Conduit cascades and secure synchronization

Synchronizing Personal Digital Assistants with host systems can result in indirect accesses that bypass security requirements. In this paper we propose a framework for analyzing the security vulnerabilities that can arise from synchronization. This framework provides us with the basis of a paradigm for analyzing the access-control vulnerabilities of systems comprised of secure and non-secure components. 1 I n t r o d u c t i o n Personal Digital Assistants (PDAs) such as the Palm handheld are small hand-held computing devices that support a variety of applications, ranging from conventional electronic organizer programs to spreadsheets, electronic mail and web browser clients. A PDA is commonly viewed as an extension of a User's workstation (or server); carrying data and programs that often mirror data and programs from the workstation. Synchronization between the workstation and the PDA is performed on a regular basis, ensuring that changes made to data stored on the PDA are reflected on the workstation, and vice-versa. Little consideration has been given to the security policy implications of using these devices as part of an application system. While PDAs are typically Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. To copy otherwise, to republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. New Security Paradigm Workshop 9•00 Ballycotton, Co. Cork, Ireland © 2001 ACM ISBN 1-58113-260-3/01/0002. $5.00 single-user systems supporting little or no accesscontrol, they are expected to synchronize with multiuser host systems that do have access-control requirements. This synchronization may be used to bypass host system access-controls. For example, an employee working in sales and engineering departments is subject to the security requirement that sales data may not be written to engineering datasets. If we are not confident about the employee's PDA upholding this requirement then synchronization must ensure that at any one time, either sales or engineering information is carried on the employee's PDA, but not both. Other scenarios are possible, for example, the PDA carries both engineering and sales datasets for information purposes. However, only sales data can be two-way synchronized with the host system. In this paper we consider the analysis of accesscontrol vulnerabilities that can arise from synchronizing host systems with PDAs. The approach first considers our confidence in the access constraints of the individual components and then analyzes whether that confidence can be maintained when the components synchronize. While a component such as a Palm does not have an access-control mechanism, we can still specify, albeit with low confidence, the access limitations that we believe the installed software implicitly provides. Our framework provides us with the basis of a paradigm for analyzing the security vulnerabilities of systems comprised of secure and nonsecure components. Arbitrary access policies can be abstractly represented in terms of directed graphs [7] or as reflexive orderings [5]. We use reflexive orderings to represent