Realizing policy verification subsystems for access control systems

管理用户对资源的访问，即访问控制，是安全最重要的方面之一。大型访问控制系统的管理具有挑战性，集中化方法无法扩展。分散的方法会带来违反安全政策的风险。对此的解决方案是用策略验证来补充访问控制，该策略验证告诉受信任的管理员将系统保持在特定状态的后果(例如，与安全性、可用性和互斥有关)。我将解决阻碍访问控制策略验证子系统实现的基础和应用问题。拟议的工作将为学生提供关于信息安全最重要方面之一的研究和教育培训。加拿大的信息系统将受益于开发的新技术，这种技术将使访问控制具有可伸缩性、健壮性和可用性。

Regulating users' accesses to resources, access control, is one of the most important aspects of security. The administration of large access control systems is challenging, and centralized approaches do not scale. Decentralized approaches introduce the risk that security policies are violated. A resolution to this is to complement access control with policy verification that tells a trusted administrator the consequences (e.g., related to safety, availability and mutual exclusion) of leaving the system in a particular state. I will address foundational and applied problems that stand in the way of realizing policy verification subsystems for access control. The proposed work will provide research and educational training to students on one of the most important aspects of information security. Information systems in Canada will benefit from the new technology that is developed that will make access control scalable, robust and usable.