Dynamic mandatory access control for multiple stakeholders

12 years 4 months ago
Dynamic mandatory access control for multiple stakeholders
In this paper, we present a mandatory access control system that uses input from multiple stakeholders to compose policies based on runtime information. In the emerging ubiquitous environment, many devices run software whose access permissions depends on multiple stakeholders, such as the device owner, the service provider, the application owner, etc., rather than a single system administrator. However, current access control administration remains as either discretionary, allowing the running and perhaps compromised process to administer, or mandatory, requiring all permissions to be known by load-time. A key problem is that users may download arbitrary programs to their devices, requiring that the system contain such programs while allowing some reasonable functionality. However, such programs may need access to resources that can lead to attacks, such as implementing voice-over-IP calls, but that may also be needed for benign operations. In our approach, we use a “soft” sandbox...
Vikhyath Rao, Trent Jaeger
Added 28 May 2010
Updated 28 May 2010
Type Conference
Year 2009
Authors Vikhyath Rao, Trent Jaeger
Comments (0)