一句话：提出 IAMPERE，用 GNN 剪枝与 MaxSAT 为 IAM 权限提升错误生成近似最小修复补丁。
IAM 是云平台中的访问控制服务，其配置错误可被利用发动权限提升（PE）攻击，造成严重损失；现有唯一修复工具 IAM-Deescalate 仅覆盖少量 PE 模式。本文提出 IAMPERE，将 IAM 修复形式化为 MaxSAT 问题，并针对状态爆炸导致的可扩展性瓶颈，使用图神经网络（GNN）先生成较小但未必最小的中间补丁以剪枝搜索空间；再在该空间内用 MaxSAT 求解器搜索最小修复，得到近似最小补丁。在合成与真实 IAM 错误配置上，IAMPERE 比 IAM-Deescalate 修复更多错误配置，且补丁规模显著更小。
Identity and Access Management (IAM) is an access control service employed within cloud platforms. Customers must configure IAM to establish secure access control rules for their cloud organizations. However, IAM misconfigurations can be exploited to conduct Privilege Escalation (PE) attacks, resulting in significant financial losses. Consequently, addressing these PEs is crucial for improving security assurance for cloud customers. Nevertheless, the area of repairing IAM PEs due to IAM mis-configurations is relatively underexplored. To our knowledge, the only existing IAM repair tool called IAM-Deescalate focuses on a limited number of IAM PE patterns, indicating the potential for further enhancements. We propose a novel IAM Privilege Escalation Repair Engine called IAMPERE that efficiently generates an approximately minimal patch for repairing a broader range of IAM PEs. To achieve this, we first formulate the IAM repair problem into a MaxSAT problem. Despite the remarkable success of modern MaxSAT solvers, their scalability for solving complex repair problems remains a challenge due to the state explosion. To improve scalability, we employ deep learning to prune the search space. Specifically, we apply a carefully designed GNN model to generate an intermediate patch that is relatively small, but not necessarily minimal. We then apply a MaxSAT solver to search for a minimum repair within the space defined by the intermediate patch, as the final approximately minimum patch. Experimental results on both synthesized and real-world IAM misconfigurations show that, compared to IAM-Deescalate, IAMPERE repairs a significantly larger number of IAM misconfigurations with markedly smaller patch sizes.
@inproceedings{HuWKMT23,
title = {Fixing Privilege Escalations in Cloud Access Control with MaxSAT and Graph Neural Networks},
author = {Yang Hu and Wenxi Wang and Sarfraz Khurshid and Kenneth L. McMillan and Mohit Tiwari},
booktitle = {ASE},
year = {2023},
doi = {10.1109/ase56229.2023.00167}
}