A Knowledge-Based Verification Method for Dynamic Access Control Policies
A Knowledge-Based Verification Method for Dynamic Access Control Policies
复制标题
一种基于知识的动态访问控制策略验证方法
DOI：
--
复制
发表时间：
2011
期刊：
影响因子：
--
通讯作者：
M. Ryan
中科院分区：
文献类型：
--
作者：
M. Koleini;M. Ryan
提出了一种新的基于知识的访问控制策略自动验证方法。该验证方法不仅发现是否存在漏洞，而且还生成可供攻击者用来利用该漏洞的策略。它调查攻击者实现目标所需的信息，以及他在执行策略时是否获得了该信息。我们提供了一种用于指定访问控制规则的策略语言和相应的查询语言，该语言适合于表达我们要验证的属性。策略语言具有足够的表现力来处理完整性约束和策略不变量。最后，在动态访问控制策略验证的背景下，我们比较了当前方法的结果和改进，该方法被实现为一个称为Poliver的策略验证工具。
We present a new approach for automated knowledge-based verification of access control policies. The verification method not only discovers if a vulnerability exists, but also produces the strategies that can be used by the attacker to exploit the vulnerability. It investigates the information needed by the attacker to achieve the goal and whether he acquires that information when he proceeds through the strategy or not. We provide a policy language for specifying access control rules and the corresponding query language that is suited for expressing the properties we aim to verify. The policy language is expressive enough to handle integrity constraints and policy invariants. Finally, we compare the results and enhancements of the current method - implemented as a policy verification tool called PoliVer - over similar works in the context of dynamic access control policy verification.