SecAuthAPI: uma abordagem para suportar infraestruturas de autorização auto-adaptativas

Abstract

Access control mechanisms have been used in information systems to restrict access to sensitive information. Such mechanisms are able to deal with external agent threats, but they are ineffective when considering attacks involving internal users. Static access control policies are unable to deal with anomalous behavior of malicious users who abuse their permissions. Self-adaptive systems have been shown as a possible response for this situation, since they are able to analyze themselves and the environment in which they are deployed, modifying themselves over various and unpredictable conditions. In this context, based on the behaviour of users, the access control policies could be dynamically modified to deal with malicious users. However, self-adaptation requires a set of well-defined operations that can be used in the definition of adaptation plans. In this sense, this work proposes the SecAuthAPI, an approach to support self-adaptive authorization infrastructures based on ABAC (Attribute-Based Access Control). The operations are based on a formal functional specification of the ABAC model and aim to enable the dynamic adaptation of access control policies. Considering the application of this approach in a real system, this work also proposes and implements the externalization of authorization mechanisms for the SUAP system, developed and used at IFRN, with the intention of decoupling access control concern from the business logic of the application SecAuthAPI operations were evaluated through a series of unit tests that attest its adherence to the formal functional specification, while separation of access control from SUAP had its performance evaluated and compared to the legacy approach. The results show that, although it has an additional computational cost, the impact on application performance is negligible. In addition, our solution is highly feasible in view of the benefits brought due to the decoupling of concern from access control from the source code of the application.