Towards quantitative analysis of proofs of authorization: Applications, framework, and techniques

J. Lee Adam, Ting Yu

Research output: Chapter in Book/Report/Conference proceedingConference contribution

2 Citations (Scopus)

Abstract

Although policy compliance testing is generally treated as a binary decision problem, the evidence gathered during the trust management process can actually be used to examine these outcomes within a more continuous space. In this paper, we develop a formal model that allows us to quantitatively reason about the outcomes of the policy enforcement process in both absolute (i.e., user to ideal case) and relative (i.e., user to user) terms. Within this framework, it becomes possible to quantify, e.g., the robustness of a user's proof of authorization to possible perturbations in the system, how close an unauthorized user is to satisfying a particular policy, and relative "top-k" style rankings of the best users to carry out a particular task. To this end, we explore several interesting classes of scoring functions for assessing the robustness of authorization decisions, and develop criteria under which these types of functions can be composed with one another. We further show that these types of functions can be extended to quantify how close unauthorized users are to satisfying policies, which can be a useful risk metric for decision making under unexpected circumstances.

Original languageEnglish
Title of host publicationProceedings - IEEE Computer Security Foundations Symposium
Pages139-153
Number of pages15
DOIs
Publication statusPublished - 11 Oct 2010
Externally publishedYes
Event23rd Computer Security Foundations Symposium, CSF 2010 - Edinburgh, United Kingdom
Duration: 17 Jul 201019 Jul 2010

Other

Other23rd Computer Security Foundations Symposium, CSF 2010
CountryUnited Kingdom
CityEdinburgh
Period17/7/1019/7/10

    Fingerprint

Keywords

  • Access control
  • Policy
  • Risk
  • Trust management

ASJC Scopus subject areas

  • Engineering(all)

Cite this

Adam, J. L., & Yu, T. (2010). Towards quantitative analysis of proofs of authorization: Applications, framework, and techniques. In Proceedings - IEEE Computer Security Foundations Symposium (pp. 139-153). [5552647] https://doi.org/10.1109/CSF.2010.17