Formal Verification of Usage Control Models: A Case Study of UseCON Using TLA+

Gouglidis, Antonios; Grompanopoulos, Christos; Mavridou, Anastasia

doi:10.4204/eptcs.272.5

Cited by 4 publications

(5 citation statements)

References 9 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Specifically, the specification proposed in [27] permits the concurrent execution of usages and allows attribute values to get values over infinitive domains using an algebraic structure. A comparison of UseCON's capabilities described in [6] against the above mentioned work is depicted in Table 1.…”

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

“…In [6], we have defined and verified the core operations of UseCON. In this paper, we provide a specification of the policy-neutral UseCON model that does not include any constraints on the number of requested uses (which was set in [6] to a maximum of 3). Furthermore, we provide policy-specific examples based on the two supported authorisation models in UseCON, and we also introduce faults in the previous examples.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Specifying and verifying usage control models and policies in TLA$$^+$$

Grompanopoulos

Gouglidis

Mavridou

2021

Int J Softw Tools Technol Transfer

Self Cite

View full text Add to dashboard Cite

Novel computing paradigms, e.g. the Cloud, introduce new requirements with regard to access control such as utilisation of historical information and continuity of decision. However, these concepts may introduce an additional level of complexity to the underpinning model, rendering its definition and verification a cumbersome and prone to errors process. Using a formal language to specify a model and formally verify it may lead to a rigorous definition of the interactions amongst its components, and the provision of formal guarantees for its correctness. In this paper, we consider a case study where we specify a formal model in TLA + for both a policy-neutral and policy-specific UseCON usage control model. Through that, we anticipate to shed light in the analysis and verification of usage control models and policies by sharing our experience when using TLA + specific tools.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Specifying and verifying usage control models and policies in TLA$$^+$$

Grompanopoulos

Gouglidis

Mavridou

2021

Int J Softw Tools Technol Transfer

Self Cite

View full text Add to dashboard Cite

show abstract

“…-The paper "Specifying and verifying usage control models and policies in TLA + " by Grompanopoulos, Gouglidis, and Mavridou [22] is an extension of the MeTRiD 2018 paper by the same authors [21]. It presents a case study on specification and model checking of usage control models and policies.…”

Section: This Issuementioning

confidence: 99%

On methods and tools for rigorous system design

Bliudze

Katsaros

Bensalem

et al. 2021

Int J Softw Tools Technol Transfer

View full text Add to dashboard Cite

Full a posteriori verification of the correctness of modern software systems is practically infeasible due to the sheer complexity resulting from their intrinsic concurrent nature. An alternative approach consists of ensuring correctness by construction. We discuss the Rigorous System Design (RSD) approach, which relies on a sequence of semantics-preserving transformations to obtain an implementation of the system from a high-level model while preserving all the properties established along the way. In particular, we highlight some of the key requirements for the feasibility of such an approach, namely availability of (1) methods and tools for the design of correct-by-construction high-level models and (2) definition and proof of the validity of suitable domain-specific abstractions. We summarise the results of the extended versions of seven papers selected among those presented at the $$1\mathrm {st}$$ 1 st and the $$2\mathrm {nd}$$ 2 nd International Workshops on Methods and Tools for Rigorous System Design (MeTRiD 2018–2019), indicating how they contribute to the advancement of the RSD approach.

show abstract

“…The UseCON model [7,10] is a next-generation model based on the concept usage control. UseCON is able to support complex and more expressive policies com-pared to existing usage-based approaches (e.g., UCON).…”

Section: Access Control In Iiotmentioning

confidence: 99%

Access Control in the Industrial Internet of Things

Salonikias

Gouglidis

Mavridis

et al. 2019

Security and Privacy Trends in the Industrial Internet of Things

Self Cite

View full text Add to dashboard Cite

The Industrial Internet of Things (IIoT) is an ecosystem that consists of -among others --various networked sensors and actuators, achieving mainly advancements related with lowering production costs and providing workflow flexibility. Introducing access control in such environments is considered to be challenging, mainly due to the variety of technologies and protocols in IIoT devices and networks. Thus, various access control models and mechanisms should be examined, as well as the additional access control requirements posed by these industrial environments. To achieve these aims, we elaborate on existing state-of-the-art access control models and architectures and investigate access control requirements in IIoT, respectively. These steps provide valuable indications on what type of an access control model and architecture may be beneficial for application in the IIoT. We describe an access control architecture capable of achieving access control in IIoT using a layered approach and based on existing virtualization concepts (e.g., the cloud). Furthermore, we provide information on the functionality of the individual access control related components, as well as where these should be placed in the overall architecture. Considering this research area to be challenging, we finally discuss open issues and anticipate these directions to provide interesting multi-disciplinary insights in both industry and academia.

show abstract

Formal Verification of Usage Control Models: A Case Study of UseCON Using TLA+

Cited by 4 publications

References 9 publications

Specifying and verifying usage control models and policies in TLA$$^+$$

Specifying and verifying usage control models and policies in TLA$$^+$$

On methods and tools for rigorous system design

Access Control in the Industrial Internet of Things

Contact Info

Product

Resources

About