Automated Analysis of Scenario-based Specifications of Distributed Access Control Policies with Non-Mechanizable Activities (Extended Version)

摘要

The advance of web services technologies promises to have far-reachingeffects on the Internet and enterprise networks allowing for greateraccessibility of data. The security challenges presented by the web servicesapproach are formidable. In particular, access control solutions should berevised to address new challenges, such as the need of using certificates forthe identification of users and their attributes, human intervention in thecreation or selection of the certificates, and (chains of) certificates fortrust management. With all these features, it is not surprising that analyzingpolicies to guarantee that a sensitive resource can be accessed only byauthorized users becomes very difficult. In this paper, we present an automatedtechnique to analyze scenario-based specifications of access control policiesin open and distributed systems. We illustrate our ideas on a case studyarising in the e-government area.