Catalog Home Page

Reusability of functionality-based application confinement policy abstractions

Schreuders, Z.C. and Payne, C. (2008) Reusability of functionality-based application confinement policy abstractions. In: 10th International Conference on Information and Communications Security (ICICS 2008), 20 - 22 October, Birmingham.

[img]
Preview
PDF - Authors' Version
Download (134kB) | Preview
    Link to Published Version: http://dx.doi.org/10.1007/978-3-540-88625-9_14
    *Subscription may be required

    Abstract

    Traditional access control models and mechanisms struggle to contain the threats posed by malware and software vulnerabilities as these cannot differentiate between processes acting on behalf of users and those posing threats to users’ security as every process executes with the full set of the user's privileges. Existing application confinement schemes attempt to address this by limiting the actions of particular processes. However, the management of these mechanisms requires security-specific expertise which users and administrators often do not possess. Further, these models do not scale well to confine the large number of applications found on functionality-rich contemporary systems. This paper describes how the principles of role-based access control (RBAC) can be applied to the problem of restricting an application's behaviour. This approach provides a more flexible, scalable and easier to manage confinement paradigm that requires far less in terms of user expertise than existing schemes. Known as functionality-based application confinement (FBAC), this model significantly mitigates the usability limitations of existing approaches. We present a case study of a Linux-based implementation of FBAC known as FBAC-LSM and demonstrate the flexibility and scalability of the FBAC model.

    Publication Type: Conference Paper
    Murdoch Affiliation: School of Information Technology
    Publisher: Springer-Verlag
    Copyright: © Springer-Verlag Berlin Heidelberg 2008
    Notes: Appears in: Chen, L., Ryan, M. & Wang, G. (Eds.) Lecture Notes in Computer Science, 2008, Volume 5308/2008, 206-221
    URI: http://researchrepository.murdoch.edu.au/id/eprint/4369
    Item Control Page

    Downloads

    Downloads per month over past year