Policy Specification Language Research Articles

Dynamic generation of access control policies from social policies

Access to and processing of personal data is regulated by norms that are written down in legal source documents, including laws, regulations and contracts. Compliance can be automated through the formalisation of these norms, reducing human effort and making the applied interpretations explicit. In addition, trust between parties may increase, thus promoting collaborations to gain more insights from sharing data. Although several policy specification languages have been proposed, there are not many that can be used to specify both social policies, such as privacy regulations and contracts, and system-level policies such as those used for access control. In this work, we present extensions to eFLINT, a domain-specific language developed to formalise norms from various sources. The extensions make it possible to interconnect social and system-level policies. We demonstrate the new features of eFLINT within the healthcare domain by formalising the regulatory document of the SIOPE DIPG/DMG Network, a consortium established to advance research into a rare form of pediatric brain cancer, and by showing how the resulting specifications are used to automate compliance checking of access and processing requests made by members of the consortium.

Static checking of GDPR-related privacy compliance for object-oriented distributed systems

The adoption of information technology in foremost sectors of human activity such as banking, healthcare, education, governance etc., increases the amount of data collected and processed to enable these services. With the convenience the technology offers, it also brings increased challenges pertaining to the privacy. In response to these emerging privacy concerns, the European Union has approved the General Data Protection Regulation (GDPR) to strengthen data protection across the European Union. This regulation requires individuals and organizations that process personal data of EU citizens or provide services in EU, to comply with the privacy requirements in the GDPR. However, the privacy policies stating how personal information will be handled to meet regulations as well as organizational objectives, are given in natural language statements. To demonstrate a program's compliance with privacy policies, a link should be established between policy statements and the program code, with the support of a formalized analysis.Based on this vision, we formalize a notion of privacy policies and a notion of compliance for the setting of object-oriented distributed systems. For this we provide explicit constructs to specify constituents of privacy policies (i.e., principal, purpose, access right) on personal data. We present a policy specification language and a formalization of privacy compliance, as well as a high-level modeling language for distributed systems extended with support for policies. We define a type and effect system for static checking of compliance of privacy policies and show soundness of this analysis based on an operational semantics. Finally, we prove a progress property.

Controlled flexibility in blockchain-based collaborative business processes

Blockchain technology enables the execution of collaborative business processes involving mutually untrusted parties. Existing tools allow such processes to be modeled using high-level notations and compiled into smart contracts that can be deployed on blockchain platforms. However, these tools do not provide mechanisms to cope with the flexibility requirements inherent to open and dynamic collaboration environments. In particular, existing tools adopt a static role binding approach wherein roles are bound to actors upfront when a process instance is created. Also, these tools do not allow participants to collectively make choices regarding alternative sub-processes or branches in the process model, at runtime. This paper presents a model for dynamic binding of actors to roles in collaborative processes and an associated binding policy specification language. The proposed language is endowed with a Petri net semantics, thus enabling policy consistency verification. Furthermore, the paper introduces a model for consensus-based control-flow flexibility, wherein participants in a process can collectively agree on how to steer the business process within the boundaries defined by control-flow agreement policies. The paper also outlines an approach to compile policy specifications into smart contracts for enforcement. An experimental evaluation shows that the cost of policy enforcement increases linearly with the number of roles, control-flow elements, and policy constraints.

Модель мандатного контроля целостности в операционной системе KasperskyOS

Existing models of mandatory integrity control in operating systems restrict accesses of active components of a system to passive ones and represent the accesses directly: subjects get read or write access to objects. Such a representation can be used in modeling of monolithic operating systems whose components that provide access to resources are part of the trusted computing base. However, the implementation of these components is extremely complex. Therefore, it is arduous to prove the absence of bugs (vulnerabilities) in them. In other words, proving such a model to be adequate to the real system is nontrivial and often left unsolved. This article presents a mandatory integrity control model for a microkernel operating system called KasperskyOS. Microkernel organization of the system allows us to minimize the trusted computing base to include only the microkernel and a limited number of other components. Parts of the system that provide resource access are generally considered untrusted. Even if some of them are erroneous, the operating system can still provide particular security guarantees. To prove that by means of a model, we introduce the notion of object drivers as intermediaries in operations on objects. We define the requirements that object drivers must satisfy. We also add the means for analysis of the consequences of violations of the requirements. We state and prove that the model either preserves integrity if all active components satisfy the requirements, or restricts the negative impact if some of the components are compromised. Correct implementation of the model guarantees that compromised components will not affect components with higher or incomparable integrity levels. We describe a policy specification language developed in accordance with the model. We provide an example of using it to describe a security policy that ensures a correct update of a system operated by KasperskyOS.

Privacy-aware cloud service selection approach based on P-Spec policy models and privacy sensitivities

In cloud computing era, massive free and function-powerful cloud services can be selected by consumers at any time. However, owing to lacking of privacy policy transparency mechanism and privacy policy comparison mechanism, it is difficult for service consumers to distinguish what is a trusted service and what is a malicious service. To solve these problems, we conceive a comprehensive framework whose primary goal is to set up a policy matching engine as a service mediator to assist service consumers to select out a group privacy trusted services whose privacy policy can comply with consumer’s privacy preferences. Accordingly, we propose a formal policy specification language named P-Spec, which can be utilized to describe the service’s privacy policies and consumer’s privacy preferences explicitly. We further propose a privacy-aware service selection approach, which consists of a group of P-Spec policy models, introduced privacy metrics and a specific policy matching algorithm based on privacy sensitivities. To verify the effectiveness and feasibility of our approach, we implement a proof-of-concept prototype to carry out the relevant experimental studies. The experimental results illustrate our approach can still work well with increasing the scale of policy models. We further utilize the relevant linear fit theories to predict the execution performance of our approach in real cloud, the final predicted results illustrate its performance is permitted and can be improved in real. Lastly, we compare our P-Spec language with some other policy languages and evaluate the comparative results.

P-Spec Policy Model-based Service Selection Approach for Privacy-aware Service Composition Establishment

As the issue of privacy exposure is becoming more and more serious, many scholars put forward the concept of privacy-aware service composition. Inspired by this concept, we propose a P-Spec policy model-based service selection approach for constructing privacy-aware service composition. P-Spec proposed in this paper is a kind of formal policy specification language, which can be utilized to describe the heterogeneous privacy policies and privacy preference explicitly. With the relevant P-Spec models, we further conceive the framework of our approach, which consists of a group of P-Spec policy models and a specific policy matching algorithm. To verify the feasibility and effectiveness of our approach, we implement a policy matching engine prototype and evaluate its performance.

HAC: Hybrid Access Control for Online Social Networks

The rapid development of communication and network technologies including mobile networks and GPS presents new characteristics of OSNs. These new characteristics pose extra requirements on the access control schemes of OSNs, which cannot be satisfied by relationship-based access control currently. In this paper, we propose a hybrid access control model (HAC) which leverages attributes and relationships to control access to resources. A new policy specification language is developed to define policies considering the relationships and attributes of users. A path checking algorithm is proposed to figure out whether paths between two users can fit in with the hybrid policy. We develop a prototype system and demonstrate the feasibility of the proposed model.

Scalable verification of border gateway protocol configurations with an SMT solver

Internet Service Providers (ISPs) use the Border Gateway Protocol (BGP) to announce and exchange routes for de- livering packets through the internet. ISPs must carefully configure their BGP routers to ensure traffic is routed reli- ably and securely. Correctly configuring BGP routers has proven challenging in practice, and misconfiguration has led to worldwide outages and traffic hijacks. This paper presents Bagpipe, a system that enables ISPs to declaratively express BGP policies and that automatically verifies that router configurations implement such policies. The novel initial network reduction soundly reduces policy verification to a search for counterexamples in a finite space. An SMT-based symbolic execution engine performs this search efficiently. Bagpipe reduces the size of its search space using predicate abstraction and parallelizes its search using symbolic variable hoisting. Bagpipe's policy specification language is expressive: we expressed policies inferred from real AS configurations, policies from the literature, and policies for 10 Juniper TechLibrary configuration scenarios. Bagpipe is efficient: we ran it on three ASes with a total of over 240,000 lines of Cisco and Juniper BGP configuration. Bagpipe is effective: it revealed 19 policy violations without issuing any false positives.

OpenSec: Policy-Based Security Using Software-Defined Networking

As the popularity of software-defined networks (SDN) and OpenFlow increases, policy-driven network management has received more attention. Manual configuration of multiple devices is being replaced by an automated approach where a software-based, network-aware controller handles the configuration of all network devices. Software applications running on top of the network controller provide an abstraction of the topology and facilitate the task of operating the network. We propose OpenSec, an OpenFlow-based security framework that allows a network security operator to create and implement security policies written in human-readable language. Using OpenSec, the user can describe a flow in terms of OpenFlow matching fields, define which security services must be applied to that flow (deep packet inspection, intrusion detection, spam detection, etc.) and specify security levels that define how OpenSec reacts if malicious traffic is detected. In this paper, we first provide a more detailed explanation of how OpenSec converts security policies into a series of OpenFlow messages needed to implement such a policy. Second, we describe how the framework automatically reacts to security alerts as specified by the policies. Third, we perform additional experiments on the GENI testbed to evaluate the scalability of the proposed framework using existing datasets of campus networks. Our results show that up to 95% of attacks in an existing data set can be detected and 99% of malicious source nodes can be blocked automatically. Furthermore, we show that our policy specification language is simpler while offering fast translation times compared to existing solutions.

Monitoring of temporal first-order properties with aggregations

In system monitoring, one is often interested in checking properties of aggregated data. Current policy monitoring approaches are limited in the kinds of aggregations they handle. To rectify this, we extend an expressive language, metric first-order temporal logic, with aggregation operators. Our extension is inspired by the aggregation operators common in database query languages like SQL. We provide a monitoring algorithm for this enriched policy specification language. We show that, in comparison to related data processing approaches, our language is better suited for expressing policies, and our monitoring algorithm has competitive performance.

A Framework and Language Support for Dynamic Security Policy in Service-Oriented Architecture

In today's global network-based environment, where mission-critical applications typically run on highly distributed systems, customers expect reliable, available, and secure services. Supporting security becomes an important issue in service-oriented architecture (SOA). This paper describes how to simultaneously support both dynamic security policies and separation of concerns when developing an SOA application. We propose the DPSL (dynamic policy specification language) for managing and controlling the security according to the dynamic behavior of the workflow in SOA. The operation model is compatible with existing SOA standards, such as the WSDL, WS-Policy, WS-Security- Policy, WS-ReliableMessaging, and the BPEL. As a result, existing standard Web-services engines and BPEL engines can be employed directly to support dynamic policies in SOA. The implementation and experimental results demonstrate the feasibility of the proposed architecture.

Real-Time Verification of Integrity Policies for Distributed Systems

We introduce a mechanism for the verification of real-time integrity policies about the operation of a distributedsystem. Our mechanism is based on Microsoft .NET technologies. Unlike rival competitors, it is not intrusive, as ithardly modifies the source code of any component of the system to be monitored. Our mechanism consists of fourmodules: the specification module, which comes with a security policy specification language, geared towards thecapture of integrity policies; the monitoring module, which includes a code injector, whereby the mechanism observeshow specific methods of the system, referred to by some policy, are invoked; the verifier module, which examines theoperation of the distributed system in order to determine whether is policy compliant or not; and, the reporter module,which notifies the system is policy compliant, or sends an alert upon the occurrence of a contingency, indicating policyviolation. We argue that our mechanism can be framed within the Clark and Wilson security model, and, thus, used torealise information integrity. We illustrate the workings and the power of our mechanism on a simple, but industrialstrength,case study.

Monitoring Data Usage in Distributed Systems

IT systems manage increasing amounts of sensitive data and there is a growing concern that they comply with policies that regulate data usage. In this paper, we use temporal logic to express policies and runtime monitoring to check system compliance. While well-established methods for monitoring linearly ordered system behavior exist, a major challenge is monitoring distributed and concurrent systems where actions are locally observed in the different system parts. These observations can only be partially ordered, while policy compliance may depend on the actions' actual order of appearance. Technically speaking, it is in general intractable to check compliance of partially ordered traces. We identify fragments of our policy specification language for which compliance can be checked efficiently, namely, by monitoring a single representative trace in which the observed actions are totally ordered. Through a case study we show that the fragments are capable of expressing nontrivial policies and that monitoring representative traces is feasible on real-world data.

Reasoning about delegation and revocation schemes in answer set programming

In this article we show how to model a range of notions in the context of delegation and revocation applied to security scenarios. We demonstrate how a range of delegation–revocation models and policies may be represented in pictorial form and formally represented in terms of reactive Kripke models and a first-order policy specification language. We translate first-order representations of our reactive Kripke models into an equivalent Answer Set Programming form that enables users to apply flexibly well-defined definitions of predicates to represent their requirements in terms of delegation–revocation policy specification.

A location-based policy-specification language for mobile devices

The dramatic rise in mobile applications has greatly increased threats to the security and privacy of users. Security mechanisms on mobile devices are currently limited, so users need more expressive ways to ensure that downloaded mobile applications do not act maliciously. Policy-specification languages were created for this purpose; they allow the enforcement of user-defined policies on third-party applications. We have implemented LoPSiL, a location-based policy-specification language for mobile devices. This article describes LoPSiL’s design and implementation, several example policies, and experiments that demonstrate LoPSiL’s viability for enforcing policies on mobile devices.

Design and Evaluation of XACML Conflict Policies Detection Mechanism

The evolution of distributed computing technologies like grid computing, peer-to-peer computing, pervasive computing, ubiquitous computing, autonomic computing, cloud computing etc. has led to the development of complex virtual systems. These systems enable sharing of resources and services distributed over geographically dispersed, heterogeneous, autonomous administrative domains and allow one to efficiently perform a compute or storage intensive task by harnessing the features available over other domains. The resources and services provided by service providers are generally protected by complex access control policies. These access control policies are expressed using policy specification languages. One of the popular, exhaustive and feature rich access control policy specification language is XACML, which is an OASIS standard also. The XACML policies are specified either manually or using automated XACML policy specification tools. Among major problems that policy administrators face is the problem of conflict policies. Conflict policies can have serious consequences and may lead to unauthorized access. This paper presents the design, implementation and evaluation of a conflict policy detection mechanism that can be used by policy administrators to proactively detect conflict XACML policies present in a policy database. This saves administrators and initiators of job from unnecessary problems arising due to presence of conflicts. The mechanism presented is simple, scalable, efficient and can be used to detect policies conflicting with respect to subject, resource, and action attributes. The mechanism has been evaluated by simulating a distributed policy based authorization and XACML access control system. A number of conflict policies of different nature have been injected in the policy database and conflicts have been identified through proposed XACML conflict policy detection algorithm. The implementation results show that the mechanism efficiently detects conflict policies having conflicts with respect to subject, resource and action attributes. This demonstrates that the approach is workable and can be used to detect conflict policies among a set of XACML policies.

On usage control for GRID systems

This paper introduces a formal model, an architecture and a prototype implementation for usage control on GRID systems. The usage control model (UCON) is a new access control paradigm proposed by Park and Sandhu that encompasses and extends several existing models (e.g. MAC, DAC, Bell-Lapadula, RBAC, etc.). Its main novelty is based on continuity of the access monitoring and mutability of attributes of subjects and objects. We identified this model as a perfect candidate for managing access/usage control in GRID systems due to their peculiarities, where continuity of control is a central issue. Here we adapt the original UCON model to develop a full model for usage control in GRID systems. We use as policy specification language a process description language and show how this is suitable to model the usage policy models of the original UCON model. We also describe a possible architecture to implement the usage control model. Moreover, we describe a prototype implementation for usage control of GRID computational services, and we show how our language can be used to define a security policy that regulates the usage of network communications to protect the local computational service from the applications that are executed on behalf of remote GRID users.

A Meta-model of Access Control in a Fibred Security Language

The issue of representing access control requirements continues to demand significant attention. The focus of researchers has traditionally been on developing particular access control models and policy specification languages for particular applications. However, this approach has resulted in an unnecessary surfeit of models and languages. In contrast, we describe a general access control model and a logic-based specification language from which both existing and novel access control models may be derived as particular cases and from which several approaches can be developed for domain-specific applications. We will argue that our general framework has a number of specific attractions and an implication of our work is to encourage a methodological shift from a study of the particulars of access control to its generalities.

Specifying and Enforcing High-Level Semantic Obligation Policies

Obligation policies specify management actions that must be performed when a particular kind of event occurs and certain conditions are satisfied. Large scale distributed systems often produce event streams containing large volumes of low-level events. In many cases, these streams also contain multimedia data (consisting of text, audio or video). Hence, a key challenge is to allow policy writers to specify obligation policies based on high-level events, that may be derived after performing appropriate processing on raw, low-level events. In this paper, we propose a semantic obligation policy specification language called Eagle, which is based on patterns of high-level events, represented as RDF graph patterns. Our policy enforcement architecture uses a compiler that builds a workflow for producing a stream of events, which match the high-level event pattern specified in a policy. This workflow consists of a number of event sources and event processing components, which are described semantically. We present the policy language and enforcement architecture in this paper.

ConSpec — A formal language for policy specification

The paper presents ConSpec, an automata-based policy specification language. The language trades off clean semantics to language expressiveness; a formal semantics for the language is provided as security automata. ConSpec specifications can be used at different stages of the application lifecycle, rendering possible the formalization of various policy enforcement techniques.