A Rigorous Framework for Specification, Analysis and Enforcement of Access Control Policies

Abstract

Abstract-Access control systems are widely used means for the protection of computing systems. They are defined in terms of access control policies regulating the access to system resources. In this paper, we introduce a formally-defined, fully-implemented framework for specification, analysis and enforcement of attribute-based access control policies. The framework rests on FACPL, a language with a compact, yet expressive, syntax for specification of real-world access control policies and with a rigorously defined denotational semantics. The framework enables the automated verification of properties regarding both the authorisations enforced by single policies and the relationships among multiple policies. Effectiveness and performance of the analysis rely on a semantic-preserving representation of FACPL policies in terms of SMT formulae and on the use of efficient SMT solvers. Our analysis approach explicitly addresses some crucial aspects of policy evaluation, such as missing attributes, erroneous values and obligations, which are instead overlooked in other proposals. The framework is supported by Java-based tools, among which an Eclipse-based IDE offering a tailored development and analysis environment for FACPL policies and a Java library for policy enforcement. We illustrate the framework and its formal ingredients by means of an e-Health case study, while its effectiveness is assessed by means of performance stress tests and experiments on a well-established benchmark.

Decentralised Runtime Monitoring for Access Control Systems in Cloud Federations

“…As formally proved in [16], these constraints ensure that the corresponding FACPL (and, hence, XACML) policy evaluates an request to a certain decision dec if and only if the constraint c corresponding to dec is satisfiable with respect to the request. Therefore, once the Analyser receives the sensed request req and its response res, it first translates req into a set of SMT assertions, say c req , modelling the attributes forming the requests.…”

“…To this aim, there are available in the literature a few fullfledged analysis frameworks for XACML [14], [15], [16]. Differently from others, the framework in [16] enjoys the benefits of using formal method techniques to model and analyse XACML policies.…”

“…Differently from others, the framework in [16] enjoys the benefits of using formal method techniques to model and analyse XACML policies. The pursued approach rests on FACPL, a formal language to represent XACML, and on its translation procedure to Satisfiability Modulo Theory (SMT) constraints [17].…”

“…The FACPL-based framework ensures compelling properties on the analysis on XACML policies, hence on detecting PDP violations. Differently from other analysis framework (e.g., those in [14], [15], [16]), it ensures, experimental proves on its semantic compliance with XACML; the proves have been defined by using the XACML implementation Balana and the validation tool X-CREATE [24]. On the other hand, it ensures that the FACPL translation procedure to SMT constraints is formally proved correct according to the FACPL semantics.…”

Model-driven run-time enforcement of complex role-based access control policies

“…Recent work by Margheri et al [31] proposes a framework for the specification, analysis, and enforcement of ABAC [25] (attributebased access control) policies; RBAC can be seen as a specific case of ABAC, where role is one of the attributes. In this work, both AC requests and policies are expressed in a high-level language called FACPL; they are then translated into constraints to be solved using an SMT solver.…”