Severity Level of Permissions in Role-Based Access Control

TL;DR

This paper introduces a methodology to quantify the importance of permissions in role-based access control systems by calculating their severity levels, aiding in identifying critical permissions and reducing redundancy.

Contribution

It proposes a novel approach using analytic hierarchy process to determine permission severity levels based on role hierarchy structure.

Findings

A numerical severity level reflects permission importance.

The methodology helps identify critical permissions for security.

Role graph serves as the decision tree for analysis.

Abstract

The analysis of hidden channels of information leakage with respect to role-based access control includes monitoring of excessive permissions among users. It is not always possible to completely eliminate redundancy. The problem of ranking permissions arises in order to identify the most significant, for which redundancy is most not desirable. A numerical characteristic that reflects the value or importance of permissions is called the "severity level". A number of heuristic assumptions have been formulated that make it possible to establish the dependence of the severity level of permissions on the structure of the role hierarchy. A methodology for solving the problem is proposed, using analytic hierarchy process and taking into account these assumptions. The main idea is that the decision tree of the process will be the role graph.

Tables

Table 1. Table 1: Distribution of permissions in the role tree T 𝑇 T

$p_i$	Severity level	What roles are assigned	Number of roles	Levels of tree
$p_1$	$0.16$	$r_1$, $r_3$, $r_4$, $r_5$, $r_8$, $r_{10}$, $r_{11}$	$7$	$0$ – $3$
$p_2$	0.26	$r_1,r_2,r_3,r_5,r_6$	$5$	$0$ – $2$
$p_3$	0.25	$r_1,r_2,r_3,r_4,r_5,r_9$	$6$	$0$ – $2$
$p_4$	$0.16$	$r_1,r_3,r_4,r_6,r_8,r_{10},r_{11}$	$7$	$0$ – $3$
$p_5$	$0.17$	$r_1,r_4,r_7,r_8,r_9,r_{10}$	$6$	$0$ – $3$

Equations

$$m_{ij}=\frac{|RP(r_i)|}{|RP(r_j)|}.$$

$$m_{is}\times m_{sj}=\frac{|RP(r_i)|}{|RP(r_s)|}\times \frac{|RP(r_s)|}{|RP(r_j)|}=\frac{|RP(r_i)|}{|RP(r_j)|}=m_{ij}.$$

$$w_i=m_{i1}^{\ast }=\frac{m_{i1}}{m_{11}+\dots +m_{k1}}=\frac{|RP(r_i)|}{|RP(r_1)|+\dots +|RP(r_k)|},$$

$$w_{ij}=\frac{|RP(r_{ij})|}{|RP(r_{i1})|+\dots +|RP(r_{ik})|},j=1,\dots ,k.$$

$$S(p_i)=\sum _{\rho (r,r_l):RP(r_l)=\{p_i\}}\left(\prod _{j:r_j\in \rho (r,r_l)}{w}_j\right).$$

$$|\text{RP}{|}_{2,3,4}=\left(\begin{array}{c}2\\ 4\\ 4\end{array}\right),{\text{W}}_{2,3,4}=\left(\begin{array}{c}0.2\\ 0.4\\ 0.4\end{array}\right).$$

$$|\text{RP}{|}_{5,6}=\left(\begin{array}{c}3\\ 2\end{array}\right),|\text{RP}{|}_{7,8,9}=\left(\begin{array}{c}1\\ 3\\ 2\end{array}\right),|\text{RP}{|}_{10,11}=\left(\begin{array}{c}3\\ 2\end{array}\right),$$

$${\text{W}}_{5,6}=\left(\begin{array}{c}0.6\\ 0.4\end{array}\right),{\text{W}}_{7,8,9}\approx \left(\begin{array}{c}0.17\\ 0.5\\ 0.33\end{array}\right),{\text{W}}_{10,11}=\left(\begin{array}{c}0.6\\ 0.4\end{array}\right).$$

$$S(p_1)=w_{5,1}{w}_5{w}_4+w_{10,1}{w}_{10}{w}_8{w}_4+w_{11,1}{w}_{11}{w}_8{w}_4\approx$$

$$\approx 0.33\cdot 0.6\cdot 0.4+0.33\cdot 0.6\cdot 0.5\cdot 0.4+0.5\cdot 0.4\cdot 0.5\cdot 0.4\approx \mathrm{0.16.}$$

$$S(p_2)\approx 0.5\cdot 0.2+0.33\cdot 0.6\cdot 0.4+0.5\cdot 0.4\cdot 0.4\approx \mathrm{0.26.}$$

$$S(p_3)\approx 0.5\cdot 0.2+0.33\cdot 0.6\cdot 0.4+0.5\cdot 0.33\cdot 0.4\approx \mathrm{0.25.}$$

$$S(p_4)\approx 0.5\cdot 0.4\cdot 0.4+0.33\cdot 0.6\cdot 0.5\cdot 0.4+0.5\cdot 0.4\cdot 0.5\cdot 0.4\approx \mathrm{0.16.}$$

$$S{p}_5)\approx 1\cdot 0.17\cdot 0.4+0.33\cdot 0.6\cdot 0.5\cdot 0.4+0.5\cdot 0.33\cdot 0.4\approx \mathrm{0.17.}$$

$$R(V,T)=P(V,T)\cdot I(T),$$

Full text

Severity Level of Permissions in Role-Based Access Control

S.V. Belim, N.F. Bogachenko, A.N. Kabanov

Dostoevsky Omsk State University, Omsk, Russia

Abstract

The analysis of hidden channels of information leakage with respect to role-based access control includes monitoring of excessive permissions among users. It is not always possible to completely eliminate redundancy. The problem of ranking permissions arises in order to identify the most significant, for which redundancy is most not desirable. A numerical characteristic that reflects the value or importance of permissions is called the ”severity level”. A number of heuristic assumptions have been formulated that make it possible to establish the dependence of the severity level of permissions on the structure of the role hierarchy. A methodology for solving the problem is proposed, using analytic hierarchy process and taking into account these assumptions. The main idea is that the decision tree of the process will be the role graph.

Keywords: role structure; analytic hierarchy process; severity level of permissions.

1 Introduction

The concept of roles has become widespread in the field of information security [1, 2]. At the heart of the role-based access control is the idea of distributing rights and privileges (we will call them permissions) between users not directly, but through assigning certain roles to them. In the process of authorizing a user for a certain role, he receives a set of permissions assigned to the given role.

One of the most difficult problems encountered in the construction of access control systems is the problem of covert channels of information leakage. A covert channel of information leakage is a mechanism by which a computer system can transmit information between entities bypassing the access control policy. At the same time, any model of access control should provide proof, including formal one, of the impossibility of inadmissible information flows. But such proofs are mostly based on a single security criterion. For example, such a criterion may be ”the impossibility of accessing subjects to objects outside explicit permissions”. Outside the proof, there are implicit information flows, which are caused by covert channels of information leakage. Thus, proof of the absence of ”dangerous” accesses and analysis of covert channels of information leakage are two components of any access control system.

In the context of a role-based access control, for which many modifications and extensions have been proposed [3, 4, 5, 6, 7, 8, 9, 10], first of all an analysis of the problem of users’ excessive permissions is needed. Obviously, this indicator is decisive in assessing the possibility of unauthorized transmission of information. As part of the solution of the problem, permissions should be ranked ”according to the level of danger of information leakage” or ”according to the degree of preference from the point of view of the attacker”. The quantitative characteristics that meet the qualitative criteria are called ”the severity level” of permissions. The term used is understood as the significance or value of the corresponding rights and privileges in terms of information security of the system: the higher the severity level of permission, the greater the loss in case of its misuse (leakage).

In this paper, we consider systems with a hierarchical organization of a set of roles that contain in their description an oriented (role) graph, which is most often used only to control the inheritance of the permissions assigned to roles. It is suggested, on the basis of the role graph, to obtain additional information necessary for analyzing the security of the system. Most approaches to analyzing graphs of access to information resources are connected with the study of attack graphs of models with discretionary access control [11]. In a more general case, the threats realization graph can be constructed to analyze the security of information systems [12]. Unfortunately, most of the work is devoted to the synthesis of such graphs and only a few to formal models of their analysis. Most often this is the use of standard methods of analysis of oriented graphs [13], or other search algorithms, for example, recursive algebraic analysis [14]. As will be shown below, the hierarchical organization of the set of roles in a system with role-based access control makes it possible to apply the analytic hierarchy process, used to quantify the phenomena of a qualitative nature, to determine the severity level and rank permissions [15, 16]. In the future, when reconstructing the role hierarchy in order to reduce the number of excessive permissions, it is first necessary to analyze roles that have permissions with a higher severity level.

2 Formulation of the problem

The role-based access control is determined by a set of four sets: $U$ – the set of users, $R$ – the set of roles, $P$ – the set of permissions (rights, privileges), $C$ – the set of users’ sessions in the system. Along with the role, the user receives a certain set (list) of permissions assigned to the given role. There are three main issues in the organization of role-based access:

1. How many and which roles can be assigned to one user.

2. How many and which roles a user can use in a single session with the system (to which roles the user can be authorized).

3. Is it possible to delegate (transfer) permissions from one role to another.

Depending on the methods of solving the questions posed, there are several types of role models. The most common is a model with a hierarchical organization of multiple roles. In this case, the senior in the hierarchy role gets the permissions of the roles directly subordinate to it.

We denote the set of permissions assigned to some role $r\in R$ as $RP(r)$. Then the model with a hierarchical role system is determined by the following refinements and additions:

1. A partial order relation is introduced on the role set $R$ specifying the dominant / subordinate operator of the roles ”$\geq$”: if $r_{1}\geq r_{2}$, then the role $r_{1}$ is higher in the hierarchy than the role $r_{2}$ and the set of permissions $RP(r_{1})$ includes the set of permissions $RP(r_{2})$.

2. If the role $r$ is assigned to the user $u\in U$, then all roles subordinate to $r$ are automatically assigned to him. If the user $u$ is authorized for the role $r$ in the current session of the system, then he is automatically authorized for all roles that are subordinate to $r$. The set of permissions that are available to the user for all roles for which he is authorized in the current session of the system is determined by taking into account the subordinate roles.

It is convenient to describe the hierarchy of roles with a labeled oriented graph (we call it role), in which the vertices correspond to the roles existing in the system, the vertex labels represent the sets of permissions for these roles, the edges define the dominance / subordination of roles. As a rule, it is considered that the role graph is an oriented tree. In fact, this is not so obvious, and in a more general case it is sufficient to require that the hierarchy be described by an oriented acyclic graph [17]. But within the framework of this article, we need the tree role graph. It is worth noting that the authors of [9, 17] studied the problem of transforming an arbitrary oriented graph without cycles describing the hierarchy of roles into an equivalent tree and presented algorithms for its solution.

So, let the hierarchy of roles be given by the oriented tree $T$ – the role tree. At this stage of the problem analysis, we assume that in the role hierarchy, only leaf nodes directly receive the permissions, and then the permissions are distributed according to the principle of inheritance (using the leaf approach to the distribution of permissions [17]).

By the severity level of the permission $p_{i}\in P$ we call the numerical characteristic $S(p_{i})$ characterizing the significance or value of $p_{i}$ from the point of view of system’s information security. We require that $\forall p_{i}\in P$: $0\leq S(p_{i})\leq 1$, $\sum S(p_{i})=1$ (summation is over all $i$ from 1 to $m$, where $m$ is the number of permissions).

Obviously, the value of $S(p_{i})$ should depend both on the prevalence of the permission $p_{i}$ in the system, and on the significance of the roles to which this permission is assigned (that is, on the hierarchical organization of the set $R$). The task is set for each element $p_{i}$ of the permission set $P$ to calculate its severity level $S(p_{i})$. We will proceed from the following heuristic assumptions.

Assumption 1. The more permissions this role contains, the more likely it will be attacked, the greater is the severity level of permissions assigned to the role.

Assumption 2. The more often this permission appears in the list of roles permissions, the more likely it is to leak, the greater is its severity level.

Assumption 3. The higher the role in the hierarchy, the more likely it will be attacked, the greater is the severity level of permissions assigned to the role.

3 Hierarchy of roles and analytic hierarchy process

Let’s estimate the severity level of permissions using the analytic hierarchy process (AHP), well-known from decision support theory [15, 16]. The main difficulty of AHP is the search for quantitative indicators for constructing a numerical scale of preferences for possible alternatives. Often, a mechanism of expert assessments is used to do this. In turn, subjectivism and inconsistency of expert judgments are the main sources of criticism of the method [18]. In this paper, we propose to use the hierarchical organization of the set of roles to construct the AHP decision tree, and calculate the coefficients of the pairwise comparison matrices based on the distribution of permissions in the system, without involving external subjective expert assessments.

The proposed approach consists of several stages. The first one preprocesses the role hierarchy: each leaf node $r_{l}$ of the original role tree $T$ is appended with additional vertices, each of which contains exactly one permission from the set of permissions $RP(r_{l})$ of the vertex $r_{l}$. Thus, an extended role tree $T_{p}$ is constructed. The decision tree (or hierarchy) of the AHP will be the tree $T_{p}$.

The second stage calculates the relative weights of all vertices (except the root) of the tree $T_{p}$. Calculation of weights occurs when moving from the root to the leaf vertices. At each step, a subset of the roles $\{r_{1},\ldots,r_{k}\}$, subordinate to one role $r$ of the previous level, is considered. In the AHP terminology, the selected vertices are the matched factors or alternatives for the $r$ criterion. For each such subset a pairwise comparison matrix M is constructed. The dimension $k$ of the matrix M is equal to the cardinality of the allocated subset of the subordinate roles. The element $m_{ij}=[\textbf{M}]_{ij}$ in the pairwise comparison matrix corresponding to the pair $(r_{i},r_{j})$ is equal to the ratio of the number of permissions $|RP(r_{i})|$ of role $r_{i}$ to the number of permissions $|RP(r_{j})|$ of role $r_{j}$:

[TABLE]

Taking into account Assumption 1, the value $m_{ij}$ characterizes the degree of significance of the role $r_{i}$ in comparison with the role $r_{j}$ from the point of view of the severity level of permissions. The diagonal elements $m_{ii}$ are equal to one. Then the columns of the matrix M are normalized, and the elements $m^{*}_{ij}$ of the new normalized matrix $\textbf{M}^{*}$ are calculated by the formula: $m^{*}_{ij}=m_{ij}/(m_{1j}+\ldots+m_{kj})$. The weight of each role $r_{i}$ is calculated as the arithmetic mean of the corresponding row role in the normalized matrix $\textbf{M}^{*}$: $w_{i}=(m^{*}_{i1}+\ldots+m^{*}_{ik})/k$.

Since the elements $m_{ij}$ of the pairwise comparison matrix are calculated automatically, the ideal consistency of the matrix M is ensured: its elements are connected by the equalities $m_{ij}=m_{is}\times m_{sj}$ (for any $i$, $j$, $s$). Indeed,

[TABLE]

Since the matrix M is ideal consistent, after normalization the columns of the matrix $\textbf{M}^{*}$ become the same. Hence, $w_{i}=m^{*}_{ij}$ for any $j$. Without loss of generality, we will continue to work with the elements of the first column of the matrix M, then

[TABLE]

for $i=1,\ldots,k$. Thus, the relative weight coefficients can be calculated without constructing a pairwise comparison matrix, only on the basis of knowledge of some numerical characteristics attributed to the compared factors (roles). In our case, this is the number of permissions. Thus, in the problem under consideration, AHP is based only on the properties of the system itself, which frees it from the ”model” error that arises from the inconsistency of expert assessments [18].

At the third stage, the combined weights of the leaf vertices of the tree $T_{p}$ are calculated. These values will be the severity level of permissions. The severity level $S(p)$ of each permission $p$ is equal to the sum of the products of the relative weight coefficients of the vertices along all the paths from the root to the leaves containing this permission. Note that $\forall i=1,\ldots,|R|$: $0\leq w_{i}\leq 1$. Therefore, at this stage, Assumption 2 is taken into account: the more items, the greater is $S(p)$, and Assumption 3: the shorter the path, the larger is product, the larger is the contribution to $S(p)$.

4 Algorithm for calculating the severity level of permissions

Let’s write out formally the algorithm for calculating the severity level of permissions. Let use the leaf principle of distribution of permissions; the role tree $T$, which defines the hierarchy of roles, contains $n$ vertices $r_{1},\ldots,r_{n}$; $m$ permissions $p_{1},\ldots,p_{m}$ are defined in the system. The algorithm for steps can be written in the following form.

1. To each vertex $r_{i}$ of the role tree $T$, assign the value $|RP(r_{i})|$ equal to the number of permissions assigned to this vertex.

2. Construct an extended role tree $T_{p}$: add as many permission vertices to each leaf node $r_{l}$ of the role tree $T$, as contained in its permission set $RP(r_{l})$; assign to each of the new vertices one permission from the set of permissions $RP(r_{l})$ and assign to it a numerical characteristic (see step 1) equal to one.

3. For each non-leaf vertex $r_{i}$ of the tree $T_{p}$, starting from the root, consider a subset of the vertices subordinate to it: $\{r_{i1},\ldots,r_{ik}\}$. For the vertices of this subset, calculate the relative weights by the formula:

[TABLE]

4. For each permission $p_{i}$, $i=1,\ldots,m$, calculate its severity level:

[TABLE]

The sum is taken over all oriented paths $\rho(r,r_{l})$ in the tree $T_{p}$, leading from the root $r$ to that leaf $r_{l}$, the list of permissions $RP(r_{l})$ of which contains the single permission $p_{i}$ (obviously, these are the permission vertices that were added to the original role tree $T$ and which correspond to the permission $p_{i}$). In each product, there are the relative weight coefficients $w_{j}$ from step 3 of those vertices $r_{j}$ that compose the oriented path $\rho(r,r_{l})$ (excluding the root $r$, because the weight is not defined for it).

Note that $\forall p_{i}\in P:$ $0\leq S(p_{i})\leq 1$ $\sum S(p_{i})=1$, $i=1,\ldots,m$. Thus, the numerical characteristics found are relative values and allow a comparative analysis of the permissions.

It is easy to understand that the computational complexity of the presented algorithm depends polynomially on the number of roles $n$ and the number of permissions $m$ in the original role tree $T$ and does not exceed O$((n\cdot m)^{2})$.

5 Example

Consider the hierarchy of roles represented by the unbalanced tree T (see fig. 1).

Let the permissions of leaf roles are represented by the following sets: $RP(r_{2})=\{p_{2},p_{3}\}$, $RP(r_{5})=\{p_{1},p_{2},p_{3}\}$, $RP(r_{6})=\{p_{2},p_{4}\}$, $RP(r_{7})=\{p_{5}\}$, $RP(r_{1}0)=\{p_{1},p_{4},p_{5}\}$, $RP(r_{11})=\{p_{1},p_{4}\}$, $RP(r_{9})=\{p_{3},p_{5}\}$, and for other roles, the permissions are determined from the inheritance condition: $RP(r_{8})=\{p_{1},p_{4},p_{5}\}$, $RP(r_{3})=\{p_{1},p_{2},p_{3},p_{4}\}$, $RP(r_{4})=\{p_{1},p_{3},p_{4},p_{5}\}$, $RP(r_{1})=\{p_{1},p_{2},p_{3},p_{4},p_{5}\}.$ The expanded $T_{p}$ role tree is shown in fig. 2.

For this example $|RP(r_{2})|=2$, $|RP(r_{3})|=|RP(r_{4})|=4$. Hence, $w_{2}=2/(2+4+4)=0.2$, $w_{3}=w_{4}=4/(2+4+4)=0.4$. In vector form:

[TABLE]

The coordinates of the vector $|\textbf{RP}|_{2,3,4}$ are determined by the number of permissions assigned to the roles $r_{2}$, $r_{3}$, $r_{4}$; the coordinates of the vector $\textbf{W}_{2,3,4}$ are determined by the relative weight coefficients of these roles.

Similarly, the coordinates of the remaining vectors are calculated:

[TABLE]

[TABLE]

For leaf nodes, we will index the weight coefficients by the number of the parent role and the number of permission assigned to the leaf: $w_{2,2}=w_{2,3}=0.5$, $w_{5,1}=w_{5,2}=w_{5,3}\approx 0.33$, $w_{6,2}=w_{6,4}=0.5$, $w_{7,5}=1$, $w_{10,1}=w_{10,4}=w_{10,5}\approx 0.33$, $w_{11,1}=w_{11,4}=0.5$, $w_{9,3}=w_{9,5}=0.5$. In fig. 3, the leaves of the tree $T_{p}$ that correspond to the same permission are replaced by a single vertex, with the edges being assigned weights corresponding to their terminal vertices.

According to step 4 of the algorithm, the severity level of permission $p_{1}$ is calculated by the formula:

[TABLE]

[TABLE]

Similarly:

[TABLE]

[TABLE]

[TABLE]

[TABLE]

Let us analyze the results obtained. As we can see from table 1, permissions $p_{2}$ and $p_{3}$ have the highest severity level, although their prevalence in the system is not maximal (Assumption 2). This is explained by the fact that the proposed approach takes into account also the location of the roles to which the interesting permission is assigned in the given hierarchy (Assumption 3). Indeed, the permissions $p_{2}$ and $p_{3}$ occur from the 2nd level of the role tree, whereas the most common in the system permissions $p_{1}$ and $p_{4}$ are present in the system, starting at level 3. Thus, in the example considered, the criterion of ”proximity to the administrator” is more significant than the ”prevalence in the system” criterion.

6 Conclusions

Most often, because there is no possibility to obtain quantitative estimates of the severity of certain processes, in practice a qualitative scale is used, for example: critical / high / medium / low. The article defines the algorithm for calculating the numerical indicators of the severity of the leakage of permissions in the role-based access control policy.

It follows from the proposed methodology that AHP makes it possible to automate the process of ranking permissions by significance or value from the point of view of information security. And the decision is made only on the basis of the features of the system itself, without involving the mechanism of expert assessments. This use of the method is new. Indeed, at present AHP is developing in the direction of using the theory of fuzzy sets, including within the framework of constructing a comprehensive information security system [19, 20, 21, 22, 23]. But in the vast majority of works the method still relies on the mechanism of expert assessments.

The advantage and novelty of the proposed solution lies precisely in the ”bundle” of AHP and the role tree of the access control system. This, on the one hand, allows you to obtain additional information in a situation where alternative solutions can not be linked by any precise functional dependencies, and on the other hand, relieves the method of inconsistency and subjectivism of expert judgments.

According to [24], the information security risk is an assessment of the possible damage to an organization or an asset as a result of a certain threat implementation. The main way to assess risks is to combine the probability of an event and its consequences:

[TABLE]

where $P(V,T)$ is the probability of implementing the threat $T$ through a given vulnerability $V$ (for a two–factor risk assessment method) or the product of the probability of implementing the threat $T$ and exploiting vulnerability $V$ (for the three–factor risk assessment method), $I(T)$ is the damage from the implementation of the threat $T$ [25]. The main difficulty in solving the problems of quantitative assessment of information security risks is the qualitative nature of most indicators that affect the probability of the implementation of threats and the use of vulnerabilities, as well as determine the damage. The quantitative characteristics of permissions suggested in the article can be the basis for determining the probability of the implementation of information security threats through the vulnerabilities generated by the structure of roles of the access control policy.