Evaluating access control policies through model checking

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

Volumn 3650 LNCS, Issue , 2005, Pages 446-460

  Zhang, Nan ^a   Ryan, Mark ^a   Guelev, Dimitar P ^b  

^a UNIVERSITY OF BIRMINGHAM   (United Kingdom)

^b INSTITUTE OF MATHEMATICS AND INFORMATICS   (Bulgaria)

Author keywords

Access control; Access control model; Access control policy; Access control policy language; Model checking; Verification

Indexed keywords

CONTROL SYSTEM ANALYSIS; SECURITY OF DATA; USER INTERFACES;

ACCESS CONTROL; ACCESS CONTROL MODEL; ACCESS CONTROL POLICY; ACCESS CONTROL POLICY LANGUAGE; MODEL CHECKING; VERIFICATION;

ALGORITHMS;

EID: 33645964601     PISSN: 03029743     EISSN: 16113349     Source Type: Book Series    
DOI: 10.1007/11556992_32     Document Type: Conference Paper

References (14)

1. Sandhu, R., Coyne, E., Feinstein, H., Youman, C.: Role-based access control models. IEEE Computer 29 (1996) 38-47
2. Anderson, R.: Security Engineering: A Guide to Building Dependable Distributed Systems. John Wiley & Sons, Inc., U.S.A. (2001)
3. Guelev, D.P., Ryan, M.D., Schobbens, P.Y.: Model-checking access control policies. In: the Seventh Information Security Conference (ISC'04). Lecture Notes in Computer Science, Springer-Verlag (2004)
4. Zhang, N., Ryan, M., Guelev, D.P.: Synthesising verified access control systems in XACML. In: the 2004 ACM Workshop on Formal Methods in Security Engineering, Washington DC, USA, ACM Press (2004) 56-65
5. Godik, S., Moses, T.: extensible Access Control Markup Language. OASIS committee. 1.1 edn. (2003) Committee specification.
6. Jackson, D.: Micromodels of Software: Lightweight Modelling and Analysis with Alloy. Software Design Group, MIT Lab for Computer Science. (2002) This document and the tool can be obtained from http://alloy.mit.edu/.
7. Whaley, J.: JavaBDD: Java BDD implementation (2004) Information about this implementation can be found at http://javabdd.sourceforge.net/.
8. Zhang, N.: Web site for the access control policy evaluator and generator (2005) The tool can be obtained from http://www.cs.bham.ac.uk/~nxz.
9. Fisler, K., Krishnamurthi, S., Meyerovich, L.A., Tschantz, M.C.: Verification and change-impact analysis of access-control policies. In: ICSE'05, St. Louis, Missouri, USA (2005)
10. Clarke, E., Fujita, M., McGeer, P., Yang, J., Zhao, X.: Multi-terminal binary decision diagrams: An efficient data structure for matrix representation. In: International Workshop on Logic Synthesis, Tahoe City (1993)
11. Ahmed, T., Tripathi, A.R.: Static verficiation of security requirements in role based CSCW systems. In: SACMAT'03, Como, Italy (2003)
12. Chess, B.: Improving computer security using extended static checking. In: 2002 IEEE Symposium on Security and Privacy, Washington, DC, USA, IEEE Computer Society (2002)
13. Schaad, A., Moffett, J.: A lightweight approach to specification and analysis of role-based access control extensions. In: SACMAT'02, Monterey, California, USA (2002)
14. Jackson, D., Schechter, I., Shlyahter, H.: Alcoa: the Alloy constraint analyzer. In: the 22nd international conference on Software engineering, ACM Press (2000) 730-733