Change impact analysis in authorization policies

Abstract

Due to the lack of tools for analyzing policies,most authorization policies on the Internet have been plagued with policy errors.A policy error either creates security vulnerabilities that will compromise the security of information technology system.A major source of policy errors stems from policy changes.Authorization policies often need to be changed as networks evolve and new requests emerge.The theory and algorithms for authorization policy change-impact analysis were presented.Algorithms in this paper took an authorization policy and a proposed change as input,and then output the accurate impact of the change.Thus,an administrator can verify a proposed change before committing it.A prototype was built to demonstrate the use of the algorithms.