Realizing policy verification subsystems for access control systems

规范用户对资源的访问，即访问控制，是安全的一个重要方面。大型访问控制系统的管理具有挑战性，集中式方法无法扩展。分散的方法引入了违反安全策略的风险。解决这个问题的方法是用策略验证来补充访问控制，策略验证告诉受信任的管理员使系统处于特定状态的后果（例如，与安全性、可用性和互斥相关的后果）。我将讨论妨碍实现访问控制的策略验证子系统的基础问题和应用问题。拟议的工作将为学生提供信息安全最重要方面之一的研究和教育培训。加拿大的信息系统将受益于开发的新技术，该技术将使访问控制具有可扩展性、健壮性和可用性。

Regulating users' accesses to resources, access control, is one of the most important aspects of security. The administration of large access control systems is challenging, and centralized approaches do not scale. Decentralized approaches introduce the risk that security policies are violated. A resolution to this is to complement access control with policy verification that tells a trusted administrator the consequences (e.g., related to safety, availability and mutual exclusion) of leaving the system in a particular state. I will address foundational and applied problems that stand in the way of realizing policy verification subsystems for access control. The proposed work will provide research and educational training to students on one of the most important aspects of information security. Information systems in Canada will benefit from the new technology that is developed that will make access control scalable, robust and usable.