Скачать или смотреть [OOPSLA23] Secure RDTs: Enforcing Access Control Policies for Offline Available JSON Data

Secure RDTs: Enforcing Access Control Policies for Offline Available JSON Data (Video, OOPSLA2 2023)
Thierry Renaux, Sam Van den Vonder, and Wolfgang De Meuter
(Vrije Universiteit Brussel, Belgium; Vrije Universiteit Brussel, Belgium; Vrije Universiteit Brussel, Belgium)

Abstract: Replicated Data Types (RDTs) are a type of data structure that can be replicated over a network, where each replica can be kept (eventually) consistent with the other replicas. They are used in applications with intermittent network connectivity, since local (offline) edits can later be merged with the other replicas. Applications that want to use RDTs often have an inherent security component that restricts data access for certain clients. However, access control for RDTs is difficult to enforce for clients that are not running within a secure environment, e.g., web applications where the client-side software can be freely tampered with. In essence, an application cannot prevent a client from reading data which they are not supposed to read, and any malicious changes will also affect well-behaved clients.


This paper proposes Secure RDTs (SRDTs), a data type that specifies role-based access control for offline-available JSON data. In brief, a trusted application server specifies a security policy based on roles with read and write privileges for certain fields of an SRDT. The server enforces read privileges by projecting the data and security policy to omit any non-readable fields for the user's given role, and it acts as an intermediary to enforce write privileges. The approach is presented as an operational semantics engineered in PLT Redex, which is validated by formal proofs and randomised testing in Redex to ensure that the formal specification is secure.

Article: https://doi.org/10.1145/3622802

Supplementary archive: https://doi.org/10.5281/zenodo.8310917 (Badges: Artifacts Available, Artifacts Evaluated — Reusable)

ORCID: https://orcid.org/0000-0002-9301-2187, https://orcid.org/0000-0002-9241-1098, https://orcid.org/0000-0002-5229-5627

Video Tags: replicated data types, role-based access control, security, conflict-free replicated data types, oopslab23main-p93-p, doi:10.1145/3622802, doi:10.5281/zenodo.8310917, orcid:0000-0002-9301-2187, orcid:0000-0002-9241-1098, orcid:0000-0002-5229-5627, Artifacts Available, Artifacts Evaluated — Reusable

Presentation at the OOPSLA2 2023 conference, October 22–27, 2023, https://2023.splashcon.org/track/spla...
Sponsored by ACM SIGPLAN,