oa Repairing Access Control Configurations via Answer Set Programming

Although various access control models have been proposed, access control configurations are error prone. There is no assurance of the correctness of access control configurations. When we find errors in an access control configuration, we take immediate actions to repair the configuration. The repairing is difficult, largely because arbitrary changes to the configuration may result in no less threat than errors do. In other words, constraints are placed on the repaired configuration. The presence of constraints makes a manual error-and-trial approach less attractive. There are two main shortcomings with the manual approach. Firstly, it is not clear whether the objectives are reachable at all; if not, we waste time trying to repair an error prone configuration. Secondly, we have no knowledge of the quality of the solution such as correctness of the repair.

In order to address these shortcomings, we aim to develop an automated approach to the repairing task of access control configurations. We have utilized answer set programming (ASP), a declarative knowledge representation paradigm, to support such an automated approach. The rich modeling language of ASP enables us to capture and express the repairing objectives and the constraints. In our approach, the repairing instance is translated into an ASP, and the ASP solvers are invoked to evaluate it.

Although the applications of ASP follow the general “encode-compute-extract” approach, they differ in the representations of the problems in ASP. In our case, there are two principal factors which render the proposed problem and approach non-trivial. Firstly, we need to identify constraints which are not only amendable to ASP interpretation, but also expressive enough to capture common idioms of security and business requirements; there is a trade-off to make. Secondly, our ASP programs should model the quality measure of repairs—when more than one repair is possible, the reported one is optimized in terms of the quality measure. We have also undertaken extensive experiments on both real-world and synthetic data-sets. The experiment results validate the effectiveness and efficiency of the automated approach.