Analyzing access control configurations

• US 8,701,200 B2
• Filed: 09/11/2012
• Issued: 04/15/2014
• Est. Priority Date: 10/31/2006
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Naldurg, Prasad G., Rajamani, Sriram K., Schwoon, Stefan, Lambert, John
• Primary Examiner(s): Reza, Mohammad W
• Application Number:
  US13/610,702
• Publication Number:
  US 20130067583A1
• Time in Patent Office: 581 Days
• Field of Search: 726/25, 726/2, 726/17, 726/22, 726/23, 726/26, 713/182
• US Class Current: 726/25
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system

Abstract

A facility is described for analyzing access control configurations. In various embodiments, the facility comprises an operating system having resources and identifications of principals, the principals having access control privileges relating to the resources, the access control privileges described by access control metadata; an access control scanner component that receives the access control metadata, determines relationships between principals and resources, and emits access control relations information; and an access control inference engine that receives the emitted access control relations information and an access control policy model, analyzes the received information and model, and emits a vulnerability report. In various embodiments, the facility generates an information flow based on access control relations, an access control mechanism model, and an access control policy model; determines, based on the generated information flow, whether privilege escalation is possible; and when privilege escalation is possible, indicates in a vulnerability report that privilege escalation is possible.

Claims

1. A computer-readable memory device encoded with computer-executable instructions that, when executed, perform a method of analyzing access control configurations, the method comprising:

generating an information flow based on access control relations, an access control mechanism model, and an access control policy model, wherein the information flow comprises inferred read, write, and execute relations between one or more principals and one or more resources, the inferred read, write, and execute relations determined by processing the access control relations according to functions of the access control mechanism model;

determining, based on applying functions of the access control policy model to the inferred read, write, and execute relations of the generated information flow, whether privilege escalation is possible; and

when privilege escalation is possible, indicating in a vulnerability report that the privilege escalation is possible;

wherein the vulnerability report comprises one or more hierarchical structures, and wherein each hierarchical structure comprises;

a root element identifying a potential privilege escalation with a corresponding type, resource, and principal; and

a derivation comprising one or more non-root elements that are descendants of the root element and identify the source of each of the type, resource, and principal.

2. The computer-readable memory device of claim 1 further comprising:

determining, based on the generated information flow, whether taint is possible; and

when taint is possible, indicating in the vulnerability report that the taint is possible.

3. The computer-readable memory device of claim 1 further comprising:

determining, based on the generated information flow, whether integrity can be compromised; and

when integrity can be compromised, indicating in the vulnerability report that the integrity can be compromised.

4. The computer-readable memory device of claim 1 wherein the information flow identifies relationships between principals and resources.

5. The computer-readable memory device of claim 1 wherein the access control policy model defines system security policies.

6. The computer-readable memory device of claim 1 wherein the access control mechanism model comprises an operating system-specific component identifying resources and principals, and a component that is general across several operating systems.

7. The computer-readable memory device of claim 6 wherein:

the operating system-specific component receives the access control relations and emits a relationship dataset; and

the component that is general across several operating systems receives the relations dataset and emits the information flow.

8. The computer-readable memory device of claim 1 wherein the vulnerability report is provided in a hierarchical representation, identifies a security vulnerability in the operating system, or identifies a reason for a vulnerability.

9. The computer-readable memory device of claim 1 wherein the method further comprises receiving the vulnerability report at a access control graph viewer component and emitting a graphical report that illustrates vulnerabilities identified by the vulnerability report.

10. A method of analyzing access control configurations, the method comprising:

generating an information flow based on access control relations, an access control mechanism model, and an access control policy model, wherein the information flow comprises inferred read, write, and execute relations between one or more principals and one or more resources, the inferred read, write, and execute relations determined by processing the access control relations according to functions of the access control mechanism model;

determining, based on applying functions of the access control policy model to the inferred read, write, and execute relations of the generated information flow, whether privilege escalation is possible; and

when privilege escalation is possible, indicating in a vulnerability report that privilege escalation is possible;

wherein the vulnerability report comprises one or more hierarchical structures, and

wherein each hierarchical structure comprises;

a root element identifying a potential privilege escalation with a corresponding type, resource, and principal; and

a derivation comprising one or more non-root elements that are descendants of the root element and identify the source of each of the type, resource, and principal.

11. The method of claim 10 wherein the information flow identifies relationships between principals and resources.

12. The method of claim 10 wherein the access control policy model defines system security policies.

13. The method of claim 10 wherein the access control mechanism model comprises an operating system-specific component identifying resources and principals, and a component that is general across several operating systems.

14. The method of claim 13 further comprising:

receiving, by the operating system-specific component, the access control relations and emitting a relationship dataset; and

receiving, by the component that is general across several operating systems, the relations dataset and emitting the information flow.

15. A system for analyzing access control configurations, the system comprising:

at least one memory and at least one processor;

an operating system having resources and identifications of principals;

an information flow component configured to generate an information flow based on access control relations, an access control mechanism model, and an access control policy model, wherein the information flow comprises inferred read, write, and execute relations between one or more principals and one or more resources, the inferred read, write, and execute relations determined by processing the access control relations according to functions of the access control mechanism model;

an escalation checking component configured to determine, based on applying functions of the access control policy model to the inferred read, write, and execute relations of the generated information flow, whether privilege escalation is possible; and

a vulnerability report generator configured to, when privilege escalation is possible, generate a vulnerability report indicating that privilege escalation is possible;

wherein the vulnerability report comprises one or more hierarchical structures, and wherein each hierarchical structure comprises;

a root element identifying a potential privilege escalation with a corresponding type, resource, and principal; and

a derivation comprising one or more non-root elements that are descendants of the root element and identify the source of each of the type, resource, and principal.

16. The system of claim 15 wherein the information flow identifies one or more relationships between at least one of the principals and at least one of the resources.

17. The system of claim 15 wherein the access control policy model defines system security policies.

18. The system of claim 15 wherein the access control mechanism model comprises an operating system-specific component identifying resources and principals, and a component that is general across several operating systems.

19. The system of claim 15 wherein:

the operating system-specific component receives the access control relations and emits a relationship dataset; and

the component that is general across several operating systems receives the relations dataset and emits the information flow.

20. The system of claim 15 wherein

the escalation checking component further determines, based on the generated information flow, that taint is possible or that integrity can be compromised;

and

the vulnerability report generator indicates in the vulnerability report that taint is possible or that integrity can be compromised.