Reasoning about XACML policies using CSP

Abstract

In this work we explore the use of process algebra in formalising and analysing access control policies. We do this by considering a standard access control language (XACML) and show how the core concepts in the language can be represented in CSP. We then show how properties of these policies may also be described in CSP, and how model checking may be used to verify that a policy meets the property.We further consider how we may introduce a notion of workflow into this framework, and show that a simple appreciation of the workflow context may limit the things we need to verify about a policy.

Access Control Configuration for J2EE Web Applications: A Formal Perspective

“…Our prototype contains an implementation of · SCL which compiles security constraints as well as the decision function ∆ described in Sec. 4.…”

“…However, XACML is quite a complex policy language with informal evaluation semantics, so the development of tools complementing testing with formal verification of XACML is difficult. To tackle this issue, different formal semantics have been given to core concepts of XACML using for instance process algebra [4], description logics [5], answer set programming [6], specific algebraic variety [7] or ad hoc compositional semantics [8].…”

“…which is not a URL according to Definition 2. We can then write v ∈ u ↓ ⇒ v |v| = * leading, according to (4), to the following conclusion:…”

Towards model-driven development of access control policies for web applications

“…Regarding works on XACML's formalization, a largely followed approach is based on 'transformational' semantics (see, e.g., [10,4,3]). The target formalisms have in their turn their own semantics.…”

Formalisation and Implementation of the XACML Access Control Mechanism

“…A largely followed approach is based on 'transformational' semantics, where XACML policies are translated into terms of some formalism. For example, [11] uses description logic expressions as target formalism, [12] exploits the process algebra CSP [13], and [14] the model-oriented specification language VDM++ [15]. The main advantage of this approach is the possibility of analysing policies by means of off-the-shelf reasoning tools that may be already available for the considered formalisms.…”