CAREER: Tolerating Access Control Misconfiguration

点击翻译按钮获取中文摘要

Access control is a multi-faceted area that has been advanced by a wide range of computer science research communities including programming languages, human-computer interaction, computerarchitecture, and operating systems. In general, this body of work has either sought to improve the expressiveness of access control logic or introduce novel mechanisms for enforcing policies. Eachapproach relies on a human operator or programmer to manually specify access control policies which are then enforced by a trusted reference monitor. Unfortunately, policy specification is often an error-prone process and can lead to damaging breaches of confidentiality due toaccess control misconfiguration. This work takes a three-phased approach to mitigating the effects of access control misconfiguration: 1) develop heuristics and models of proper access control enforcement, 2) design and implement system monitoring mechanisms capable of automatically identifying suspicious sharing patterns, and 3) evaluate the effectiveness of these heuristics and implementations through user studies and honeypots. These activities target both ubiquitousInternet systems such as the web and email as well as emerging mobile systems such as mobile social networks and mobile banking.