CAREER: Access Control Policy Verification Through Security Analysis And Insider Threat Assessment

访问控制是当今使用的最基本的安全机制之一，然而，访问控制策略的规范和管理仍然是一个具有挑战性的问题，并且今天的管理员没有有效的工具来帮助他们。本研究通过开发新的访问控制策略验证技术和验证工具来解决这些需求和带来的挑战，这些验证工具将帮助管理员指定、了解和管理其访问控制策略。特别是，本研究对安全分析和内部威胁评估进行了研究。安全分析技术回答了一个基本问题，即访问控制系统是否在授权状态发生变化时保留基本的安全属性。内部威胁评估技术确定如果内部人员滥用对他们的信任可能造成的损害。在主要关注广泛部署的基于角色的访问控制模型的同时，本项目还旨在开发访问控制策略验证的理论基础和一般技术。本研究获得的见解将适用于其他更丰富的访问控制模型，并有助于提高对访问控制的能力和局限性的理解。

Access control is one of the most fundamental security mechanisms in use today; however, the specification and management of access control policies remains a challenging problem, and today's administrators have no effective tools to assist them. This research addresses these needs and arising challenges by developing new verification techniques for access control policies, and verification tools that will help administrators specify, understand, and manage their access control policies. In particular, this research studies security analysis and insider threat assessment. Security analysis techniques answer the fundamental question of whether an access control system preserves essential security properties across changes to the authorization state. Insider threat assessment techniques determine what damages insiders can cause if they misuse the trust that has been placed on them. While focusing primarily on the widely-deployed Role-Based Access Control model, this project also aims at developing theoretical foundations and general techniques for access control policy verification. Insights obtained from this research will be applicable to other richer access control models and will help improve the understanding of the power and limitation of access control.