[Paper Review] Event Systems and Access Control

Domingo Mery, Stephan Merz|arXiv (Cornell University)|Apr 21, 2006

Access Control and Trust18 references3 citations

TL;DR

This paper proposes a formal framework for specifying and verifying access control policies—permissions, prohibitions, obligations, and user rights—within event systems using temporal logic. It introduces proof rules for verifying policy enforcement and establishes conditions for preserving user rights during system refinement by combining low-level rights and system obligations.

ABSTRACT

We consider the interpretations of notions of access control (permissions, interdictions, obligations, and user rights) as run-time properties of information systems specified as event systems with fairness. We give proof rules for verifying that an access control policy is enforced in a system, and consider preservation of access control by refinement of event systems. In particular, refinement of user rights is non-trivial; we propose to combine low-level user rights and system obligations to implement high-level user rights.

Motivation & Objective

• To bridge the gap between static access control models and dynamic system behavior by formalizing access control as run-time properties of event systems.
• To enable verification of whether a system enforces a given access control policy through formal proof rules grounded in temporal logic.
• To address the challenge of preserving user rights during system refinement, which is non-trivial due to changes in atomicity and system structure.
• To propose a combined approach using concrete-level user rights and system obligations to ensure high-level user rights are preserved across refinements.
• To demonstrate the feasibility of the approach through a running example of a loan management system with varying access control requirements.

Proposed method

• Model information systems as event systems with fairness conditions, where system states and transitions are formally specified using before-after predicates and fairness constraints.
• Interpret permissions and prohibitions as safety properties expressed as constraints on event enabling conditions in temporal logic.
• Model obligations as liveness properties in linear temporal logic (LTL), ensuring that certain events eventually occur under specified conditions.
• Define user rights as branching properties, representing the ability of a subject to initiate a sequence of events leading to a desired outcome.
• Introduce a refinement condition combining concrete-level user rights and system obligations to ensure high-level user rights are preserved during refinement.
• Use proof rules based on standard event system verification techniques to formally verify that access control policies are enforced in both abstract and concrete system models.

Experimental results

Research questions

• RQ1 How can access control policies—especially permissions, prohibitions, obligations, and user rights—be formally specified as dynamic properties of event system runs?
• RQ2 What proof rules can be established to verify that a system implementation enforces a given access control policy?
• RQ3 How can obligations be formally interpreted and verified within the event system framework using temporal logic?
• RQ4 What conditions ensure that user rights are preserved during system refinement, especially when the granularity of atomicity changes?
• RQ5 Can a combination of concrete-level rights and system obligations be used to synthesize high-level user rights in refined systems?

Key findings

• Permissions and prohibitions are successfully formalized as safety properties over event system runs, and their preservation under refinement is guaranteed by standard refinement theory.
• Obligations are effectively modeled as liveness properties in linear temporal logic, ensuring that required actions eventually occur when preconditions are met.
• User rights, as branching properties, are not preserved by standard refinement; additional conditions are required to ensure their preservation across refinement steps.
• The proposed condition combining concrete-level user rights and system obligations ensures that high-level user rights are preserved during refinement, as demonstrated in the loan management system example.
• The framework successfully prevents unintended behaviors such as a client circumventing a payment limit by making multiple requests, as the system's obligation to approve extra payments ceases once the limit is reached.
• The approach enables formal verification of access control policies in dynamic systems, offering a foundation for integrating access control specifications with formal development methods based on event systems and refinement.