Shriram Krishnamurthi Brown University Policy Languages Shriram Krishnamurthi Brown University

Designated TAs can write homework grades Delegation Designated TAs can write homework grades Separation of Duty Creating a course requires authorization from two distinct people Information Filtering Professor group gets network priority Mon 12-1 Information Flow One student cannot learn another's grade information Composition Department's building access rules override the university's Administrative Nobody can change their own privileges Obligation TAs who check out assignment blocks must submit grades for them Authorization A professor can modify grades

<Policy PolicyId="SamplePolicy" RuleCombiningAlgId=”…s:names:tc:xacml:1.0:rule-combining-algorithm:permit-overrides"> <Target> <Subjects> <AnySubject/> </Subjects> <Resources> <ResourceMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal"> <AttributeValue DataType=“…/XMLSchema#string">SampleServer</AttributeValue> <ResourceAttributeDesignator DataType=”….w3.org/2001/XMLSchema#string" AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id"/> </ResourceMatch> </Resources> <Actions> <AnyAction/> </Actions> </Target> …

hostname int interface in_dmz ip address 10.1.1.1 255.255.255.0 ip nat outside interface in_lan ip access-group 102 in ip address 192.168.1.1 255.255.0.0 ip nat inside access-list 102 deny ip 192.168.4.1 0.0.0.255 host 10.1.1.3 access-list 102 permit tcp any host 10.1.1.3 eq 25 access-list 102 permit tcp any any eq 80 access-list 102 deny any ip nat inside source list 1 interface in_dmz overload ip route 0.0.0.0 0.0.0.0 10.1.1.2 access-list 1 permit 192.168.1.1 0.0.255.255

Independent Composition faculty (s)  Permit(s, grades, assign) student(s)  -Permit(s, grades, assign) -faculty(s)  Permit(s, course, enroll) Safety Independent Composition Monotonicity

System Structure

System Structure = +

Access-Control Policies Policy maps requests to decisions: <subject, action, resource> g {permit, deny} Depends on the domain role not-applicable First-applicable, Permit-overrides, Deny-overrides university policy on building access department policy: undergrad TAs get night access

System Structure = +

Good Verification Target Sub-Turing-complete languages High-level operators Not very large programs Accessible to non-technical users

What Makes This Domain Hard/Interesting?

Program or Property? The balance between enforcement and verification

A professor can modify grades Delegation Authorization A professor can modify grades Delegation Designated TAs can write homework grades Information Filtering Professor group gets network priority Mon 12-1 Composition Department's building access rules override the university's Information Flow One student cannot learn another's grade information Administrative Nobody can change their own privileges Separation of Duty Creating a course requires authorization from two distinct people Obligation TAs who check out assignment blocks must submit grades for them

Linking Ontologies

A professor can modify grades Authorization A professor can modify grades Delegation Designated TAs can write homework grades Information Filtering Professor group gets network priority Mon 12-1 Composition Department's building access rules override the university's

Dynamics

Dynamic/Temporal Policies Coarse-grained: Fine-grained: Don’t allow access to a paper’s other reviews until the PC member has submitted their own review Submit Review Meet Respond

Mutual Dependence

func UploadReview(a, p) { if Permit == CheckReq (a,submit-review,p) Reviews := Review U (a, p) …} During submission phase, author may submit a paper During review phase, a reviewer r may submit review for paper p if r is assigned to p ….

What is the State Space?

⊨ Access Control ⊨ Business Rules ⊨ ⊨ ⊨