1. Shriram Krishnamurthi Brown University
Policy Languages
Shriram Krishnamurthi
Brown University

3. Designated TAs can write homework grades
Delegation
Designated TAs can write homework grades
Separation of Duty
Creating a course requires authorization from two distinct people
Information Filtering
Professor group gets network priority Mon 12-1
Information Flow
One student cannot learn another's grade information
Composition
Department's building access rules override the university's
Administrative
Nobody can change their own privileges
Obligation
TAs who check out assignment blocks must submit grades for them
Authorization
A professor can modify grades

4. <Policy PolicyId="SamplePolicy"
RuleCombiningAlgId=”…s:names:tc:xacml:1.0:rule-combining-algorithm:permit-overrides">
<Target>
<Subjects>
<AnySubject/>
</Subjects>
<Resources>
<ResourceMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
<AttributeValue DataType=“…/XMLSchema#string">SampleServer</AttributeValue>
<ResourceAttributeDesignator DataType=”….w3.org/2001/XMLSchema#string"
AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id"/>
</ResourceMatch>
</Resources>
<Actions>
<AnyAction/>
</Actions>
</Target> …

5. hostname int
interface in_dmz
ip address
ip nat outside
interface in_lan
ip access-group 102 in
ip address
ip nat inside
access-list 102 deny ip host
access-list 102 permit tcp any host eq 25
access-list 102 permit tcp any any eq 80
access-list 102 deny any
ip nat inside source list 1 interface in_dmz overload
ip route
access-list 1 permit

6. Independent Composition
faculty (s)  Permit(s, grades, assign)
student(s)  -Permit(s, grades, assign)
-faculty(s)  Permit(s, course, enroll)
Safety
Independent Composition
Monotonicity

7. System Structure

8. System Structure = +

9. Access-Control Policies
Policy maps requests to decisions:
<subject, action, resource> g {permit, deny}
Depends on the domain
role
not-applicable
First-applicable, Permit-overrides, Deny-overrides
university policy on building access
department policy:
undergrad TAs get night access

10. System Structure = +

11. Good Verification Target
Sub-Turing-complete languages High-level operators Not very large programs Accessible to non-technical users

12. What Makes This Domain Hard/Interesting?

13. Program or Property?
The balance between enforcement and verification

14. A professor can modify grades Delegation
Authorization
A professor can modify grades
Delegation
Designated TAs can write homework grades
Information Filtering
Professor group gets network priority Mon 12-1
Composition
Department's building access rules override the university's
Information Flow
One student cannot learn another's grade information
Administrative
Nobody can change their own privileges
Separation of Duty
Creating a course requires authorization from two distinct people
Obligation
TAs who check out assignment blocks must submit grades for them

15. Linking Ontologies

16. A professor can modify grades
Authorization
A professor can modify grades
Delegation
Designated TAs can write homework grades
Information Filtering
Professor group gets network priority Mon 12-1
Composition
Department's building access rules override the university's

17. Dynamics

18. Dynamic/Temporal Policies
Coarse-grained:
Fine-grained:
Don’t allow access to a paper’s other reviews until the PC member has submitted their own review
Submit
Review
Meet
Respond

19. Mutual Dependence

20. func UploadReview(a, p) { if Permit == CheckReq (a,submit-review,p)
Reviews := Review U (a, p) …}
During submission phase, author may submit a paper
During review phase, a reviewer r may submit review for paper p if r is assigned to p ….

21. What is the State Space?

22. ⊨
Access Control ⊨
Business Rules ⊨ ⊨ ⊨