U.S. flag

An official website of the United States government

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

PUBLICATIONS

General Methods for Access Control Policy Verification

Published

Author(s)

Chung Tong Hu, David R. Kuhn

Abstract

Access control systems are among the most critical of computer security components. Faulty policies, misconfigurations, or flaws in software implementations can result in serious vulnerabilities. To formally and precisely capture the security properties that access control should adhere to, access control models are usually written, bridging the gap in abstraction between policies and mechanisms. Identifying discrepancies between policy specifications and their intended function is crucial because correct implementation and enforcement of policies by applications is based on the premise that the policy specifications are correct. As a result, policy specifications represented by models must undergo rigorous verification and validation through systematic verification and testing to ensure that the policy specifications truly encapsulate the desires of the policy authors. Verifying the conformance of access control policies and models is a non-trivial and critical task, and one important aspect of such verification is to formally check the inconsistency and incompleteness of the model and safety requirements of the policy, because an access control model and its implementation do not necessarily explicitly express the policy, which can also be implicitly embedded by mixing with direct access constraints or other access control models.
Proceedings Title
IEEE 17th International Conference on Information Reuse and Integration (IEEE IRI2016)
Conference Dates
July 28-30, 2016
Conference Location
Pittsburgh, PA
Pub Type
Conferences

Download Paper

https://doi.org/10.1109/IRI.2016.49

Keywords

access control, authorization, model checking, policy, policy verification, policy testing, policy tool
Conformance testing, Cybersecurity and Identity and access management

Citation

, C. and Kuhn, D. (2016), General Methods for Access Control Policy Verification, IEEE 17th International Conference on Information Reuse and Integration (IEEE IRI2016), Pittsburgh, PA, [online], https://doi.org/10.1109/IRI.2016.49 (Accessed May 3, 2024)

Created December 19, 2016, Updated November 10, 2018