Formal definitions for usable access control rule sets from goals to metrics
Formal definitions for usable access control rule sets from goals to metrics
复制标题
从目标到指标的可用访问控制规则集的正式定义
DOI：
--
复制
发表时间：
2013
期刊：
影响因子：
--
通讯作者：
L. Martucci
中科院分区：
文献类型：
--
作者：
Matthias Beckerle;L. Martucci
访问控制策略描述了访问控制系统的高级要求。理想情况下，访问控制规则集将这些策略转换为一致且可管理的允许/拒绝规则集合。设计反映所需策略的规则集是一项困难且耗时的任务。结果是规则集很难理解和管理。本文的目标是提供获得可用的访问控制规则集，我们定义为规则集，（i）反映访问控制策略和（ii）易于理解和管理的手段。在本文中，我们正式定义了用户在生成可用的访问控制规则集时所面临的挑战，并提供了正式的工具来更容易地处理它们。我们从一项试点研究开始，在这项研究中，我们采访了专家。其目的是列出关于访问控制规则集管理的可用性挑战，并核实专家如何处理这些挑战。试点研究的结果进行了比较，并结合相关工作的结果，并细化为六个新的，正式定义的指标，用于衡量访问控制规则集的安全性和可用性方面。我们通过两项用户研究验证了我们的发现，这表明我们的指标可以帮助用户生成统计上显著更好的规则集。
Access control policies describe high level requirements for access control systems. Access control rule sets ideally translate these policies into a coherent and manageable collection of Allow/Deny rules. Designing rule sets that reflect desired policies is a difficult and time-consuming task. The result is that rule sets are difficult to understand and manage. The goal of this paper is to provide means for obtaining usable access control rule sets, which we define as rule sets that (i) reflect the access control policy and (ii) are easy to understand and manage. In this paper, we formally define the challenges that users face when generating usable access control rule sets and provide formal tools to handle them more easily. We started our research with a pilot study in which specialists were interviewed. The objective was to list usability challenges regarding the management of access control rule sets and verify how those challenges were handled by specialists. The results of the pilot study were compared and combined with results from related work and refined into six novel, formally defined metrics that are used to measure the security and usability aspects of access control rule sets. We validated our findings with two user studies, which demonstrate that our metrics help users generate statistically significant better rule sets.