The Logic of XACML

Ramli, Carroline Dewi Puspa Kencana; Nielson, Hanne Riis; Nielson, Flemming

doi:10.1007/978-3-642-35743-5_13

Cited by 12 publications

(1 citation statement)

References 4 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…But the semantics of PBel and its validation analyses would also work for richer predicates, for example those expressed in quantifier-free first-order logic. A nice example and application of how to interpret richer predicates for policy analysis in XACML is given in [47,55].…”

Section: Static Analysis Of Security Modelsmentioning

confidence: 99%

Static Analysis for Proactive Security

Huth

Nielson

2019

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

We reflect on current problems and practices in system security, distinguishing between reactive security -which deals with vulnerabilities as they are being exploited -and proactive security -which means to make vulnerabilities un-exploitable by removing them from a system entirely. Then we argue that static analysis is well poised to support approaches to proactive security, since it is sufficiently expressive to represent many vulnerabilities yet sufficiently efficient to detect vulnerabilities prior to system deployment. We further show that static analysis interacts well with both confidentiality and integrity aspects and discuss what security assurances it can attain. Next we argue that security models such as those for access control can also be statically analyzed to support proactive security of such models. Finally, we identify research problems in static analysis whose solutions would stand to improve the effectiveness and adoption of static analysis for proactive security in the practice of designing, implementing, and assuring future ICT systems.

show abstract

Section: Static Analysis Of Security Modelsmentioning

confidence: 99%

Static Analysis for Proactive Security

Huth

Nielson

2019

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

show abstract

Inference Leakage Detection for Authorization Policies over RDF Data

Sayah

Coquery

Thion

et al. 2015

Data and Applications Security and Privacy XXIX

View full text Add to dashboard Cite

Abstract. The Semantic Web technologies include entailment regimes that produce new RDF data from existing ones. In the presence of access control, once a user has legitimately received the answer of a query, she/he can derive new data entailed from the answer that should have been forbidden if carried out inside of the RDF store. In this paper, we define a fine-grained authorization model for which it is possible to check in advance whether such a problem will arise. To this end, we provide a static analysis algorithm which can be used at the time of writing the authorization policy and does not require access to the data. We illustrate the expressiveness of the access control model with several conflict resolution strategies including most specific takes precedence as well as the applicability of the algorithm for diagnosis purposes.

show abstract