CT-ISG: Deductive Spreadsheets for Security Policy Specification and Analysis

规则语言用于指定安全和管理策略，例如访问控制和授权策略以及网络管理策略。虽然这些规则语言旨在简化复杂策略的规范和管理，但大型规则集通常包含微妙的交互，使它们难以理解和推理。该项目侧重于开发演绎电子表格（DSS）范例，它使用熟悉的类似电子表格的界面来指定规则。DSS为符号和基于规则的计算带来了传统电子表格为数值计算带来的东西。具体来说，演绎电子表格将允许用户直接看到规则的效果，并在规则和/或基础数据发生变化时看到结果的变化。通过一个用于描述网络中漏洞传播的原型，DSS的可行性得到了证明。该项目将决策支持系统的范围扩展到与安全相关的策略规范和分析问题的广泛范围。该项目解决了DSS语言发展中的基本问题，包括其语义、增量评估算法和解释演绎结果的技术。在这个项目中所做的研究将产生用于安全策略和信任管理策略的基于dss的工具。该项目将通过将这些工具纳入本科和研究生课程来促进这些工具的使用。该项目有助于安全策略语言、逻辑和约束编程、语义、基于规则的计算的解释以及可视化它们的接口的研究和教育。

Rule languages have been used to specify security and management policies, such as access control and authorization policies, and network management policies. While these rule languages aim to simplify the specification and management of complex policies, large rule sets often contain subtle interactions, making them difficult to understand and reason about.This project focuses on developing the Deductive Spread Sheet (DSS) paradigm, which uses the familiar spreadsheet-like interface for specifying rules. DSS brings to symbolic and rule-based computation what traditional spreadsheets bring to numeric computation. Specifically, deductive spreadsheets will allow users to directly see the effect of the rules, and see the changes to the results when the rules and/or the base data is changed. The feasibility of DSS has been shown via a prototype that has been used to describe the propagation of vulnerabilities in a network. This project significantly expands the scope of DSS to a broad range of security-related policy specification and analysis problems. The project addresses fundamental questions in the development of the DSS language including its semantics, algorithms for its incremental evaluation, and techniques for explaining the results of deduction. Research done in this project will result in DSS-based tools for security policies and trust management policies. The project will promote the use of such tools by integrating them into undergraduate and graduate courses. The project contributes to research and education in security policy languages, logic and constraint programming, semantics, explanations of rule-based computation and interfaces for visualizing them.