Monitoring security policies with metric first-order temporal logic

Abstract

We show the practical feasibility of monitoring complex security properties using a runtime monitoring approach for metric first-order temporal logic. In particular, we show how a wide variety of security policies can be naturally formalized in this expressive logic, ranging from traditional policies like Chinese Wall and separation of duty to more specialized usage-control and compliance requirements. We also explain how these formalizations can be directly used for monitoring and experimentally evaluate the performance of the resulting monitors.

Temporal Mode-Checking for Runtime Monitoring of Privacy Policies

“…To check α U I β, we wait until the upper limit of I is exceeded and then search backward. As an optimization, one may build conservative summary structures for future formulas, as in some prior work [5].…”

“…Alternatively, an online program may monitor privacy-relevant events, check them against the prevailing privacy policy and report violations on the fly. Both approaches have been considered in literature: An algorithm for offline compliance checking has been proposed by a subset of the authors [4], whereas online monitoring has been the subject of extensive work by other researchers [5][6][7][8][9][10][11].…”

“…Some work, e.g. [5,[8][9][10][11], is based on the safe-range check [5], which requires syntactic subformulas to have finite support independent of each other; other work, e.g. [4,7], is based on the mode check from logic programming [13][14][15], which is more general and can propagate variable groundedness information across subformulas.…”

“…This is inefficient when compared to an online monitor, but it can handle all privacy requirements of HIPAA and GLBA. In this work, we combine the space-and time-efficiency of online monitoring with the generality of offline monitoring: We extend existing work in online monitoring [5] for privacy policy violations with a brute force search fallback based on offline audit for subformulas that are not amenable to caching. Like the work of Basin et al [5], our work uses policies written in metric first-order temporal logic (MFOTL) [16].…”

“…Unlike the safe-range check or the standard mode check, our new temporal mode check captures this information correctly and our monitoring algorithm, précis, implements this strategy. No existing work on online monitoring can handle this formula because r cannot be summarized [5][6][7][8][9][10][11]. The work on offline checking can handle this formula [4], it does not build summary structures and is needlessly inefficient on q.…”