FR2864657A1 - Customizable security control performing process for e.g. personal digital assistant, involves defining security procedure using language defining security rules, and processing language by compiling it into representations - Google Patents

Abstract

The process involves defining a security procedure with the help of a language permitting to define security rules. The language is processed by compiling the language into internal representations, and processing the internal representations. The language is processed to apply the security rules. The language comprises of positive rules specifying rights for certain subjects, or certain groups of subjects. An independent claim is also included for an embedded portable computer system having a unit for implementing a process for customizable control of security of a computer system.

Description

The present invention relates to a method for the parametric control of

  the security of computer systems, this method being usable, but not exclusively, for computer systems with low hardware resources. Such a method enables the computer system in question to react in case of violation of certain security rules by

  for example, and in a nonlimiting manner, by emitting certain visual or audible signals, by blocking the computer system or by passing it to a specific state while preventing the action in progress.

  In general, we know that the use of portable computer systems such as personal digital assistants (PDAs), cell phone type terminals, bank payment terminals, portable payment terminals, is developing extremely rapidly . These computer systems provide services in a compact form and require limited storage and processing power.

  Some of these portable computer systems are equipped to communicate wirelessly over limited distances with other computer systems using infrared or radio signals. Many portable computer systems can also send and receive e-mail and access the Internet.

  2864657 2 In terms of risks, several remarks should be taken into consideration: - given their small size, portable computer systems can be misplaced, unattended, or stolen, - user authentication can be disabled permitting the disclosure of the information contained in the computer system to any person having physical access to said computer system, - even if the authentication of the user is provided, the authentication mechanism may be fragile or easily circumvented, - the facility with which portable computer systems can be wirelessly interconnected, combined with weak or nonexistent authentication of the parties involved, provides new avenues for the introduction of viruses or other types of malicious code.

  The risks become greater when the portable computer system is used as a point of entry to a corporate network or as a service provider offered by a telecommunication operator. At best, a company or security agent would like to be able to voice, monitor, and enforce security controls to reduce the risk to the computer system.

  Existing portable computer systems lack, in particular, sufficient control means to impose the use of available mechanisms according to a prescribed safety procedure. A security controller should allow the user to define his own rules on his computer system without allowing him to circumvent the general rules defined by the security officer. By way of non-limiting example, the security rules can be used to: prohibit the use of a service which, in case of abuse, could inflict damage or loss on the user of the computer system, to the company or operator, 2864657 3 - prohibit the use of a sensitive operating system service to any application to reserve it for the components of the operating system itself, - prohibit the installation of an application that would access a service without the explicit authorization of the user, - reserve the use of a service to privileged users, In addition to the prohibitions to perform certain actions, this controller can trigger actions to signal the attempted breach of the security procedure, such as, for example, the issuance of visual or audible signals, the complete blocking of the computer system or the unavailability of certain functions; t internal computer system, etc. Two major constraints must be taken into consideration in the context described above: the need for customization (or parameterization) of a security controller by different actors (for example the security agent, the operator, the user, etc.): a controller not offering this possibility would be too rigid to be usable in practice.

  - the need to implement the security controller effectively on small computer systems with limited resources.

  Two main techniques have been exploited to satisfy the need for customization of a security controller: - customization by dedicated interfaces that can be exploited by the various actors (security agent, user, etc.) to define (or parameterize) a security procedure, for example by choosing elements from a list or checking boxes in a table; this mode of personalization is too simple to take into account the varied requirements of the various actors concerned by the portable computer systems (security agent, user, operator, etc.); 2864657 4 - the definition of security procedures using a dedicated language; the existing, over-rich, dedicated languages are not suitable for portable computer systems with limited hardware resources.

  The object of the invention is therefore more particularly to eliminate these disadvantages.

  To this end, it proposes a method for the parametric control of the security of computer systems, applicable in particular, but not exclusively, to portable or embedded computer systems with low hardware resources, including: the definition of a security procedure to using a language for defining security rules, involving subjects representing the active entities of said computer system capable of performing actions on objects representing the passive entities of said computer system, and a processing of said language allowing applying said security rules in the aforesaid computer systems comprising a compilation of the aforesaid language into internal representations, and an exploitation of said internal representations for security control purposes.

  The security procedure includes a plurality of control rules that indicate permissions for subjects (or actors) to access objects (or resources, assets) to perform a particular action on those objects.

  The action may consist, for example, and in a non-limiting manner, in reading, creating or modifying the object concerned. The security procedure also includes specific treatments, known as exceptions, in the event of an attempt to breach a security rule. These exceptional treatments may consist, for example in the emission of visual signals 2864657 5 or audible, the complete blocking of the apparatus or the unavailability of certain functions, the change of internal state of the system, etc. Predefined sets of subjects, objects and types of services are considered. A security procedure includes the following statements: - Statements of groups of subjects (optional).

  Such a statement consists in assigning an identifier to a set of subjects. This type of declaration then makes it possible to associate control rules with a set of subjects. A subject is represented by an identifier, and, optionally, security attributes (indicating, for example, whether the subject has been authenticated and by whom). This then makes it possible to define access rules depending on the origin of a subject.

  - Declarations of groups of objects (optional).

  Such a statement includes the definition of a group of objects and, optionally, subgroups of objects. An object group definition has a group name that will be used to classify objects based on certain properties. Some groups can be pre-defined in the system. A subgroup statement classifies objects into more specialized subsets.

  - Declarations of services (optional).

  Such a statement consists of an attribute indicating the type of the service, a service identifier (unique), the resources to which the service applies and all the functions supported by the service.

  - Declaration of control rules.

  Positive rules and negative rules of access control can be defined.

  A positive control rule allows s to perform a, where * s is a topic or a group of topics, 2864657 6 * a is an action or set of actions on resources, where - an action is a service type, or a service identifier, or an identifier of a service function.

  - a resource is an object or group of objects. A negative control rule forbids s to perform a, where s and a are defined as above. In addition, a negative rule can be associated (optionally) with a suitable treatment (for example: transition to a specific state, transmission of a signal, partial or total blocking of the apparatus, etc.) exception. The default exception handling is the prohibition of the action specified in the rule.

  Each rule can also be associated (optionally) with so-called security attributes, such as, for example, the level of responsibility of the actor (security agent, operator, user, etc.) who introduced the rule. These security attributes can be used by the inconsistency handling procedure in the event of incompatibility between multiple security rules. This makes it possible to ensure that the rules defined by the security agent will prevail over all those introduced by the user.

  A hierarchy is implicitly associated with actions. An action TS1, for example, where TS1 is a particular type of service, should be understood as encompassing each function of each service provided by the service type TS1.

  Similarly, the action TS1.S1 should be understood as encompassing all the functions provided by the service S1 of type TS1. The symbol <will be used to indicate that two actions have an inclusion hierarchy relationship described above (TS1 <TS2 if TS2 includes or includes TS1).

  A security procedure according to the invention therefore makes it possible to indicate for a given subject several access rules. The definition of a positive rule and a negative rule of control for the same subject and the same action on a given resource leads to a conflict. A conflict resolution strategy can be defined for each type of conflict. This policy can exploit, for example, the security attributes associated with the rules to ensure that a rule introduced by a priority actor (security agent for example) overrides a rule defined by the user.

  One embodiment of the invention will be described below, by way of non-limiting example, with reference to the accompanying drawings: FIG. 1 illustrates an example of a declaration of a security control procedure for mobile telephony FIG. 2 illustrates the translation of the security procedure and the atomic information of said security procedure.

  In this example, as shown in FIG. 1, the control procedure declares a group of subjects G, three groups of objects: "NationalNumber", "InternationalNumber" and "FreeNumber", each of which is a specialization of a predefined group of 20 "PhoneNumbers" objects, and two rules (one positive, the other negative) for group G as well as a rule (positive) for the predefined subject "my_application".

  The notation [0-9] * represents a sequence of numbers of any length.

  The exception processing associated with the negative rule is the emission of a specific sound signal.

  The implementation of a security screening procedure consists of examining the rules of the procedure, during any attempt to access a resource by a subject, in order to decide whether the permission to access the resource is granted to the person. subject and, if not, to perform the exception processing associated with the relevant negative rule.

  All of these operations are performed by the processor of the computer system. Therefore, in the case where the processor is limited in terms of resources (storage, calculation), it is extremely important that the security procedure can be compactly recorded in the computer system and that it is possible to implement an efficient calculation of the decision rules (a calculation that will be called a decision operation later on).

  According to the invention, an effective implementation of a security check procedure can be carried out using the following two steps: (1) verification of the coherence of the set of control rules: it is a question of check that the access control rules defined in the procedure are not contradictory and associate topics, actions, and resources appropriately. A faulty procedure is, for example, a procedure that indicates an access control rule for a subject that is neither predefined nor explicitly declared elsewhere. Another example is the one about a control rule for an action a on a certain object o such that o is not an object on which the action can be executed.

  The consistency check of a security procedure prior to its translation offers the following advantages: it makes it possible, in a first step, to prevent errors which could cause the malfunction of the translation of the procedure.

  * it simplifies the definition of the decision operation: if, by hypothesis, it is known that this operation will only be performed on conforming procedures, it is not necessary to check dynamically (at runtime) the coherence of the procedure. This will significantly improve the efficiency of the access decision operation.

  2864657 9 (2) the translation of the security procedure into a compact internal representation allowing effective access to its control rules.

  A security procedure consists of four main components: topic groups, object groups, services (which define actions), and access control rules. Access control rules are most often examined. The rules of control of a security procedure can be considered as relations linking subjects (and groups of subjects), actions and objects.

  The method according to the invention allows different data structures to represent this information. The choice among candidate structures depends on the following factors: É the accesses to the structure required by the decision operation (in order to allow an efficient implementation of this operation), and É the space required by the implementation of each structure.

  The internal representation of a procedure can itself be translated (or compiled) into native code, that is to say, into a code supported by the platform of the computer system. The advantage of separating the generation of the internal representation of the compilation into native code is that the first translation makes it possible to obtain an optimized version of the procedure independent of the platform on which it will be executed.

  The consistency check of a security procedure, its translation into an optimized internal representation and the use of this representation to perform the decision operation are the three essential steps of the method according to the invention which allow the efficient implementation. a security procedure set up on computer systems with limited resources (memory, calculation). These three steps are described successively: The consistency check of a security procedure includes the following steps: - Step 1: check the consistency of the statements of groups of subjects. This is equivalent to verifying that, for each topic group declaration: * all members of the group are separate predefined topics, and * the group-attached identifier does not already exist.

  - Step 2: check the consistency of object group declarations. This is to verify that for each object group declaration: * all members of the group are separate predefined objects, and * the identifier attached to the group does not already exist.

  - Step 3: check the consistency of the services. This amounts to checking that: * the definition of the resources of each service is well formed. The resources of a service being defined as groups of objects, it is a question of checking the coherence of these groups as indicated above.

  * the definition of the functions of the service is well formed. This amounts to checking that: o the function identifiers are all distinct, and o for each function, the group of objects, if any, on which the function can be applied is already defined.

  * The identifier attached to the service does not already exist.

  - Step 4: check that the safety rules are well formed. This is to verify that: * each access control rule satisfies the following criteria: o the subject of the rule is defined (predefined subject or identifier of one of the groups of subjects), and o the set of pairs (action , object) of the rule is well formed. This amounts to verifying that: this set is not empty, - each action of this set belongs to one of the declared services, and - the object associated with each action is valid (belongs to the resources declared for this action).

  * if there are conflicting control rules, there is a conflict resolution procedure (the so-called inconsistency handling procedure) that specifies the actions to be applied; this procedure may, for example, use the security attributes associated with two conflicting control rules to determine that one of them outweighs the other.

  Two rules ri and r2 are in conflict if: o ri is a positive rule (respectively negative) and r2 is a negative rule (respectively positive), and o SI is the subject of ri, S2 is the subject of r 2, and S i and S2 are either identical or in an inclusion relation (S1 is included in S2 or vice versa), and 2864657 -12- ri relates to an action al on an object o, r2 relates to an action a2 on the same object o and al and a2 are the same action or are related by the relation ie al <a2 or a2 <al).

  The method according to the invention does not require that steps 1 to 4 of the verification are performed in this order.

  The translation of the aforementioned security procedure into optimized internal representations comprises the following two steps: Step 1: the translation of each atomic information of the procedure into a corresponding digital representation. Atomic information refers to the different types of identifiers involved in a security procedure statement, such as, for example, those of subjects, groups of subjects, groups of objects, and services. Another type of atomic information is the one used to represent actions and, in particular, functions of services. This translation provides a compact memory representation of the procedure. For example, information that identifies a function of a service, which includes the juxtaposition of three identifiers, can be translated into a TSSSFFFF representation of four bytes where T is the service type (1 quartet), SSS is the service (3 nibbles), and FFFF is the function (4 nibbles). In order to optimize the necessary memory space, the different occurrences of the same atomic information can be shared in a correspondence table and accessed with references pointing to the appropriate entry of the table.

  - Step 2: Translation of the procedure control rules into an optimized data structure. The generation of this data structure is optimized according to the types of access required by the decision operation.

  The exploitation of the aforementioned internal representations to perform the decision operation is triggered when a request for access to a service has been detected. An access request can be characterized by a question of the form: can s run on o? where s is a (group of) subject (s), a is an action and o is a (a group of) resource (s). For the example of the declared procedure, shown in Figure 1, an access decision request for permission to send a fax to a foreign telephone number could be formulated as follows: Can Fax Execute OS.Telephony .Dial on 005983422358? A method for resolving an access decision request concerning an action a consists in applying the following steps: ADl) determining the set S of pairs (action, object or set of objects) declared in the procedure for the subject s, then determine the subset SA of S which corresponds to the action a, AD2) check whether one of the elements of SA applies to the object o (ie if an element (a, y) of SA is such that y is 0 or includes o).

  For example, in the case of the security procedure shown in FIG. 1, two control rules have been defined for the subject Fax (more precisely for the group G to which the subject Fax belongs). Since 005983422358 is an international phone number, and there is a negative rule for the "OS.Telephony.Dial" action on international phone numbers, the access request is denied. This refusal is accompanied by the emission of the specific double beep sound signal.

  Given a (group of) subject (s) and an action a, the procedure AD1) involves the following treatments: 2864657 -14- - if s is a predefined subject, determine all groups of subjects in which s appears, then perform the union of sets of pairs (action, object) that have been declared for these groups in the security procedure, - if s is a group of subjects, perform the union of sets of pairs (action, object) that have have been declared to s, then filter the pairs (a ', o') collected and keep only those which satisfy a <a '(ie those which concern action a).

  The procedure ADl) described above can be implemented effectively by applying the following embodiment for the translation of the control rules of a procedure. The control rules are translated into a table of which each element contains (1) the internal representation of a pre-defined subject (or group of subjects) S, (2) a pointer to an array of Boolean values indicating for each predefined subject, whether or not it belongs to s (this information being empty in the case where S is a pre-defined subject and not a group of subjects), (3) a pointer to a structure containing the internal representations of the actions and objects associated with s with a sign (bit) indicating whether the rule of control defines an authorization or prohibition and, in the case of a negative value, an (optional) pointer to the associated exception handling code.

  FIG. 2 illustrates, by way of example, the translation, described above, of the security procedure shown in FIG. 1. FIG. 2 also illustrates the translation of the atomic information of this security procedure. 25

  Two types of structures are to be considered, as represented in FIG. 2: 1. The CRS table which corresponds to the translation of the control rules of the security procedure, as represented in FIG. 1, according to the procedure of FIG. translation described above.

  2. Correspondence tables that contain the internal representations of the atomic information used in the control rules. Three tables, TRIS, TRIA, TRIO, associate a numerical representation with the internal representation of the entities (subjects, actions and objects respectively) that participate in the control rules.

  The CRS array is a two-element array CRS1, CRS2 (which correspond to the two subjects and groups of subjects for which rules have been defined, as shown in Figure 1). The first element of the CRS1 array is composed of: E of the index (4) which identifies the internal representation of the group G in the table TRIS, É of a reference RefTSG in the table TSG which records the pre-defined subjects belonging to the group G , and É of a RefLAG reference in the LAG table of the triplets (sign, action, object) and quadruplets (sign, action, object, exception processing) corresponding to the control rules of the group G. The TSG table indicates that the subjects corresponding to the internal representations associated with the indices 0, 1, 2 of the table TRIS (that is, fax, combined and minitel, respectively) belong to the group G. The array LAG contains two triplets and a quadruplet which correspond to the rules declared, as represented in FIG. 1, for the group G. In particular the element (-, 0, 2, double-beep address) indicates that it is forbidden, for any subject belonging to the group G, to use the Dial service (representing the index 0 of the table TRIA) to perform a 2,864,657 - 16- connection to an international phone number (represented by the index of the table TRIO 2) and an attempt of violation will be signaled by a double beep.

  The second element of the CRS2 array is composed of the index (3) of the TRIS array which identifies the internal representation of the pre-defined subject my_application, É of an empty element EV (my_application, being a subject, this element does not include no subject group definition), E from a RefLAMAPP reference to the LAMAPP array of triplets (sign, action, object) corresponding to the control rules of the subject my_application. This table contains a single element indicating that the subject is authorized to use the Dial service to connect to a non-paying telephone number (represented by index 3 of the TRIO chart).

Claims (14)

-17-Claims   A method for configurable control of the security of computer systems, characterized in that it comprises: defining a security procedure using a language for defining security rules, said rules involving subjects representing the active entities of said computer system capable of performing actions on objects representing the passive entities of said computer system, and a processing of said language for applying said security rules, said processing comprising a compilation of the aforesaid language into internal representations, and exploitation of said internal representations.   2. Method according to claim 1, characterized in that said language for defining the set of security rules comprises at least the concepts of groups of subjects and / or groups of objects and / or groups of actions, each of these groups can itself be organized into subgroups, the whole forming a tree hierarchy tune.   3. Method according to claim 1, characterized in that said language for defining the set of security rules comprises at least so-called positive rules specifying the rights for certain subjects, or groups of subjects, to perform certain actions, or certain groups of actions, on certain objects, or groups of objects. 15   2864657 -18- 4. Method according to claim 1, characterized in that said language for defining the set of security rules comprises at least so-called negative rules specifying the prohibitions for certain subjects, or groups of subjects, to perform certain actions, or certain groups of actions, on certain objects, or groups of objects.   5. Method according to claim 1, characterized in that said language for defining the set of security rules includes both so-called positive rules specifying the rights for certain subjects, or certain groups of subjects, to perform certain actions. , or certain groups of actions, on certain objects, or groups of objects, and so-called negative rules specifying the prohibitions for certain subjects, or certain groups of subjects, of carrying out certain actions, or certain groups of actions, on certain objects, or groups of objects.   6. Method according to one of claims 4 and 5,   characterized in that said negative rules may optionally be associated with specific, so-called exception processing, which will be performed in case of an attempt to violate these rules.   7. The method as claimed in claim 6, characterized in that said exceptional processes consist of modifying the internal state of the computer system and / or emitting certain signals, visual or audible.   8. The method of claim 6, characterized in that said exception processing is to make unavailable certain features of the computer system, temporarily or permanently, or to block said computer system itself.   9. Method according to claim 1, characterized in that said language processing comprises a step of checking the coherence of the security procedures and the treatment of possible inconsistencies, said incoherence processes being able to be unique or different depending on the type of inconsistency. detected.   The method of claim 9, wherein said inconsistency processes use security attributes associated with the control rules to determine the priorities between these rules.   11. The method as claimed in claim 9, wherein said step of verifying consistency of the security rules comprises: detecting logical inconsistencies or malformation of the groups of objects, subjects and / or actions, the detection of inconsistency between the so-called positive rules and the so-called negative rules, each of these detections being optional.   12. Method according to claim 1, characterized in that it comprises at least one of the following operations, performed in any order: a calculation operation, for a given subject or group of subjects, of all of the actions or groups of actions on which said subject, or group of subjects, has rights or prohibitions, É a calculation operation, for a given subject or group of subjects, of all the objects or groups of objects on which said subject, or group of subjects, has rights or prohibitions, É a calculation operation, for a given action or group of actions of the all subjects and / or groups of subjects who have rights or prohibitions on said action or group of actions, É a calculation operation, for a given action or group of actions of all objects and / or groups of objects on which certain subjects or groups of subjects possde t rights or prohibitions on said action or group of actions, É a calculation operation, for a given object or group of objects, of all the subjects or groups of subjects who have rights or prohibitions on said object or group of objects, É a calculation operation, for a given object or group of objects, of all the actions for which certain subjects or groups of subjects have rights or prohibitions on said object or group of objects.   13. On-board portable computer system characterized in that it comprises means for implementing the method according to one of the preceding claims.   14. Computer system according to claim 13, characterized in that it consists of a personal digital assistant, a cell phone type terminal, a bank payment terminal, a portable payment terminal, or a smart card.