2013 IEEE 26th Computer Security Foundations Symposium (CSF) (2013)
New Orleans, LA, USA
June 26, 2013 to June 28, 2013
DOI Bookmark: http://doi.ieeecomputersociety.org/10.1109/CSF.2013.17
Access control schemes come in all shapes and sizes, which makes choosing the right one for a particular application a challenge. Yet today's techniques for comparing access control schemes completely ignore the setting in which the scheme is to be deployed. In this paper, we present a formal framework for comparing access control schemes with respect to a particular application. The analyst's main task is to evaluate an access control scheme in terms of how well it implements a given access control workload (a formalism that we introduce to represent an application's access control needs). One implementation is better than another if it has stronger security guarantees, and in this paper we introduce several such guarantees: correctness, homomorphism, AC-preservation, safety, administration-preservation, and compatibility. The scheme that admits the implementation with the strongest guarantees is deemed the best fit for the application. We demonstrate the use of our framework by evaluating two workloads on ten different access control schemes.
authorisation, task analysis
T. L. Hinrichs, D. Martinoia, W. C. III, A. J. Lee, A. Panebianco and L. Zuck, "Application-Sensitive Access Control Evaluation Using Parameterized Expressiveness," 2013 IEEE 26th Computer Security Foundations Symposium (CSF), New Orleans, LA, USA, 2013, pp. 145-160.