Integrated Security and Quality of Service Support in E-Commerce

One of the main challenges against successful ecommerce in an open environment is security and QoS (Quality of Service) support. A security compromise can lead to the failure of an e-business in the worst case. At the same time, an e-commerce system needs to process service requests with a certain service quality. Security and QoS support have hardly been studied in an integrated manner despite the increasing demand. To address this problem, we extend the role-based access control model, which is a popular access control model used to ensure only authorized users are allowed to access computational resources, to support the required security and QoS properties in a single framework. Our extended model, called QoS-aware Role-Based Access Control model (QRBAC), provides a novel notion of QoS-aware roles to let a system administrator directly specify resource quotas, e.g., the CPU cycle and network bandwidth quotas, needed to process service requests with the required QoS. We introduce the notion of system status as part of the access control model to detect overloads or violations of the access control policy. When overloaded, QRBAC can dynamically adjust the permission (in terms of resource quotas) and the role activation rate (the rate at which roles are actually assigned to their permissions), if necessary, to reduce resource consumptions. It can also revoke the permissions assigned to suspicious roles violating the access control policy to protect well-behaving roles. In this way, QRBAC can support the required QoS and security properties in terms of access control. In this paper, we motivate the need for integrated security and QoS support in one framework, and present a high level description of QRBAC. We also show, via examples, how QRBAC can provide security and QoS support in e-commerce. Keywords: Security, QoS, Role-Based Access Control 1 Introduction The growth of e-commerce has been dramatic. It has been reported that e-commerce trades totaled $132 billion in 2000 more than double the $58 billion reported in 1999 [1]. Behind the increasing impact of e-commerce on the economy, there are growing concerns about security and quality of service. E-commerce is usually performed in an open environment in which all possible security problems co-exist. On the other hand, e-commerce applications are sensitive to QoS such as the average response time. For example, late processing of service requests, possibly due to overloads, caused nearly $420 million in losses in 1999 [5]. Many potential clients may leave e-commerce sites when the service response time is longer than a certain time such as 5 sec [2]. Security and QoS research have separately produced abundant, successful results. However, security and QoS support can not be handled separately in e-commerce. A completely secure e-commerce system, if any, may not be useful if it significantly violates the required QoS. Alternatively, a well developed QoS management scheme without proper security support can be easily compromised by a malicious user launching a denial of service (DoS) attack, which may exhaust all system resources.1 Due to the lack of available resources, the required QoS can be significantly violated resulting in loss of profit. Without integrated security and QoS support, a system administrator should specify and monitor the required security and QoS properties separately even if a system supports both security and QoS. However, separate configuration and maintenance of security and QoS can be computationally expensive and errorprone.2 1Other types of attacks, e.g., stack overflow attacks exploiting program flaws, are beyond the scope of this paper. We assume critical e-commerce systems are implemented properly to avoid well known attacks exploiting program flaws. 2In the worst case, security and QoS requirements may pose conflicting requirements due to misconfiguration. This can be a serious problem because it is known that many security vulnerabilities are due to incorrect system configuration [9]. To bridge the gap between security and QoS support, we present a novel role-based access control model, called QoS-aware Role-Based Access Control model (QRBAC), to support QoS and security in a single, seamless framework. Role-based access control model (RBAC) [11] is one of the most efficient access control schemes used to ensure that only authorized users can access certain resources (and information). 3 A role is a semantic entity, which is the basis of an access control policy. Using RBAC, a system administrator can create roles considering the job functions performed in an organization, e.g., client, teller, and finance manager roles in a bank, and grant permissions (access authorizations) to these roles. An administrator can assign users to the roles considering their job responsibilities and qualifications. Compared to existing access control mechanisms such as the access control list, RBAC significantly reduces the difficulty to configure and maintain an access control mechanism. For example, if a teller in a bank is promoted as a finance manager, the administrator can easily reassign her to a new role of the finance manager instead of revoking all access permissions previously assigned to the teller job and reassigning permissions necessary to perform the job of a finance manager. RBAC can efficiently handle these problems because permissions assigned to roles, unlike user memberships in roles, tend to change relatively infrequently [6]. Further, RBAC supports well known security principles such as least privilege and separation of duties (SoD). Each role receives only those permissions required to perform the job functions. Several roles, e.g., client and teller roles, are mutually exclusive; that is, a user should not be allowed to take client and teller roles at the same time. Although RBAC significantly reduces the maintenance cost of an access control mechanism and supports important security principles, it is not expressive enough for ecommerce applications that need to process service requests in a QoS-aware manner. Using RBAC, an administrator can not specify the resource quotas needed for roles, e.g., catalog browsing roles, to support the required QoS, e.g., the average response time and/or minimum acceptable quality of catalog images.4 Therefore, the required QoS may not be supported, especially when overloaded. Further, an access control mechanism based on RBAC does not provide direct support for resource usage monitoring/policing to prevent malicious roles from exhausting system resources, incurring DoS. QRBAC introduces a novel notion of QoS-aware roles to let an administrator directly specify the required resource quotas for e-commerce roles to support the required service 3In this paper, we assume users are already authenticated, e.g., via passwords or mutual authentication mechanisms such as Kerberos [10], in which users and service providers can authenticate each other. 4In this paper, we mainly consider roles e-commerce service entities providing specific services, e.g., catalog browsing and purchase. quality. QRBAC defines the notion of system status as part of the access control model. In this way, an access control mechanism can directly monitor the system status to detect overloads, if any. We extend the original principles of least privilege and SoD to consider resource consumptions in a QoS-aware e-commerce system; that is, we consider a role has violated the least privilege if it has overused its quotas. Consequently, other roles may have to receive the reduced QoS due to the lack of computational resources. This violates the original intention of performance isolation among roles, which we consider a SoD problem in QoS-aware ecommerce applications. To support the extended notions of least privilege and SoD, in addition to the original notions, QRBAC can dynamically adjust the permissions in terms of resource quotas assigned to certain roles such that they receive the degraded QoS, e.g., reduced image quality, when overloaded. QRBAC can dynamically decrease the activation rate, i.e., the number of roles actually given their permissions to use resources over a certain period of time, of relatively less critical roles if the overload conditions continue after the QoS degradation described before. Further, the access control mechanism can immediately revoke the permission of a role, which causes DoS by significantly exceeding the allocated resource quotas specified in the permission, to protect other well-behaving roles. In this way, QRBAC can support the extended principles of least privilege and SoD, while supporting the required QoS in a single framework. In Section 2, background information about RBAC, a basis of our work integrating QoS and security support in a single framework, is given. In Section 3, QRBAC is presented in detail. A realistic example of using QRBAC in an e-commerce system is also given to show the applicability of QRBAC. Section 4 discusses the related work. Section 5 concludes the paper and discusses the avenues for future work. 2 Role-Based Access Control Model Figure 1 shows the basic RBAC model called RBAC in [11]. Users are assigned to roles representing job functions, e.g., teller or finance manager roles. Each role is associated with specific permissions describing the access rights authorized for a member of the role. Using roles between users and permissions, rather than directly assigning users to permissions, it significantly reduces the difficulty of configuring and maintaining the access control mechanism as discussed before. The RBAC model consists of the following components [11]: , , , and represent users, roles, permissions, and sessions, respectively; Users (U) Roles (R) Permissions (P) User to Role Assignments Role to Permission Assignments Figure 1. RBAC : A Basic Role-Based Access Control Model represents a many-to-many user to role assignment relation, which is a subse