Formal specification of an access control system

Abstract

SUMMARYComputing facilities networked together but controlled by different administrations pose a problem of access control. Who decides who can use what?We specify a formal model for an access control system which allows users and services from different administrations to communicate with each other, while still allowing the administrators to retain control of their own parts of the network. The model, written in the Z specification language, has been developed as the access control system for ADMIRAL, though it is not specific to ADMIRAL. It provides a framework for administrators to build access control systems to meet their differing requirements.A system based on the model would allow users to log in to a distributed computing system and to make requests for services in any part of the system, without having to provide any more information about themselves. After this initial log in all subsequent access control decisions are handled automatically, and remain invisible to the user unless access is refused.We also discuss the experience we have had animating this model in Prolog.KEY WORDS Networks Access control Formal model Z specification Prolog Objectives of the ModelIn a conventionally organized network, very little attention is paid to access control on a network-wide basis. Usually individual machines provide their own facilities. This can lead to frustration both for users and for administrators; users are continually faced with log-in prompts, and administrators have to control a multitude of tables on different machines. Most access control schemes designed for networks are based around a centralized service, or are controlled by a single administration. These fail to address the problems associated with access control in a multi-administration network. In such a network, several autonomous access control system (ACSs) have to interact.The model described here has been developed as the access control system for project ADMIRAL. ADMIRAL is a collaborative project supported by the Alvey programme, carrying out research into the use and management of high performance networks. An internet of linked networks, covering five industrial and academic sites, is being set up. The project is described in Reference 1.Our model is not specific to ADMIRAL, however. A system based on our model will have the following properties:1. Autonomous administrations can work with each other, but still retain control over their own facilities. 2. Users' access to services can be controlled, even when the user and the service fall under different administrations. This control is invisible to users, unless they try to access services not available to them.

From Astrophysics to Unconventional Computation

“…In the mid-1980s, Susan left astrophysics and academia to join the GEC-Marconi Research Centre in Chelmsford. Her first computer science paper was about modelling access control of networks with different administrations linked together [15], and she later wrote a formal model of access control in the Z formal specification language [31]. She moved to Logica Cambridge in 1989, where she developed the formal specification and correctness proofs of a high-integrity compiler [21,22,36] and the Mondex electronic purse [2,29].…”

Formalization and assessment of regulatory requirements for safety-critical software

“…For example, the Z notation was used in the development of formal models for access-control systems for the ADMIRAL project [51]. More recently, VDM and the Prototype verification system (PVS) were used in the analysis of the requirements for an access-control system, which is part of a comprehensive security system [12].…”

What is Logic Programming good for in Software Engineering?

“…19 This intrinsic high level of logic programming is being exploited even when the specification is written in a specification language that is not logic. More precisely, this approach consists of animating a not executable specification language using Prolog: this is the case of the systems that implement specifications written with Petri Nets, 20 DeMarco's Structured Anal-ysis Dataflow Diagrams,, 21,22 Z, 23,24 and CSP/LOTOS. 25 Animation gives a way of querying the formal specification, increasing the designers' confidence in the code they develop.…”