Verifying resource access control on mobile interactive devices

Issue title: 7th International Workshop on Issues in the Theory of Security (WITS'07)

Guest editors: Riccardo Focardi

Article type: Research Article

Authors: Besson, Frédéric^a | Dufay, Guillaume^{a; c} | Jensen, Thomas^b | Pichardie, David^{a; *}

Affiliations: [a] Inria Rennes, Campus de Beaulieu, Rennes Cedex, France | [b] CNRS, Campus de Beaulieu, Rennes Cedex, France | [c] Trusted Labs, Versailles, France

Correspondence: [*] Corresponding author. E-mail: [email protected].

Abstract: A model of resource access control is presented in which the access control to resources can employ user interaction to obtain the necessary permissions. This model is inspired by and improves on the Java security architecture used in Java-enabled mobile telephones. We extend the Java model to include access control permissions with multiplicities in order to allow to use a permission a certain number of times. We define a program model based on control flow graphs together with its operational semantics and provide a formal definition of the basic security policy to enforce viz that an application will always ask for a permission before using it to access a resource. A static analysis which enforces the security policy is defined and proved correct. A constraint solving algorithm implementing the analysis is presented.

Keywords: Resource access control, static analysis

DOI: 10.3233/JCS-2009-0387

Journal: Journal of Computer Security, vol. 18, no. 6, pp. 971-998, 2010