On Properties of Policy-Based Specifications

Andrea Margheri
(Università degli Studi di Firenze, Università di Pisa)
Rosario Pugliese
(Università degli Studi di Firenze)
Francesco Tiezzi
(Università di Camerino)

The advent of large-scale, complex computing systems has dramatically increased the difficulties of securing accesses to systems' resources. To ensure confidentiality and integrity, the exploitation of access control mechanisms has thus become a crucial issue in the design of modern computing systems. Among the different access control approaches proposed in the last decades, the policy-based one permits to capture, by resorting to the concept of attribute, all systems' security-relevant information and to be, at the same time, sufficiently flexible and expressive to represent the other approaches. In this paper, we move a step further to understand the effectiveness of policy-based specifications by studying how they permit to enforce traditional security properties. To support system designers in developing and maintaining policy-based specifications, we formalise also some relevant properties regarding the structure of policies. By means of a case study from the banking domain, we present real instances of such properties and outline an approach towards their automatised verification.

In Maurice H. ter Beek and Alberto Lluch Lafuente: Proceedings 11th International Workshop on Automated Specification and Verification of Web Systems (WWV 2015), Oslo, Norway, 23rd June 2015, Electronic Proceedings in Theoretical Computer Science 188, pp. 33–50.
Published: 14th August 2015.

ArXived at: http://dx.doi.org/10.4204/EPTCS.188.5 bibtex PDF
References in reconstructed bibtex, XML and HTML format (approximated).
Comments and questions to: eptcs@eptcs.org
For website issues: webmaster@eptcs.org