CSC News

Out of Sight, Not Out of Mines

Source - CD Tracks, Fermi National Accelerator Laboratory, May 2010

“Mining Likely Properties of Access Control Policies via Association Rule Mining," a paper by graduate student JeeHyun Hwang and Dr. Tao Xie, associate professor in the Computer Science Department at NC State University, Vincent Hu from the Institute of Standards and Technology, and Mine Altunay from Fermi National Accelerator Laboratory (Fermilab), was published in the Proceedings of the 24th Annual IFIP WG 11.3 Working Conference that took place in Rome on June 21-23, 2010. JeeHyun, a PhD candidate at NC State, completed an internship with Mine at Fermilab last summer.  

The paper discusses the authors' approach to automatically mine likely properties from an access security policy by a technique called association rule mining. 

Access control mechanisms control which users or processes have access to which resources in a system. Database management systems often use access control mechanisms to offer fine-grained access control to sensitive resources based on policies. In such situations, identifying discrepancies between policies and their intended function is crucial because these discrepancies may cause unexpected behaviors, such as exposing security vulnerabilities by giving malicious users access to sensitive resources.

To ensure that policies are correct, policy authors check whether certain properties are satisfied by the policy. If a property is violated, a property verification tool produces counterexamples that lead to property violations and restrict the user or process. But writing these properties is not a trivial task. Policy authors must not only have sufficient knowledge of a given policy to identify its properties, but as the policy's size increases and its structure becomes more complex, identifying its properties becomes more challenging. 

To facilitate property verification, the researchers have developed a method that automatically mines the policy for likely properties---properties that are true for most, but not all of the policies---via association rule mining. Behaviors that don't satisfy likely properties then undergo verification to produce counterexamples to help authors identify faulty policy rules.

JeeHyun and his colleagues tested four different XACML policies and showed a higher fault-detection capability than that of an existing approach by over 30 percent. 

For more information on the collaborative project on testing and verification of security policies, click here.

###