Extracting Database Access-control Policies From Web Applications

• URL: http://arxiv.org/abs/2411.11380v1
• Date: Mon, 18 Nov 2024 08:58:11 GMT
• Title: Extracting Database Access-control Policies From Web Applications
• Authors: Wen Zhang, Dev Bali, Jamison Kerney, Aurojit Panda, Scott Shenker,
• Abstract summary: It is difficult to divine what policy is embedded in application code and what data the application may access. This paper tackles policy extraction: the task of extracting the access-control policy. Ote is a policy extractor for Ruby-on-Rails web applications.
• Score: 5.193592261722995
• License:
• Abstract: To safeguard sensitive user data, web developers typically rely on an implicit access-control policies, which they implement using access checks and query filters. This ad-hoc approach is error-prone, as these scattered checks and filters are easy to misplace or misspecify; and the lack of an explicit policy precludes external access-control enforcement. More critically, it is difficult to divine what policy is embedded in application code and what data the application may access -- an issue that worsens as development teams evolve. This paper tackles policy extraction: the task of extracting the access-control policy embedded in an application by summarizing its data queries. An extracted policy, once vetted for errors, can stand alone as a specification for the application's data access, and can be enforced to ensure compliance as code changes over time. We introduce Ote, a policy extractor for Ruby-on-Rails web applications. Ote uses concolic execution to explore execution paths through the application, generating traces of SQL queries and conditions that trigger them. It then merges and simplifies these traces into a final policy that aligns with the observed behaviors. We applied Ote to three real-world applications and compare extracted policies to handwritten ones, revealing several errors in the latter.

Related papers

• Harpocrates: A Statically Typed Privacy Conscious Programming Framework [1.4732811715354455]
  Harpocrates eliminates raw data for a policy protected type from the application, ensuring it can only exist in protected form. Harpocras allows the data to flow freely throughout the application, inside the policy membranes but enforces the policies when the data is tried to be accessed, mutated, declassified or passed through the application boundary.
  arXiv  Detail & Related papers  (2024-11-10T00:28:58Z)
• RAGent: Retrieval-based Access Control Policy Generation [1.2016264781280588]
  RAGent is a novel retrieval-based access control policy generation framework based on language models. RAGent identifies access requirements from high-level requirement specifications with an average state-of-the-art F1 score of 87.9%. Unlike existing frameworks, RAGent generates policies with complex components like purposes and conditions, in addition to subjects, actions, and resources.
  arXiv  Detail & Related papers  (2024-09-08T00:23:37Z)
• PolicyLR: A Logic Representation For Privacy Policies [34.73520882451813]
  We propose PolicyLR, a new paradigm that offers a comprehensive machine-readable representation of privacy policies. PolicyLR converts privacy policies into a machine-readable format using valuations of atomic formulae. We demonstrate PolicyLR in three privacy tasks: Policy Compliance, Inconsistency Detection and Privacy Comparison Shopping.
  arXiv  Detail & Related papers  (2024-08-27T07:27:16Z)
• Are you still on track!? Catching LLM Task Drift with Activations [55.75645403965326]
  Task drift allows attackers to exfiltrate data or influence the LLM's output for other users. We show that a simple linear classifier can detect drift with near-perfect ROC AUC on an out-of-distribution test set. We observe that this approach generalizes surprisingly well to unseen task domains, such as prompt injections, jailbreaks, and malicious instructions.
  arXiv  Detail & Related papers  (2024-06-02T16:53:21Z)
• Sparsity-Aware Intelligent Massive Random Access Control in Open RAN: A Reinforcement Learning Based Approach [61.74489383629319]
  Massive random access of devices in the emerging Open Radio Access Network (O-RAN) brings great challenge to the access control and management. reinforcement-learning (RL)-assisted scheme of closed-loop access control is proposed to preserve sparsity of access requests. Deep-RL-assisted SAUD is proposed to resolve highly complex environments with continuous and high-dimensional state and action spaces.
  arXiv  Detail & Related papers  (2023-03-05T12:25:49Z)
• Distributed-Training-and-Execution Multi-Agent Reinforcement Learning for Power Control in HetNet [48.96004919910818]
  We propose a multi-agent deep reinforcement learning (MADRL) based power control scheme for the HetNet. To promote cooperation among agents, we develop a penalty-based Q learning (PQL) algorithm for MADRL systems. In this way, an agent's policy can be learned by other agents more easily, resulting in a more efficient collaboration process.
  arXiv  Detail & Related papers  (2022-12-15T17:01:56Z)
• Offline RL With Realistic Datasets: Heteroskedasticity and Support Constraints [82.43359506154117]
  We show that typical offline reinforcement learning methods fail to learn from data with non-uniform variability. Our method is simple, theoretically motivated, and improves performance across a wide range of offline RL problems in Atari games, navigation, and pixel-based manipulation.
  arXiv  Detail & Related papers  (2022-11-02T11:36:06Z)
• Mutual Information Regularized Offline Reinforcement Learning [76.05299071490913]
  We propose a novel MISA framework to approach offline RL from the perspective of Mutual Information between States and Actions in the dataset. We show that optimizing this lower bound is equivalent to maximizing the likelihood of a one-step improved policy on the offline dataset. We introduce 3 different variants of MISA, and empirically demonstrate that tighter mutual information lower bound gives better offline RL performance.
  arXiv  Detail & Related papers  (2022-10-14T03:22:43Z)
• Cross-Policy Compliance Detection via Question Answering [13.373804837863155]
  We propose to address policy compliance detection via decomposing it into question answering. We demonstrate that this approach results in better accuracy, especially in the cross-policy setup. It explicitly identifies the information missing from a scenario in case policy compliance cannot be determined.
  arXiv  Detail & Related papers  (2021-09-08T15:47:41Z)
• Benchmarks for Deep Off-Policy Evaluation [152.28569758144022]
  We present a collection of policies that can be used for benchmarking off-policy evaluation. The goal of our benchmark is to provide a standardized measure of progress that is motivated from a set of principles. We provide open-source access to our data and code to foster future research in this area.
  arXiv  Detail & Related papers  (2021-03-30T18:09:33Z)
• Fast Compliance Checking with General Vocabularies [0.0]
  We introduce an OWL2 profile for representing data protection policies. With this language, a company's data usage policy can be checked for compliance with data subjects' consent. We exploit IBQ reasoning to integrate specialized reasoners for the policy language and the vocabulary's language.
  arXiv  Detail & Related papers  (2020-01-16T09:08:00Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.