Semi-automatic Synthesis of Security Policies by Invariant-Guided Abduction

Hurlin, Clément; Kirchner, Hélène

doi:10.1007/978-3-642-19751-2_11

Cited by 1 publication

(2 citation statements)

References 15 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…There are three main lines of research that are related to our work. First, several logic-based frameworks (e.g., [19,14,7,15,1,24]) have been proposed to specify and analyze authorization policies with conditions depending on the environment of the system in which they are enforced. In principle, it is possible to consider the conditions depending on the execution of human activities as part of the environment and then re-use the available specification and analysis techniques.…”

Section: Discussionmentioning

confidence: 99%

“…We avoid this state-explosion problem by considering scenario-based specifications that allow one to focus on a small sub-set of the possible sequences of events, as explained in Section 5. It would be interesting to adapt the abduction techniques in [6,15] to identify which non-mechanizable facts need to be generated for the executability of complex scenarios in which condition (COMP2), about the "monotonicity" of the events (Section 5), does not hold.…”

Section: Discussionmentioning

confidence: 99%

See 1 more Smart Citation

Automated Analysis of Scenario-Based Specifications of Distributed Access Control Policies with Non-mechanizable Activities

Barletta

Ranise²,

Viganò

2013

Security and Trust Management

View full text Add to dashboard Cite

The advance of web services technologies promises to have far-reaching effects on the Internet and enterprise networks allowing for greater accessibility of data. The security challenges presented by the web services approach are formidable. In particular, access control solutions should be revised to address new challenges, such as the need of using certificates for the identification of users and their attributes, human intervention in the creation or selection of the certificates, and (chains of) certificates for trust management. With all these features, it is not surprising that analyzing policies to guarantee that a sensitive resource can be accessed only by authorized users becomes very difficult. In this paper, we present an automated technique to analyze scenario-based specifications of access control policies in open and distributed systems. We illustrate our ideas on a case study arising in the e-government area.

show abstract