CT-ISG: Deductive Spreadsheets for Security Policy Specification and Analysis

规则语言已被用于指定安全和管理策略，例如访问控制和授权策略以及网络管理策略。 虽然这些规则语言旨在简化复杂策略的规范和管理，但大型规则集通常包含微妙的交互，使其难以理解和推理。本项目侧重于开发Deductive Spread Sheet（DSS）范式，该范式使用熟悉的类似电子表格的界面来指定规则。 DSS给符号和基于规则的计算带来了传统电子表格给数值计算带来的东西。 具体而言，演绎电子表格将允许用户直接看到规则的效果，并在规则和/或基础数据发生变化时看到结果的变化。 DSS的可行性已通过一个原型，已被用来描述在网络中的脆弱性的传播。 该项目大大扩展了DSS的范围，使其涵盖了广泛的与安全相关的政策规范和分析问题。 该项目解决了DSS语言开发中的基本问题，包括其语义，增量评估算法和解释演绎结果的技术。在这个项目中完成的研究将导致基于DSS的安全策略和信任管理策略的工具。 该项目将通过将这些工具纳入本科生和研究生课程，促进这些工具的使用。该项目有助于安全政策语言，逻辑和约束编程，语义，基于规则的计算和可视化接口的解释的研究和教育。

Rule languages have been used to specify security and management policies, such as access control and authorization policies, and network management policies. While these rule languages aim to simplify the specification and management of complex policies, large rule sets often contain subtle interactions, making them difficult to understand and reason about.This project focuses on developing the Deductive Spread Sheet (DSS) paradigm, which uses the familiar spreadsheet-like interface for specifying rules. DSS brings to symbolic and rule-based computation what traditional spreadsheets bring to numeric computation. Specifically, deductive spreadsheets will allow users to directly see the effect of the rules, and see the changes to the results when the rules and/or the base data is changed. The feasibility of DSS has been shown via a prototype that has been used to describe the propagation of vulnerabilities in a network. This project significantly expands the scope of DSS to a broad range of security-related policy specification and analysis problems. The project addresses fundamental questions in the development of the DSS language including its semantics, algorithms for its incremental evaluation, and techniques for explaining the results of deduction. Research done in this project will result in DSS-based tools for security policies and trust management policies. The project will promote the use of such tools by integrating them into undergraduate and graduate courses. The project contributes to research and education in security policy languages, logic and constraint programming, semantics, explanations of rule-based computation and interfaces for visualizing them.