Verification and change-impact analysis of access-control policies

Abstract

Sensitive data are increasingly available on-line through the Web and other distributed protocols. This heightens the need to carefully control access to data. Control means not only preventing the leakage of data but also permitting access to necessary information. Indeed, the same datum is often treated differently depending on context.System designers create policies to express conditions on the access to data. To reduce source clutter and improve maintenance, developers increasingly use domain-specific, declarative languages to express these policies. In turn, administrators need to analyze policies relative to properties, and to understand the effect of policy changes even in the absence of properties. This paper presents Margrave, a software suite for analyzing role-based access-control policies. Margrave includes a verifier that analyzes policies written in the xacml language, translating them into a form of decision-diagram to answer queries. It also provides semantic differencing information between versions of policies. We have implemented these techniques and applied them to policies from a working software application.

An advanced approach for modeling and detecting software vulnerabilities

“…Such methods are often based on formally specifying system requirements or design, including security aspects, then either generating the system or verifying that the system (or a model of the system) conforms to the specification. Notable examples of this approach include Event-B [44] (in which systems are generated from Event-B specifications); Secure Tropos [45], which extends the Tropos [46] agent-oriented software development method with security-related models and activities; UMLSec [47]; various approaches for specifying and analyzing security protocols, access control policies and other system properties [48,49,50,51,52,53].…”

EXAM: a comprehensive environment for the analysis of access control policies

“…Existing approaches to the policy similarity analysis are mostly based on graph, model checking or SAT-solver techniques [1,3,8,13,16,19]. Koch et al [13] use graph transformations to represent policy change and integration, which may be used to detect differences among policies.…”

“…A more practical approach is by Fisler et al [8], who have developed a software tool known as Margrave for the analysis of role-based access-control policies in XACML. Margrave represents policies using the Multi-Terminal Binary Decision Diagram (MTBDD), which can explicitly represent all variable assignments that satisfy a Boolean expression and hence provides a good representation for the relationships among policies.…”

“…The main task of the PSA module is to determine all variable assignments that can satisfy the Boolean formulae corresponding to one or more policies, and also variable assignments that lead to different decisions for different policies. The basic idea is to combine functionalities of the policy ratification technique [1] and MTBDD technique [8] by using a divide-and-conquer strategy. Figure 3 shows the architecture of PSA.…”

“…2.2). Common limitations concern: policy conditions, in that only policies with simple conditions can be analyzed [8]; and relationship characterization, in that for example one can only determine whether two policies authorize some common request, but no characterization of such request is provided.…”