History-sensitive versus future-sensitive approaches to security in distributed systems

TL;DR

This paper explores combining history-sensitive and future-sensitive security policies in distributed systems using aspect-oriented techniques, enhancing flexibility and control in access management.

Contribution

It introduces a novel aspect-oriented language that integrates history- and future-sensitive security policies for distributed systems.

Findings

The language effectively models Bell-LaPadula policy.

Combines history- and future-sensitive policies seamlessly.

Enhances flexibility in security policy specification.

Abstract

We consider the use of aspect-oriented techniques as a flexible way to deal with security policies in distributed systems. Recent work suggests to use aspects for analysing the future behaviour of programs and to make access control decisions based on this; this gives the flavour of dealing with information flow rather than mere access control. We show in this paper that it is beneficial to augment this approach with history-based components as is the traditional approach in reference monitor-based approaches to mandatory access control. Our developments are performed in an aspect-oriented coordination language aiming to describe the Bell-LaPadula policy as elegantly as possible. Furthermore, the resulting language has the capability of combining both history- and future-sensitive policies, providing even more flexibility and power.