Reseña: The Unified Policy Framework (UPF)
Se ha publicado un artículo de razonamiento formalizado en Isabelle sobre seguridad titulado The Unified Policy Framework (UPF)
Sus autores son
- Achim D. Brucker (de SAP SE).
- Lukas Brügger (del ETH Zürich) y
- Burkhart Wolff (de la University Paris-Sud (Orsay))
Su resumen es
We present the Unified Policy Framework (UPF), a generic framework for modelling security (access-control) policies. UPF emphasizes the view that a policy is a policy decision function that grants or denies access to resources, permissions, etc. In other words, instead of modelling the relations of permitted or prohibited requests directly, we model the concrete function that implements the policy decision point in a system. In more detail, UPF is based on the following four principles: 1) Functional representation of policies, 2) No conflicts are possible, 3) Three-valued decision type (allow, deny, undefined), 4) Output type not containing the decision only.
El marco en el que se apoya el trabajo se presenta en la tesis de Lukas Brügger A framework for modelling and testing of security policies.
El trabajo se ha publicado en The Archive of Formal Proofs.
El código de las correspondientes teorías en Isabelle se encuentra aquí.