Verification techniques for policy based systems

Abstract

Verification techniques are applied to policy based systems to ensure design correctness and to aid in the discovery of errors at an early stage of the development life cycle. A primary goal of policy verification is to evaluate the policy's validity. Other analyses on policy based systems include the identification of conflicting policies and policy efficiency evaluation and improvement. In this work, we present a discussion and classification of recent research on verification techniques for policy based systems. We analyse several techniques and identify popular supporting verification tools. An evaluation of the benefits and drawbacks of the existing policy analyses is made. Some of the common identified problems were the significant need of computational power, the limitation of the techniques to particular policy model, which restrict their extension to other policy models and the lack of efficient conflicts resolution methods. We use the evaluation results for discussing the further challenges and future research directions that will be faced by policy verification techniques. In particular, we discuss specific requirements concerning verification techniques for coalition policies systems and autonomous decision making.

Usage Control Specification, Enforcement, and Robustness: A Survey

“…A major drawback observed after comparing the various usage control frameworks is the lack of verification and validation tools that can be used to assess the accuracy and the correctness of the proposed usage control mechanisms. When it comes to the broader verification and validation literature, there are a number of possible techniques, such as those examined by Karafili et al [47], which have already been successfully applied to systems that employ model checking, algebraic solutions, abductive reasoning, answer set programming solvers.…”

Towards a Fine-Grained Access Control Mechanism for Privacy Protection and Policy Conflict Resolution

“…Policy conflicting affect the systems' security as malicious users can easily exploit the vulnerability to access the system. In literature, many studies have addressed the problem of policy conflicting [9], [10], [11], [12], [13], [14]. These solutions include: using expert system [10], modifying (edit, insert, revoke) policy/rule at the collision area [9], [14], using algebraic solutions [11], using Bayesian Network [12], [13].…”

“…In literature, many studies have addressed the problem of policy conflicting [9], [10], [11], [12], [13], [14]. These solutions include: using expert system [10], modifying (edit, insert, revoke) policy/rule at the collision area [9], [14], using algebraic solutions [11], using Bayesian Network [12], [13]. Furthermore, XACML 3.0-based approaches rely on the combining algorithm between policies and rules as in [15], [16], [17], [18], [19].…”

A Methodology and Toolkit for Deploying Reliable Security Policies in Critical Infrastructures

“…As main and objective solutions we highlight proposals based on model checking, algebraic techniques, graph of roles, Satisfiability Modulo Theories (SMT) and Satisfiability (SAT) solver, formal methods, abductive reasoning, and the conjunctions of those techniques. Authors in [20] present synthesis, discussion, and analysis of several popular verification techniques.…”

“…We consider the risk of an association as the ratio between the risk values of the members of the association. For example, the risk value of the user-role assignment relation ( ) that attributes the role to the user is evaluated, as defined in (20), as the ratio between the risk of the role and the risk of the user.…”