Static conflict detection for a policy language∗
نویسندگان
چکیده
We present a static control flow analysis used in the Simple Unified Policy Programming Language (Suppl) compiler to detect internally inconsistent policies. For example, an access control policy can decide to both “allow” and “deny” access for a user; such an inconsistency is called a conflict. Policies in Suppl follow the Event-Condition-Action paradigm; predicates are used to model conditions and event handlers are written in an imperative way. The analysis is twofold; it first computes a superset of all conflicts by looking for a combination of actions in the event handlers that might violate a user-supplied definition of conflicts. SMT solvers are then used to try to rule out the combinations that cannot possibly be executed. The analysis is formally proven sound in Coq in the sense that no actual conflict will be ruled out by the SMT solvers. Finally, we explain how we try to show the user what causes the conflicts, to make them easier to solve.
منابع مشابه
An Effective Modality Conflict Model for Identifying Applicable Policies During Policy Evaluation
Policy evaluation is a process to determine whether a request submitted by a user satisfies the access control policies defined by an organization. Modality conflict is one of the main issues in policy evaluation. Existing modality conflict detection approaches do not consider complex condition attributes such as spatial and temporal constraints. An effective authorization propagation rule is n...
متن کاملPolicy Conflict Detection for Cfengine Project Report
An ATP system, Bliksem, has been used for policy conflict detection in cfengine configurations. For this purpose, predicates corresponding to cfengine configuration directives have been developed, additional rules describing conflicting actions have been defined and a basic translator tool from the cfengine language to the TPTP language has been developed. Although some parts of the cfengine la...
متن کاملAdaptive Policy-based Approach for Static and Dynamic Policy Conflict Detection
Policy-based approach has been mostly acknowledged as a methodology that separates the rules governing the behavior of a system from its functionality. It provides the ability to (re-)configure differentiated services networks so that desired Quality of Service (QoS) goals are achieved, by considering administratively specified rules. Moreover, it promises to reduce maintenance costs of informa...
متن کاملApplying static code analysis to firewall policies for the purpose of anomaly detection
Treating modern firewall policy languages as imperative, special purpose programming languages, in this article we will try to apply static code analysis techniques for the purpose of anomaly detection. We will first abstract a policy in common firewall policy language into an intermediate language, and then we will try to apply anomaly detection algorithms to it. The contributions made by this...
متن کاملPolicy-based Approach to Detect and Resolve Policy Conflict for Static and Dynamic Architecture
Current research efforts are being directed to commit with the long-term view of self-management properties for wireless telecommunications. One of the key approaches that have been recognized as an enabler of such a view is policy-based management. Policy-based management has been mostly acknowledged as a methodology that provides flexibility, scalability, adaptability and support to automatic...
متن کامل