Author:
Ahmed Khoumsi
Affiliation:
Department of Electrical & Computer Engineering, Université de Sherbrooke, Sherbrooke, Canada
Keyword(s):
Dynamic Access Control Policies, Deterministic, Nondeterministic Policies, Complete Policy, Nonblocking Policy, Conflict-Free Policy, Automata-Based Design, Analysis.
Abstract:
Access control policies (more briefly: policies) are used to filter accesses to resources. A policy is usually defined by a table of rules that specify which access requests (more briefly: requests) must be accepted and which ones must be rejected. In this paper, we study dynamic policies which do not have a common definition in the scientific community, but whose basic intuition is that the decision to accept or reject a request rq depends not only on rq, but also on the history of what have preceded rq. In our case, it is the history of events and requests that precede rq. An event indicates that a specific condition has just been met, for example “it is midnight”. We formally specify the history of events and requests by associating a guard and an assignment to each rule, and an assignment to each event. We show how to model, execute and analyze dynamic policies using an automata-based approach. In the analysis, we verify several properties of a dynamic policy, such as nonblocking
, completeness, and absence of conflict. Deterministic as well as nondeterministic policies are considered.
(More)