Model Checking Usage Policies

Abstract

We propose a model for specifying, analysing and enforcing safe usage of resources. Our usage policies allow for parametricity over resources, and they can be enforced through finite state automata. The patterns of resource access and creation are described through a basic calculus of usages. In spite of the augmented flexibility given by resource creation and by policy parametrization, we devise an efficient (polynomial-time) model-checking technique for deciding when a usage is resource-safe, i.e. when it complies with all the relevant usage policies.

Modular Plans for Secure Service Composition

“…if ϕ says "never α" from the validity of α and of ϕ[β] it does not follow αβ |= ϕ. As a matter of fact, the validity of H is established through model-checking in polynomial time [8].…”

Securing Java with Local Policies.

“…E.g., a file usage policy file-usage(x) might require that before reading or writing a file x, that file must have been opened, and not yet closed. A usage policy gives rise to an finite state automaton (FSA) when the formal parameters are instantiated to actual resources (see [8] for further details). These automata will be exploited in Sec.…”

“…, R k ), to be used in recognizing those traces respecting the policy. Roughly, the transformation into a FSA amounts to: (i) instantiating x i to R i , while respecting the conditions in the when clauses, (ii) maintaining Z i = R for R static, and (iii) adding self-loops for all the events not explicitly mentioned in the policy (see [8] …”

“…For the second item, we transformed history expressions to remove the redundant sandboxes therein. Full details about our technique and our model-checking tool can be found in [8,10].…”

“…The analysis exploits call-graph construction and model-checking to predict the policies that will always be obeyed, and to single out the program points where run-time checks are needed. An implementation of our framework is currently under development; only the model-checking tool is already available [10]. It runs in polynomial time in the size of the history expression extracted from the analysed program.…”