CT-ISG: Collaborative Research: A New Approach to Testing and Verification of Security Policies

CT-ISG：协作研究：安全策略测试和验证的新方法

• 批准号: 0716407
• 负责人: Alex Liu
• 金额: $ 18万
• 依托单位: Michigan State University
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2007
• 资助国家: 美国
• 起止时间: 2007-08-01 至 2013-07-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=0716407&HistoricalAwards=false
• 关键词: CT; ISG; Collaborative; Research; New

Policy-based access control is one of the most fundamental and widely used mechanisms for achieving privacy and security at both application and network levels. Given the high importance and delicacy of security policies, ensuring the correctness of these policies is important, and yet difficult. A tiny error in security policies could lead to irreparable, if not tragic, consequences. Therefore, identifying discrepancies between policy specifications and their intended function is a crucial task. To achieve this goal, this project pursues a new approach to testing and verification of security policies, including application-level security policies (such as XACML policies) and network-level security policies (such as firewall policies). To accomplish this, this project is defining two unified representations for security policies: program code representation and decision tree representation. Second, the project is developing a suite of rigorous and systematic security policy testing techniques. Third, this project is pursuing efficient and scalable verification and change-impact analysis techniques for security policies. Fourth, this project explores methods for testing and verifying stateful security policies. The project is developing frameworks and techniques for testing and verifying both application-level and network-level security policies. The project will also produce concepts and theories that fundamentally advance the knowledge and understanding of security policies. The concepts, theories, algorithms, and tools produced by this NSF-supported research are expected to promote rigorous security policy testing and verification practice, which will lead to better policy quality and higher security assurance in general. Furthermore, the results of this research will enable further innovations in related fields that depend on the correctness of security policy.

基于策略的访问控制是在应用程序和网络级别上实现隐私和安全性的最基本和广泛使用的机制之一。鉴于安全政策的重要性和美味，确保这些政策的正确性很重要，但很困难。安全策略的微小错误可能导致不可弥补的后果，即使不是悲惨的后果。因此，确定政策规范与其预期功能之间的差异是一项至关重要的任务。为了实现这一目标，该项目采用了一种新的方法来测试和验证安全策略，包括应用程序级安全策略（例如XACML策略）和网络级别的安全策略（例如防火墙策略）。为了实现这一目标，该项目正在定义安全策略的两个统一表示：程序代码表示和决策树表示。其次，该项目正在开发一套严格而系统的安全策略测试技术。第三，该项目正在采用高效且可扩展的验证以及对安全策略的变更影响分析技术。第四，该项目探讨了测试和验证状态安全策略的方法。该项目正在开发用于测试和验证应用程序级别和网络级安全策略的框架和技术。该项目还将产生概念和理论，从根本上推进对安全政策的知识和理解。这项由NSF支持的研究产生的概念，理论，算法和工具预计将促进严格的安全政策测试和验证实践，这将带来更好的政策质量和更高的安全保证。此外，这项研究的结果将在相关领域的进一步创新，这些领域取决于安全政策的正确性。