instead try to conﬁrm the critical

case of safety violation in unrestricted HRU models

(which is possible due to the actual semi-decidable

nature of the problem). This is done in an approx-

imative, heuristics-based approach resulting in the

DEPSEARCH (DS) algorithm (Amthor et al., 2013).

To apply this approach to a broader range of models,

384

Amthor, P.

Efﬁcient Heuristic Safety Analysis of Core-based Security Policies.

DOI: 10.5220/0006477103840392

In Proceedings of the 14th International Joint Conference on e-Business and Telecommunications (ICETE 2017) - Volume 4: SECRYPT, pages 384-392

ISBN: 978-989-758-259-2

we have merged it with two generalized modeling pat-

terns (core-based modeling (K

uhnhauser and P

olck,

2011; P

olck, 2014) and entity labeling (Amthor,

2015; Amthor, 2016)). The resulting f DS framework

allows to tailor heuristic safety analysis to a multitude

of policy semantics beyond traditional HRU (Amthor,

2017).

However, despite promising ﬁrst results, our

safety analysis algorithms still expose weaknesses

with respect to both heuristic effectivity and efﬁ-

ciency. Based on our previous work and some criti-

cal observations made there, the goal of this paper is

to take the next step towards practice by presenting

f DS++, an optimized framework for safety analysis

based on DEPSEARCH. In details, we have identiﬁed

and solved the following weaknesses:

1. Inefﬁcient heuristic for state-space exploration,

leading to a signiﬁcant portion of ineffective

heuristic steps;

2. Negligence of static model properties inﬂuencing

unsafety-satisﬁability, which effectively allows to

identify known-safe policies and to avoid heuris-

tic analysis where unnecessary;

3. Lack of support for parameter assignment algo-

rithms (which contribute to an efﬁcient state space

traversal) based on static dependency analysis.

We have speciﬁed these improvements and imple-

mented the resulting algorithms tailored to SELX, an

access control model for the SELinux operating sys-

tem (Amthor, 2015) (Section. 4). As a preliminary

proof-of-concept validation that complements ongo-

ing experimentation, we outline an exemplary anal-

ysis of an excerpt of the SELinux reference policy

(Section 5). Our results hint at a feasibility of the

generalized safety analysis approach in practice and

indicate the direction of ongoing and future work in

that ﬁeld.

2 DYNAMIC SECURITY MODELS

The goal of this section is to introduce the core-based

modeling pattern by P

olck (K

uhnhauser and P

olck,

2011; P

olck, 2014) as a formal environment to de-

scribe our safety analysis approach. Here and for the

rest of this paper, we will use the following conven-

tions for formal notation:

|= is a binary relation between variable assign-

ments and formulas in second-order logic, where I |=

φ iff I is an assignment of unbound variables to values

that satisﬁes φ. In an unambiguous context, we will

write

,...,x

|= φ for any assignment of variables

in φ that satisﬁes φ. A logical formula assigned to

a variable is delimited by [[ ]]. We will mark ﬁxed

values referenced from outside the formula by under-

lining, e.g. a ﬁxed x in an expression φ = [[ y = x ]].

B is the set of Boolean values > (true) and ⊥ (false).

In a directed graph

V,E

, E

denotes the set of in-

coming edges of a node v, while E

out

denotes its set

of outgoing edges.

The Model Core. To provide a uniform formal ba-

sis for safety deﬁnition and dynamic model analy-

sis, we use a generalization of the deterministic au-

tomaton introduced in HRU models. This automaton

serves as an abstract pattern used to deﬁne specialized

policies in a formally uniform calculus.

A core-based access control model is deﬁned as

an automaton, the model core:

Q,Σ,δ,λ,q

, EXT

where Q is a set of protection states, Σ is a set of in-

puts, δ : Q × Σ → Q is the state transition function,

λ : Q × Σ → B is the output function, q

∈ Q is the

initial protection state, and EXT is an arbitrary tuple

of static model extensions.

The model core is tailored to a domain-speciﬁc se-

curity policy by deﬁning Q (a system’s dynamic pro-

tection state) and EXT (static portion of the policy).

To describe protection state dynamics for a particu-

lar policy, the state transition function δ is deﬁned via

pre- and post-conditions of any possible state transi-

tion. This is done by comparing each input of the

automaton with two formulas in second-order logic,

PRE and POST. We then deﬁne δ by formally spec-

ifying the conditions that each pair of states q and q

has to satisfy w.r.t. an input σ ∈ Σ for a state transition

from q to q

to occur:

δ(q,σ) =



q,σ

|= PRE ∧

,σ

|= POST

q, otherwise.

Because an access control system is fundamentally

deterministic, POST requires that q

equals q where

not redeﬁned. In practice, PRE and POST are di-

vided into commands that match particular interface

calls of the modeled system: For any command

cmd ∈ Σ

, PRE(cmd) denotes the partial, command-

speciﬁc pre-condition of cmd and POST(cmd) its

post-condition. The AC system’s interface is then

modeled by Σ = Σ

× Σ

, where Σ

is a set of

command identiﬁers and Σ

contains sequences

of possible values (actual command parameters)

for variables in PRE and POST. Corresponding to

, Σ

is a set of formal command parameters,

i. e. variable names used in PRE and POST. An

engineering-friendly, conventional notation of δ

is then based on partial deﬁnitions for each input

command: We call the set of such partial deﬁnitions

Efﬁcient Heuristic Safety Analysis of Core-based Security Policies

385

∆ = {

cmd,x

cmd

,PRE(cmd),POST(cmd)

|cmd ∈

cmd

∈ Σ

;PRE(cmd),POST(cmd) ∈ B} a

model’s state transition scheme, a speciﬁcation of the

behavior of δ.

In the core-based pattern, a HRU model is deﬁned

Q,Σ,δ,λ,q

, with a protection state deﬁned

as q =



,acm



∈ Q. We call R the set of ac-

cess rights, S

the subjects set, O

the objects set, and

acm

: S

×O

→ 2

the access control matrix of state

q, the latter deﬁning authorization rules in form of

Lampson’s ACM (Lampson, 1971). The notation of

a simple example command delegateRead of an HRU

model’s state transition scheme is shown in Fig. 1.

I delegateRead(s

,o) ::=

PRE: read right ∈ acm

,o) ;

POST: acm

,o) = acm

,o) ∪{read right}

Figure 1: Exemplary command deﬁnition for a core-

based HRU model: delegateRead with parameters

models delegation of read right regarding o by s

. PRE(delegateRead) requires that s

possesses this

right for a state transition by this command to occur,

POST(delegateRead) requires s

to do so afterwards.

3 SAFETY ANALYSIS

In this section, we discuss the basic idea of heuris-

tic safety analysis. We will outline our most analysis

strategy, DEPSEARCH, along with the algorithm for

HRU safety analysis. This will be the foundation for

a subsequent discussion of algorithmic optimizations.

We start by deﬁning the notion of privilege prolifera-

tion introduced by HRU safety:

As formalized for the HRU model, the safety

of a system fundamentally addresses such questions:

Given a protection state of an HRU model, is it pos-

sible that some subject ever obtains a speciﬁc right

with respect to some object? If this may happen,

such a model state is considered unsafe with respect

to that right. An intuitive deﬁnition of this question,

(r)-simple-safety, has been presented by Tripunitara

and Li (Tripunitara and Li, 2013):

Deﬁnition 1. Given a core-based HRU model

Q,Σ,δ,λ,q

, a state q =



,acm



∈ Q is

(r)-simple-unsafe with respect to a right r ∈ R iff

∃q



,acm



∈ {δ

∗

(q,a)|a ∈ Σ

∗

∃s ∈ S

,∃o ∈ O

: r ∈ acm

(s,o)

∧



s /∈ S

∨ o /∈ O

∨ r /∈ acm

(s,o)



where δ

∗

: Q ×Σ

∗

→ Q is the transitive state transition

function deﬁned as δ

∗

(q,σ ◦ b) = δ

∗

(δ(q,σ),b) and

∗

(q,ε) = q for any σ ∈ Σ ∪ {ε},b ∈ Σ

∗

As per this deﬁnition, safety always relates to both

a speciﬁc model state q to analyze (in practice, this is

a momentary conﬁguration of the system in question)

and a speciﬁc access right r whose proliferation we

are interested in. We call this r, being the source of

an HRU model’s authentication mechanics, a safety

analysis target.

Heuristic State-Space Exploration. In order to

handle the undecidability of HRU safety, we choose

to trade accuracy for tractability: using a heuristic,

unsafe model states may be found (given such exist),

while termination of the algorithm cannot be guaran-

teed. The idea of heuristic safety analysis thus lever-

ages the semi-decidability of the problem. On the

plus side, valuable hints on model correctness are ob-

tained if unsafe states are found and policy engineers

are pointed to input sequences that lead to such states.

The strategy behind heuristic safety analysis al-

gorithms is to ﬁnd an input sequence that, starting at

q, enters r into a matrix cell of some follow-up state

target

. When this happens, q is proven to be unsafe

with respect to r; as long as no such target state is

found, the search continues. A successful heuristic

must therefore maximize the probability of an input

to contribute to a path from q to q

target

The DEPSEARCH Approach. We developed DS

based on the insight that in the most difﬁcult case,

right leakages in a model appear only after speciﬁc

state transition sequences where each command ex-

ecuted depends exactly on the execution of its pre-

decessor. From this observation we derived the idea

of a two-phases algorithm: First, a static analysis of

inter-command dependencies is performed; a subse-

quent, dynamic analysis consists of state space explo-

ration by simulating the automaton’s behavior. We

will discuss these phases on an informal basis, for an

in-depth discussion and evaluation of DS for HRU see

(Amthor et al., 2013; Amthor et al., 2014).

During the ﬁrst phase, a static analysis of the

HRU state transition scheme is performed. It yields a

graph-based description of inter-command dependen-

cies, constituted by entering (as a part of POST) and

requiring (part of PRE) the same right in two differ-

ent commands. As a result of the static analysis, these

dependencies are modeled by a command dependency

graph (CDG)

V,E

where nodes c

∈ V represent

commands, and an edge

denotes that a post-

condition of c

matches at least one pre-condition of

. An example of a CDG is depicted in Fig. 2.

The CDG is assembled in a way that all paths from

vertices without incoming edges to vertices without

outgoing edges indicate input sequences for reaching

SECRYPT 2017 - 14th International Conference on Security and Cryptography

386

target

from q. To achieve this, two virtual commands

and c

target

are generated: c

is the source of all

paths in the CDG, since it represents the state q to

analyze in terms of a command speciﬁcation added to

∆. It is generated by encoding acm

in POST(c

). In

a similar manner, c

target

is the sink of all paths in the

CDG, which represents all possible states q

target

checking the presence of the target right in any matrix

cell in PRE(c

target

In the second, dynamic analysis phase, the CDG

is used to guide dynamic state transitions by generat-

ing input sequences to the automaton. The commands

involved in each sequence are chosen according to

different paths from c

and c

target

, which in turn de-

termine the direction of state space exploration. Paths

in the CDG are generated based on a simple ant al-

gorithm: with each edge traversed to generate an in-

put sequence, the algorithm increases an edge weight

“scent” which has repellent effect for the next itera-

tion of the CDG traversal, thus effectively leading to

a full path coverage and potentially maximal chances

for actually generating a right leakage.

DS successively generates input sequences by

traversing the CDG on every possible path and in

turn parameterizing the emerging sequence of com-

mands with values from Σ

. Each effected state tran-

sition is simulated by the algorithm, and once a CDG

path is completed, the unsafety-criteria (cf. Def. 1) is

checked.

4 f DS IMPROVEMENTS

Three major problems affecting both efﬁciency and

effectivity of the original DS have become evident

during its usage:

Efﬁcient State-Space Exploration: DS uses an ant

algorithm for CDG path generation, which ultimately

determines efﬁciency and effectivity of state-space

exploration. As a closer look on more complex state

transition schemes reveals, its partially randomized

strategy is not optimal, possibly resulting in high rates

of unsatisﬁable simulation paths for such CDGs.

Static Satisﬁability Analysis: A mere dependency

analysis does not exploit particular static properties

of a state transition scheme leading to leakage-free

policies, which we call unsafety-unsatisﬁable (i. e.

provable safe). An intuitive example indicating an

unsafety-unsatisﬁable state transition scheme is the

existence of cycles in the CDG.

Parameter Dependency Analysis: The assignment

of state-speciﬁc values to parameters in the state tran-

sition scheme is a highly policy-speciﬁc task. How-

ever, since the inference of command sequences from

mutual execution dependency as one portion of the

automaton’s input proved a successful idea, we expect

signiﬁcant improvements during the dynamic analysis

phase by restricting the domain of possible parameter

values in a similar manner.

The original DS was restricted to HRU models. In

(Amthor, 2017), we generalized the approach to f DS,

which can be tailored to a wide range of core-based

models using generic interfaces. We have shown this

principle based on the SELinux model SELX. How-

ever, since f DS does not yet address the above efﬁ-

ciency problems, we will discuss them more detailed

in the following and present solution proposals.

4.1 Efﬁcient State-space Exploration

In f DS, state space exploration is driven by input se-

quences generated by the heuristic. These sequences

are controlled by the CDG, which is successively tra-

versed with the goal of maximum path diversity in

mind; however, this strategy disregards the inﬂuence

of path ordering. In a worst-case dependency situa-

tion, where each command requires execution of all

predecessors (i. e., each incoming edge of each CDG

node stands for a different dependency), this may lead

to the traversal algorithm not generating a minimal se-

quence of paths, but preferring redundant or unsatisﬁ-

able paths over necessary ones. The reason for this is

the initially equal chance for all in-edges of c

target

be chosen; the algorithm does not state any determin-

istic criteria for preferring one of them.

Consider the example in Fig. 2. Based on the par-

ticular order of choosing between equally-weighted

edges, the minimal number of paths needed to exe-

cute c

varies from 2 to 5 (unsatisﬁable commands in

parentheses):

optimal: c

→ c

→ (c

→ c

)

→ c

worst case: c

→ c

→ (c

→ c

)

→ c

→ (c

→ c

)

→ c

→ (c

→ c

)

→ c

→ (c

→ c

)

→ c

In order to prioritize such paths more likely to

be executed, nodes with low in-degree in the CDG

should be traversed before such with higher in-degree.

This leads to paths whose dependencies can be satis-

ﬁed early on, and which thus produce more successful

state transitions.

Solution. Our modiﬁed algorithms for path genera-

tion (Alg. 1) and CDG assembly (Alg. 2) adapt edge

weights (“scents”) according to the above idea:

Efﬁcient Heuristic Safety Analysis of Core-based Security Policies

387

Algorithm 1: f DS++::CDGPathGeneration

Input:

V,E

. . . CDG as generated by Alg. 2

d . . . edge weighting/increment

function of

V,E

. . . CDG source node

Output: path . . . path in the CDG

d . . . modiﬁed edge weights

function lowestScent(in E

⊆ E)

min

← E

.someMember;

minw ← d(e

min

);

for e

∈ E

if minw > d(e

) then

min

← e

;

minw ← d(e

min

);

return e

min

;

v ← c

, path ← v;

repeat

u,v, i

← lowestScent(E

out

);

path ← path ◦ v;

(1) d(

u,v, i

) ← d(

u,v, i

) +

u,v, i

);

until E

out

return path, d;

Algorithm 2: f DS++::CDGAssembly

Input: ∆ . . . model’s state transition scheme

Output:

V,E

. . . command dependency

graph

d : E → N . . . edge

weighting/increment function

. . . CDG source node

procedure predecessors(in v ∈ V )

(3) (c) P ← buildPredSet(∆,v);

for

c,i

∈ P do

if c /∈ V then

V ← V ∪ {c};

predecessors(c);

E ← E ∪ {

c,v, i

};

(1) d(

c,v, i

) ← |P|;

(2)

c,v, i

) ← |P|;

(d) c

← createCDGSource(q);

(e) c

target

← createCDGSink(target);

∆ ← ∆ ∪ {c

};

V ← {c

target

};

E ←

predecessors(c

target

);

return

V,E

,d,

d,c

;

c1 c3

c4 c5

target

Figure 2: A CDG to illustrate the path generation problem.

The edge weighting function d is initialized on

CDG assembly, where the cardinality of each node’s

set of predecessors determines the weight of all its

incoming edges (see Alg. 2, line (1)). During path

generation, edge weights serve as “scents” as usual,

while an additional increment function

d is used to

modify them when passing an edge (Alg. 1, line (1)).

Setting an edge increment to the respective edge’s ini-

tial weight during CDG assembly (Alg. 2, line (2))

ensures that the intended traversal frequency is main-

tained for the rest of the dynamic analysis.

In order to satisfy as many dependencies as possi-

ble as early as possible, it is advantageous for Alg. 1

to traverse the CDG in direction of its edges, starting

at c

(instead of in reverse, starting with c

target

4.2 Static Satisﬁability Analysis

For policies with a leakage-free state transition

scheme, safety might be statically inferred from

reachability properties of the CDG (e. g. indicating

cyclic dependencies); however, the current deﬁnition

of the CDG does not allow this: Semantics of an edge

only denote that “c

establishes at least one

condition necessary for executing c

” (cf. (Amthor

et al., 2013)) – but not how many and which particular

conditions. Fig. 3(b) shows an HRU-based example

of such a graph, with the speciﬁc rights that establish

the respective dependency added to each edge.

As indicated above, unsatisﬁable dependencies

can be statically identiﬁed by reﬁning edge semantics

in the CDG. For this we use an edge-colored multi-

graph

V,E

,E = V ×V × N, where

u,v, i

∈ E ⇔ u

establishes a precondition of v whose color is i. In

HRU for example, 1 ≤ i ≤ |R| would cover all possible

precondition colors (matching HRU rights). In SELX,

assuming (t)-safety (Amthor, 2017), colors 1 ≤ i ≤ |T |

match SELinux types.

We will now deﬁne potential satisﬁability of a

CDG as a goal of static satisﬁability analysis: Using

this deﬁnition, a costly, heuristic state-space explo-

ration can be avoided for such state transition schemes

SECRYPT 2017 - 14th International Conference on Security and Cryptography

388

r1r4

r2r4, r5

target

(a) potentially satis-

ﬁable

r1r4

r2r4, r5

target

(b) unsatisﬁable

Figure 3: Fine-grained edges semantics for CDG satisﬁabil-

ity analysis: In case (a), conditions of c

may be satisﬁed by

, while in case (b), c

1...3

all depend on each other’s prior

execution in a cycle.

Algorithm 3: f DS++::unsatisﬁable

Input: CDG =

V,E

Output: > if CDG is unsatisﬁable; ⊥ if CDG

is potentially satisﬁable

function isPSat(in v ∈ V )

if v = c

then return > ;

if v ∈ H then return ⊥ ;

H ← H ∪ {v};

for

u,v, i

∈ E

for

,v, j

∈ E

if i = j then

return isPSat(u) ∨ isPSat(u

)

else

return isPSat(u) ∧ isPSat(u

)

H ←

return ¬ isPSat(c

target

);

which do not allow for c

target

to be reachable under

any dynamic conditions.

Deﬁnition 2. Potential Satisﬁability of a CDG:

1. A CDG node v is potentially satisﬁable iff ∀u,u

∈

V,{

u,v, i

,v, j

} ⊆ E

i = j ⇒ u is potentially satisﬁable

∨ u

is potentially satisﬁable

i 6= j ⇒ u is potentially satisﬁable

∧ u

is potentially satisﬁable.

2. c

is potentially satisﬁable.

3. A CDG is potentially satisﬁable iff c

target

is poten-

tially satisﬁable.

Solution. To implement our extended CDG deﬁni-

tion, we had to modify CDG assembly: the func-

tion buildPredSet (Alg. 2, line (3)) now returns a set

of command-color-pairs, allowed to include multiple

pairs for the same predecessor command. For a core-

based model with variables set Var, it is deﬁned as

buildPredSet

SELX

(∆,c

succ

) = {



pred

∈ ∆,i ∈ N



∃x

∈ Var : PRE(c

succ

) and POST(c

pred

) depend on

the assignment of x

}

where Var is deﬁned as the set of variables in the state

transition scheme, which are used as formal parame-

ters of some command. It holds Σ

= Var

∗

As per CDG construction, there is a path from

each node to c

target

. This implies we can check the

conditions in Def. 2 in a backwards-depth-ﬁrst search,

starting from c

target

. Based on this strategy, our static

satisﬁability analysis is implemented in Alg. 3 and

called right before the dynamic analysis phase in

Alg. 5, line (1).

4.3 Parameter Dependency Analysis

In order to assist a model-speciﬁc parameter selec-

tion heuristic, domains of possible values for parame-

ter variables should be as small as possible. This can

also be achieved by a more ﬁne-grained static depen-

dency analysis: Parameter selection can be mapped

to a constraint satisfaction problem (CSP), and thus

tackled by a CSP solver algorithm. If we take a basic

arc consistency algorithm such as AC-3 (Mackworth,

1977), an additional data structure is needed to repre-

sent variables, domains, and constraints of the CSP:

the parameter constraints network (PCN).

The PCN is deﬁned as an undirected,

bipartite, and node-labeled graph PCN =

V ∪ Cons,E ⊆ V × Cons,DOM

where V ⊆ Var

is a set of variables, Cons is a set of constraints

(logical formulas), and DOM = {dom

: Var

→

Val

|1 ≤ k ≤ K} is a set of domain-labeling func-

tions for each variable. Here, Val is the set of all

possible values that could be assigned to a parameter,

corresponding to Var. It also constitutes Σ

= Val

∗

in a core-base model; for HRU e. g. Val = S ∪ O, for

SELX Val = E ∪ C ∪ P ∪ U ∪ R ∪ T . K denotes the

number of value domains, which is derived from the

number of basic sets for values: for HRU it holds

K = 2, for SELX K = 6.

Solution. The PCN is assembled by subdividing

edges in the CDG, als speciﬁed in Alg. 4. We initial-

ize our PCN with empty sets, and iteratively extend it

by transforming each edge

in the CDG into

a number of constraint nodes (line (1)): one for each

precondition in c

that matches CDG edge color i.

Each such constraint is a disjunctive formula includ-

ing one clause for each potentially i-satisfying state

Efﬁcient Heuristic Safety Analysis of Core-based Security Policies

389

Algorithm 4: f DS++::PCNAssembly

Input: CDG =

CDG

Output: PCN =

V ∪ Cons,E, DOM

V ←

0, Cons ←

0, E ←

0,DOM ←

(6) for 1 ≤ k ≤ K do

(1) for

∈ E

CDG

src

← {x ∈ Var

POST(c

) depends on x and i};

sink

← {x ∈ Var

PRE(c

) depends on x and i};

for x ∈ P

sink

if x /∈ V then

dom

(x) ← Val

;

(3) V ← V ∪ {x};

exp ← [[⊥]];

for x

∈ P

src

(2) exp ← [[exp ∨ (x = x

)]];

(4) E ← E ∪ {

,exp

};

(5) E ← E ∪ {

x,exp

};

Cons ← Cons ∪ {exp};

DOM ← DOM ∪ {dom

};

return

V ∪ Cons,E, DOM

;

manipulation in POST(c

), which is iteratively as-

sembled in line (2). We then add all variables in these

formulas as nodes to the PCN (line (3)), each con-

nected with the previously created constraint nodes

(lines (4), (5)) according to arc consistency semantics.

To clearly separate and thus minimize the different

domains of variables, the whole process is repeated

for each domain (line (6)).

During dynamic analysis, right before a command

sequence is attempted to be executed, we run the CSP

solver on the PCN, yielding a (possibly pruned) do-

main for each variable x which in turn modiﬁes the

initial PCN for the next iteration. We then select

an assignment for each variable based on a policy-

speciﬁc heuristic. We have abstracted this policy-

speciﬁc parameter assignment heuristic, which is as-

sumed to call a CSP solver as a subroutine, through

the interface assignParams (Alg. 5, line (2)).

4.4 f DS++ Heuristic

In Alg. 5, we have speciﬁed the improved f DS++ al-

gorithm, using Algs. 2, 3, 4, and 1. Arabic labels

in the algorithms denote references throughout this

chapter, while latin labels indicate abstract interfaces

that must be implemented based on the particular

core-based/EL model to analyze: assignParams (a)

implements a parameter assignment heuristic, which

is based on a momentary state, a command sequence

Algorithm 5: f DS++

Input: δ . . . model’s state transition function

∆ . . . model’s state transition scheme,

specifying δ

. . . model state to be analyzed

target . . . leakage target

Output: seq . . . states sequence leaking target

q ← q

, seq ← ε;



CDG,d,

d,c



← CDGAssembly(∆,q,target);

if unsatisﬁable(CDG) then

return seq;

else

seq ← q;

PCN ← PCNAssembly(CDG);

repeat

path,d

←

CDGPathGeneration(CDG,d,

d,c

);

(2) (a)

assignment, PCN

←

assignParams(q,path, PCN);

while c ← path.nextNode do

← δ(q,c,assignment(c));

seq ← seq ◦ q

;

q ← q

;

until(b) isLeaked(q

,target);

return seq;

to be executed, and a PCN deﬁning domains of pos-

sible values for each variable used as a parameter

in the input command sequence. It returns an as-

signment function for these parameters and a mod-

iﬁed PCN with updated (and thus minimized) do-

mains. isLeaked (b) implements a safety deﬁnition

(e. g. Def. 1), which is evaluated to a boolean value

based on some initial state, some reached state to

check for a leakage, and target. buildPredSet (b)

checks model-speciﬁc dependencies in ∆ to return the

set of predecessor nodes, along with their respective

dependency color, based on some given node in the

CDG. createCDGSource (d) creates a deﬁnition of c

based on q

. createCDGSink (e) creates a deﬁnition

of c

target

based on target.

(Amthor, 2017) shows how to implement these in-

terfaces based on the example of SELX.

5 ONGOING EVALUATION

This section describes ongoing and future work re-

garding an experimental evaluation of f DS++. Us-

ing SELX-implementations of the interfaces listed in

Sec. 4.4, we have implemented Alg. 5 and performed

an exemplary (t)-safety analysis of an SELinux policy

excerpt as a ﬁrst proof-of-concept application.

SECRYPT 2017 - 14th International Conference on Security and Cryptography

390

One major prerequisite for applying the heuristic

is model instantiation. Here, we have reused existing

tools and methods for extracting both an initial state

space and static policy rules. These methods are de-

scribed in detail in (Amthor, 2016) and include (1) a

ﬁle system crawler that extracts protection state infor-

mation from a ﬁle system of a virtual machine snap-

shot, (2) a policy scanner, which parses the SELinux

policy speciﬁcation language and produces a SELX

model implementation, (3) a simulation runtime envi-

ronment (WorSE, cf. (Amthor et al., 2014)) that im-

plements the automaton’s state transition scheme.

We speciﬁed our state transition scheme using

SELX basic commands, as described in (Amthor,

2016), which led to a expectable, trivial CDG consist-

ing solely of create and relabel. Composing these ba-

sic commands and taking into account other than only

type-dependencies leads to a more complex graph.

Note that in this speciﬁc analysis scenario, inter-

command dependencies are solely type variables –

leading to a runtime-speciﬁc CDG, whose dynamic

reanalysis has not been subject of our heuristic yet (as

already pointed out in Sec. 4.2).

Moreover, focusing on rather complex policy se-

mantics as in SELinux emphasizes the impact of mul-

tiple dependency classes: in SELX these are, for ex-

ample, type-, role-, class-, or user-dependency, all

of which must be represented in the CDG. For the

sake of clearly implementing and presenting the al-

gorithmic concepts, we have so far opted for a one-

dimensional solution, taking into account solely type-

dependencies. Since our approach is approximative,

this delivers valid results, yet open to further opti-

mization in terms of ﬁne-grained policy semantics.

Both problems, dynamic CDGs and complex de-

pendencies, indicate the direction of our future re-

search in heuristic safety analysis. The immediate

next step, an experimental, comparative evaluation

of the improvements of f DS++ in terms of heuristic

steps count and heuristic runtime, is subject ongoing

work regarding practical systems analyses.

6 CONCLUSIONS

In this paper, we have presented solutions to three

open problems with heuristic safety analysis: First,

we identiﬁed an efﬁciency-enhanced path generation

scheme for state-space exploration, which prefers

such commands with less dependencies required to be

executed, and derived an edge-weighting scheme for

its implementation. Second, we deﬁned the unsafety-

unsatisﬁability property of a state transition scheme

in terms of command reachability (which also means

potential executability). We then speciﬁed an algo-

rithm for a static analysis that may identify policies

satisfying this property as safe, eliminating the need

for a heuristic simulation in such cases. Third, a

static support algorithm for model-speciﬁc parame-

ter assignment heuristics was described. The idea is

basically identical to that of inter-command depen-

dencies, which is implemented leveraging a constraint

satisfaction problem solver (an arc consistency algo-

rithm was proposed for this).

As a proof of concept, we have presented practi-

cal insights given by an analysis of an SELinux se-

curity policy based on SELX, which pave the way for

current and future research focusing multiple depen-

dency classes in complex policies and dynamic com-

mand dependency graphs.

REFERENCES

Amthor, P. (2015). A Uniform Modeling Pattern for Oper-

ating Systems Access Control Policies with an Appli-

cation to SELinux. In Proc. 12th Int. Conf. on Security

and Cryptography, SECRYPT 2015, pp. 88–99.

Amthor, P. (2016). E-Business and Telecommunications:

12th Int. Joint Conf., ICETE 2015, Colmar, France,

July 20–22, 2015, Revised Selected Papers, chapter

The Entity Labeling Pattern for Modeling Operating

Systems Access Control, pp. 270–292. Springer.

Amthor, P. (2017). Towards a Uniform Framework for

Dynamic Analysis of Access Control Models. In

Proc. 10th International Symposium on Foundations

& Practice of Security, FPS 2017. (under review)

Amthor, P., K

uhnhauser, W. E., and P

olck, A. (2013).

Heuristic Safety Analysis of Access Control Mod-

els. In Proc. 18th ACM Symposium on Access Control

Models and Technologies, SACMAT ’13, pp. 137–

148. ACM.

Amthor, P., K

uhnhauser, W. E., and P

olck, A. (2014).

WorSE: A Workbench for Model-based Security En-

gineering. Computers & Security, 42(0):40–55.

Ferrara, A. L., Madhusudan, P., and Parlato, G. (2013). Pol-

icy Analysis for Self-administrated Role-Based Ac-

cess Control. In Piterman, N. and Smolka, S. A., ed-

itors, Tools and Algorithms for the Construction and

Analysis of Systems, vol. 7795 of LNCS, pp. 432–447.

Springer.

Harrison, M. A., Ruzzo, W. L., and Ullman, J. D. (1976).

Protection in Operating Systems. Communications of

the ACM, 19(8):461–471.

Kleiner, E. and Newcomb, T. (2007). On the Decidabil-

ity of the Safety Problem for Access Control Poli-

cies. Electronic Notes in Theoretical Computer Sci-

ence (ENTCS), 185:107–120.

uhnhauser, W. E. and P

olck, A. (2011). Towards Access

Control Model Engineering. In Proc. 7th Int. Conf. on

Information Systems Security, ICISS’11, pp. 379–382.

Efﬁcient Heuristic Safety Analysis of Core-based Security Policies

391

Lampson, B. W. (1971). Protection. In 5th Ann. Princeton

Conf. on Information Sciences and Systems, pp. 437–

443. Reprinted Jan, 1974: Protection. In Operating

Systems Review, 8(1), pp. 18–24.

Mackworth, A. K. (1977). Consistency in Networks of Re-

lations. Artiﬁcial Intelligence, 8(1):99–118.

olck, A. (2014). Small TCBs of Policy-controlled Operat-

ing Systems. Universit

atsverlag Ilmenau.

Ranise, S., Truong, A., and Armando, A. (2014). Scalable

and precise automated analysis of administrative tem-

poral role-based access control. In Proc. 19th ACM

Symposium on Access Control Models and Technolo-

gies, SACMAT ’14, pp. 103–114. ACM.

Sandhu, R. (1988). The Schematic Protection Model:

Its Deﬁnition and Analysis for Acyclic Attenuating

Schemes. Journal of the ACM, 35(2):404–432.

Sandhu, R. S. (1992). The Typed Access Matrix Model. In

Proc. 1992 IEEE Symposium on Security and Privacy,

SP ’92, pp. 122–136. IEEE.

Shahen, J., Niu, J., and Tripunitara, M. (2015). Mohawk+T:

Efﬁcient Analysis of Administrative Temporal Role-

Based Access Control (ATRBAC) Policies. In Proc.

20th ACM Symposium on Access Control Models and

Technologies, SACMAT ’15, pp. 15–26. ACM.

Stoller, S. D., Yang, P., Gofman, M., and Ramakrishnan,

C. R. (2011). Symbolic Reachability Analysis for Pa-

rameterized Administrative Role Based Access Con-

trol. Computers & Security, 30(2-3):148–164.

Tripunitara, M. V. and Li, N. (2013). The Foundational

Work of Harrison-Ruzzo-Ullman Revisited. IEEE

Trans. Dependable Secur. Comput., 10(1):28–39.

SECRYPT 2017 - 14th International Conference on Security and Cryptography

392