Skip to Main content Skip to Navigation
Conference papers

Securing Web Applications with Predicate Access Control

Abstract : Web application security is an increasingly important concern as we entrust these applications to handle sensitive user data. Security vulnerabilities in these applications are quite common, however, allowing malicious users to steal other application users’ data. A more reliable mechanism for enforcing application security policies is needed. Most applications rely on a database to store user data, making it a natural point to introduce additional access controls. Unfortunately, existing database access control mechanisms are too coarse-grained to express an application security policy. In this paper we propose and implement a fine-grained access control mechanism for controlling access to user data. Application access control policy is expressed using row-level access predicates, which allow an application’s access control policy to be extended to the database. These predicates are expressed using the SQL syntax familiar to developers, minimizing the developer effort necessary to take advantage of this mechanism. We implement our predicate access control system in the PostgreSQL 9.2 DBMS and evaluate our system by developing an access control policy for the Drupal 7 and Spree Commerce. Our mechanism protected Drupal and Spree against five known security vulnerabilities.
Document type :
Conference papers
Complete list of metadata

Cited literature [10 references]  Display  Hide  Download

https://hal.inria.fr/hal-01684360
Contributor : Hal Ifip <>
Submitted on : Monday, January 15, 2018 - 2:07:31 PM
Last modification on : Wednesday, August 7, 2019 - 12:14:40 PM
Long-term archiving on: : Sunday, May 6, 2018 - 7:53:38 PM

File

453481_1_En_30_Chapter.pdf
Files produced by the author(s)

Licence


Distributed under a Creative Commons Attribution 4.0 International License

Identifiers

Citation

Zhaomo Yang, Kirill Levchenko. Securing Web Applications with Predicate Access Control. 31th IFIP Annual Conference on Data and Applications Security and Privacy (DBSEC), Jul 2017, Philadelphia, PA, United States. pp.541-554, ⟨10.1007/978-3-319-61176-1_30⟩. ⟨hal-01684360⟩

Share

Metrics

Record views

128

Files downloads

116