Synthesising verified access control systems through model checking

Abstract

We present a framework for evaluating and generating access control policies. The framework contains a modelling formalism called RW, which is supported by a model checking tool. RW is designed for modelling access control policies, and verifying their properties. The RW language is very expressive, allowing us to model complex access conditions which can depend on data values, other permissions, and agent roles.A property expresses the capability of a coalition of agents to achieve a goal, which may include reading and overwriting certain information. Given a model built based on a policy and a property, the model-checking algorithm decides whether the goal defined by the property is achievable by the coalition within the permissions the policy provides. In the case that the goal is achievable, the algorithm outputs strategies which may be used by the coalition to achieve the goal.The unachievability of legitimate goals may suggest that the policy does not provide the users enough permissions to carry out their actions. The achievability of malicious goals may reveal certain security holes in the policy. When malicious goals are achievable, the resulting strategies help to provide clues on amending the policy. The tool implements the algorithm and thus performs the RW model-checking. It can also convert a policy written in the RW language into a policy file in XACML. An access control system can then be built on the converted policy file.

Model Checking Agent Knowledge in Dynamic Access Control Policies

“…Their approach is limited in modeling knowledge gained by the interaction of agents in a multi-agent system. RW framework [2] has the most similar approach with ours. The transition system in RW is build over the knowledge of the active coalition of agents.…”

“…They also allow controlling access to the data based on the user roles. In such multi-agent systems, access to the data is regulated by dynamic access control policies, which are a class of authorization rules that the permissions for an agent depend on the state of the system and change when agents interact with the system [1][2][3]. In complicated access control scenarios, there is always a risk that some required properties do not hold in the system.…”

Analysis of XACML Policies with SMT

“…For instance, Zhang et al [31] propose RW (Read and Write), a formalism based on propositional logic, for the specification of access control policies. Based on this formalism, they employ symbolic model-checking to verify properties against a policy model expressed in RW.…”

Formal verification of security properties in trust management policy

“…Zhang et al [40,41,42] provide a model checking algorithm for evaluating access control systems and present the computational complexity of the algorithm. This approach can be used to detect, in an access control policy, errors caused by the interactions of policy rules and coalitions among multiple agents.…”