Securing Web Applications with Predicate Access Control - Inria - Institut national de recherche en sciences et technologies du numérique Access content directly
Conference Papers Year : 2017

Securing Web Applications with Predicate Access Control

Zhaomo Yang
  • Function : Author
  • PersonId : 1026629
Kirill Levchenko
  • Function : Author
  • PersonId : 1026630

Abstract

Web application security is an increasingly important concern as we entrust these applications to handle sensitive user data. Security vulnerabilities in these applications are quite common, however, allowing malicious users to steal other application users’ data. A more reliable mechanism for enforcing application security policies is needed. Most applications rely on a database to store user data, making it a natural point to introduce additional access controls. Unfortunately, existing database access control mechanisms are too coarse-grained to express an application security policy. In this paper we propose and implement a fine-grained access control mechanism for controlling access to user data. Application access control policy is expressed using row-level access predicates, which allow an application’s access control policy to be extended to the database. These predicates are expressed using the SQL syntax familiar to developers, minimizing the developer effort necessary to take advantage of this mechanism. We implement our predicate access control system in the PostgreSQL 9.2 DBMS and evaluate our system by developing an access control policy for the Drupal 7 and Spree Commerce. Our mechanism protected Drupal and Spree against five known security vulnerabilities.
Fichier principal
Vignette du fichier
453481_1_En_30_Chapter.pdf (190.87 Ko) Télécharger le fichier
Origin : Files produced by the author(s)
Loading...

Dates and versions

hal-01684360 , version 1 (15-01-2018)

Licence

Attribution

Identifiers

Cite

Zhaomo Yang, Kirill Levchenko. Securing Web Applications with Predicate Access Control. 31th IFIP Annual Conference on Data and Applications Security and Privacy (DBSEC), Jul 2017, Philadelphia, PA, United States. pp.541-554, ⟨10.1007/978-3-319-61176-1_30⟩. ⟨hal-01684360⟩
64 View
123 Download

Altmetric

Share

Gmail Facebook X LinkedIn More