Developing and Enforcing Policies for Access Control, Resource Usage, and Adaptation

Margheri, Andrea; Masi, Massimiliano; Pugliese, Rosario; Tiezzi, Francesco

doi:10.1007/978-3-319-08260-8_6

Cited by 2 publications

(3 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…FACPL obligations permit enforcing, e.g., resource usage, adaptation and emergency handling strategies. For example, in the application of the Ponder language by Sloman and Lupu [60] and in the preliminary version of FACPL by Margheri et al [44], [61], obligations are used to enforce self-adaptation strategies in autonomic computing systems. Instead, in the context of emergency handling, an obligationbased approach is proposed by Brucker and Petritsch [62] and Marinovic et al [63] to enforce the principle known as 'break the glass', which means that authorisation controls can be bypassed in case of emergency.…”

Section: Discussionmentioning

confidence: 99%

“…This latter extension widens FACPL applicability range and expressiveness, as it provides the policy evaluation process with further, powerful means to affect the behaviour of controlled systems. For instance, a practical example of a policy-based manager for a Cloud platform is given by Margheri et al [44]. Additional important differences concern the definition of the policy semantics.…”

Section: Related Workmentioning

confidence: 99%

“…This latter extension widens FACPL applicability range and expressiveness, as it provides the policy evaluation process with further, powerful means to affect the behaviour of controlled systems (see e.g. [32] for a practical example of a policy-based manager for a Cloud platform). Additional important differences concern the definition of the policy semantics: in [36] it is given in terms of partitions of the set of all possible requests, while here it is defined in a functional fashion with respect to a generic request.…”

Section: Related Workmentioning

confidence: 99%

See 2 more Smart Citations

A Rigorous Framework for Specification, Analysis and Enforcement of Access Control Policies

Margheri

Masi²,

Pugliese

et al. 2019

IIEEE Trans. Software Eng.

Self Cite

View full text Add to dashboard Cite

Abstract-Access control systems are widely used means for the protection of computing systems. They are defined in terms of access control policies regulating the access to system resources. In this paper, we introduce a formally-defined, fully-implemented framework for specification, analysis and enforcement of attribute-based access control policies. The framework rests on FACPL, a language with a compact, yet expressive, syntax for specification of real-world access control policies and with a rigorously defined denotational semantics. The framework enables the automated verification of properties regarding both the authorisations enforced by single policies and the relationships among multiple policies. Effectiveness and performance of the analysis rely on a semantic-preserving representation of FACPL policies in terms of SMT formulae and on the use of efficient SMT solvers. Our analysis approach explicitly addresses some crucial aspects of policy evaluation, such as missing attributes, erroneous values and obligations, which are instead overlooked in other proposals. The framework is supported by Java-based tools, among which an Eclipse-based IDE offering a tailored development and analysis environment for FACPL policies and a Java library for policy enforcement. We illustrate the framework and its formal ingredients by means of an e-Health case study, while its effectiveness is assessed by means of performance stress tests and experiments on a well-established benchmark.

show abstract

Section: Discussionmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

“…This latter extension widens FACPL applicability range and expressiveness, as it provides the policy evaluation process with further, powerful means to affect the behaviour of controlled systems (see e.g. [32] for a practical example of a policy-based manager for a Cloud platform). Additional important differences concern the definition of the policy semantics: in [36] it is given in terms of partitions of the set of all possible requests, while here it is defined in a functional fashion with respect to a generic request.…”

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

A Rigorous Framework for Specification, Analysis and Enforcement of Access Control Policies

Margheri

Masi²,

Pugliese

et al. 2019

IIEEE Trans. Software Eng.

Self Cite

View full text Add to dashboard Cite

show abstract

Correctness of Service Components and Service Component Ensembles

Combaz

Bensalem

Tiezzi

et al. 2015

Software Engineering for Collective Autonomic Systems

View full text Add to dashboard Cite

Nowadays, cyber-physical systems consist of a large and possibly unbounded number of nodes operating in a partially unknown environment to which they need to adapt. They also have strong requirements in terms of performances, resource usage, reliability, or security. To face this inherent complexity it is crucial to develop adequate tools and underlying models to analyze these properties at design time. Proposed models must be able to capture essential aspects of the behavior (e.g. interactions between the components, adaptive behavior, uncertain or changing environments), and the corresponding analysis techniques can only succeed if they exploit as much as possible the specific structure of the considered systems (e.g. large replication of the same component, hierarchical compositions). We consider qualitative analyses targeting boolean properties stating that the system behaves without any flaw, as well as quantitative analyses that evaluate expected performances according to predefined metrics (energy/memory consumption, average/maximum time to accomplish a task, probability to fulfil a goal, etc.). We also address security specific issues such as control policies and information flow

show abstract

Developing and Enforcing Policies for Access Control, Resource Usage, and Adaptation

Cited by 2 publications

References 10 publications

A Rigorous Framework for Specification, Analysis and Enforcement of Access Control Policies

A Rigorous Framework for Specification, Analysis and Enforcement of Access Control Policies

Correctness of Service Components and Service Component Ensembles

Contact Info

Product

Resources

About