Access Control Policy Tool

Access Control (AC) determines the permission of a request in attempt to access certain resources in a software system. It has been greatly used for financial, security, privacy, safety, defense, and many other applications. However, there is no commercial‐ready tool to conveniently and thoroughly compose, test, and verify the policies against potential vulnerabilities. In this project, InfoBeyond advocates the development of a user‐friendly, efficient, reliable, and generic Access Control Policy modeling, verification, and Testing (ACPT) Tool. Our ACPT enhances the NIST’s ACPT design and add several advanced features for achieving high security confidence AC levels such that it can be commercialized. It provides user‐friendly GUI templates for user to compose attributes, enable property tests by a model checker, perform combinatorial tests, and generate XACMAL policies. It specifically improves the NIST’s ACPT design to provide a robust, unified, and generic model checker in an ABAC (Attributed‐based Access Control) framework. Our ACPT will be developed as a standalone software package and web‐based services. The standalone software package can be run in a private server for government and enterprise customers. The web service design facilitates the ACPT webification and evolution in a distributed computing environment for a large number of customers.