Stratified Abstraction of Access Control Policies

Backes, John; Berrueco, Ulises; Bray, Tyler; Brim, Daniel; Cook, Byron; Gacek, Andrew; Jhala, Ranjit; Luckow, Kasper Søe; McLaughlin, Sean; Menon, Madhav C.; Peebles, Daniel; Pugalia, Ujjwal; Rungta, Neha; Schlesinger, Cole; Schodde, Adam; Tanuku, Anvesh; Varming, Carsten; Viswanathan, Deepa

doi:10.1007/978-3-030-53288-8_9

Cited by 9 publications

(4 citation statements)

References 6 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In recent years, researchers have proposed various approaches to tackle this challenge with dedicated solvers for string constraints [3,5,11,19,21], often as extensions of satisfiability modulo theories (SMT) solvers [10]. Dedicated solvers have been successfully used in a wide range of applications, including: finding or proving the absence of SQL injections and XSS vulnerabilities in web applications [30,32,35]; reasoning about access policies in cloud infrastructure [6,7,13]; and generating database tables from SQL queries for unit testing [34].…”

Section: Introductionmentioning

confidence: 99%

Even Faster Conflicts and Lazier Reductions for String Solvers

Nötzli

Reynolds

Barbosa

et al. 2022

Computer Aided Verification

View full text Add to dashboard Cite

In the past decade, satisfiability modulo theories (SMT) solvers have been extended to support the theory of strings and regular expressions. This theory has proven to be useful in a wide range of applications in academia and industry. To accommodate the expressive nature of string constraints used in those applications, string solvers use a multi-layered architecture where extended operators are reduced to a set of core operators. These reductions, however, are often costly to reason about. In this work, we propose new techniques for eagerly discovering conflicts based on equality reasoning and lazily avoiding reductions for certain extended functions based on lightweight reasoning. We present a strategy for integrating and scheduling these techniques in a CDCL$$(T)$$ ( T ) -based theory solver for strings and regular expressions. We implement the techniques and the strategy in cvc5, a state-of-the-art SMT solver, and show that they lead to a significant performance improvement."Image missing""Image missing"

show abstract

Section: Introductionmentioning

confidence: 99%

Even Faster Conflicts and Lazier Reductions for String Solvers

Nötzli

Reynolds

Barbosa

et al. 2022

Computer Aided Verification

View full text Add to dashboard Cite

show abstract

“…The use of automated reasoning techniques to analyze properties of cloud infrastructure is gaining increasing attention [6,4,7,5,17]. Despite that, more effort needs to be put into the modeling and verification of generic security requirements over cloud infrastructure pre-deployment.…”

Section: Introductionmentioning

confidence: 99%

Actions over Core-closed Knowledge Bases

Cauli¹,

Ortiz²,

Piterman³

2022

Preprint

View full text Add to dashboard Cite

We present new results on the application of semantic-and knowledge-based reasoning techniques to the analysis of cloud deployments. In particular, to the security of Infrastructure as Code configuration files, encoded as description logic knowledge bases. We introduce an action language to model mutating actions; that is, actions that change the structural configuration of a given deployment by adding, modifying, or deleting resources. We mainly focus on two problems: the problem of determining whether the execution of an action, no matter the parameters passed to it, will not cause the violation of some security requirement (static verification), and the problem of finding sequences of actions that would lead the deployment to a state where (un)desirable properties are (not) satisfied (plan existence and plan synthesis). For all these problems, we provide definitions, complexity results, and decision procedures.

show abstract

“…Satisfiability Modulo Theories (SMT) solvers determine the satisfiability of formulas over first-order theories and their combinations. They serve as back-end reasoning engines for a wide range of applications in academia and industry [18,27], including hardware and software verification [14,29,31,35,38,40], model checking [23,24,46], security [12,33], automated test-case generation [22,50], and synthesis [10,34]. Notable SMT solvers include Bitwuzla [42], Boolector [46], cvc5 [13], MathSAT [26], OpenSMT2 [36], SMTInterpol [25], SMT-RAT [28], STP [32], veriT [20], Yices2 [30], and Z3 [41].…”

Section: Introductionmentioning

confidence: 99%

Murxla: A Modular and Highly Extensible API Fuzzer for SMT Solvers

Niemetz

Preiner

Barrett

2022

Computer Aided Verification

View full text Add to dashboard Cite

SMT solvers are highly complex pieces of software with performance, robustness, and correctness as key requirements. Complementing traditional testing techniques for these solvers with randomized stress testing has been shown to be quite effective. Recent work has showcased the value of input fuzzing for finding issues, but this approach typically does not comprehensively test a solver’s API. Previous work on model-based API fuzzing was tailored to a single solver and a small subset of SMT-LIB. We present Murxla, a comprehensive, modular, and highly extensible model-based API fuzzer for SMT solvers. Murxla randomly generates valid sequences of solver API calls based on a customizable API model, with full support for the semantics and features of SMT-LIB. It is solver-agnostic but extensible to allow for solver-specific testing and supports option fuzzing, cross-checking with other solvers, translation to SMT-LIBv2, and SMT-LIBv2 input fuzzing. Our evaluation confirms its efficacy in finding issues in multiple state-of-the-art SMT solvers.

show abstract

Stratified Abstraction of Access Control Policies

Cited by 9 publications

References 6 publications

Even Faster Conflicts and Lazier Reductions for String Solvers

Even Faster Conflicts and Lazier Reductions for String Solvers

Actions over Core-closed Knowledge Bases

Murxla: A Modular and Highly Extensible API Fuzzer for SMT Solvers

Contact Info

Product

Resources

About