Analysis of privacy and security policies

Abstract

Policy analysis techniques have usually been developed independently of applications or they have been tailored to policies with specific purposes, e.g. they have been used to analyze access control policies, system management policies or privacy policies. There are analysis techniques to detect redundancy and incompleteness of policies. There are also techniques to detect modality conflicts such as obligations that cannot be fulfilled because of the lack of authorizations, and techniques to detect circular dependencies of obligations. The intent of this paper is to present a survey of these and other analysis techniques that have been developed independently for the analysis of security and privacy policies, and to show how these techniques can be harmonized to analyze the interactions between these two types of policies. Working with health care examples we will show how these different techniques can be applied to improve the quality of policies.

A graph-based framework for the analysis of access control policies

“…The axiom (a1), and its algebraic version (a1 ), state that a request by a principal p to perform the action a on a resource r is authorised only if p belongs to a category c such that for some category below c (e.g., c itself) the action a is authorised on r, otherwise the request is denied following the wellknown negative closed world assumption [14]. However, many systems permit the definition of positive and negative authorisations (or authorisations and prohibitions).…”

“…This motivated the work on distributed and federative access control models, and the development of tools and technologies to manage the policies (see, e.g., [14] for a survey of analysis techniques). Security administrators need to query policies to extract information and to verify basic correctness properties.…”

“…According to the basic policy analysis model defined in [14], analysis queries are classified as policy metadata queries, policy content queries and policy effect queries.…”

“…Following [14], if for a given policy there is a principal not assigned to any category, or a category without associated permissions, or a resource which is not accessible, we say that the policy is ineffective for that principal, category, or resource respectively. It is unlikely that a policy is intentionally written to behave in this way; the analysis should try to identify ineffectiveness.…”

“…Given the complexities and scope involved in the definition of access control policies, formal methods to analyse and reason about access control policies are essential [14]. This is particularly important in the case of systems dealing with access control in the context of emergency situations, where users' rights may need to change in order to cope with specific emergencies.…”