Automated Access Control Policy Testing System (A-ACPTS)

A-ACPTS Phase 2 transitions NIST Access Control Policy Tool (ACPT) R&D with innovative enhancements into commercialization, developing a commercially successful access control policy testing product that improves access control policy testing (minimizes error potential, faster, more usable, more efficient). A-ACPTS Phase 2 extends ACPT through a number of innovations that improve testing beyond the state of the art, including: (1) A-ACPTS supports the specification of testing properties and policies at a generic, intuitive “high level” of abstraction. With A-ACPTS, testing properties can be automatically verified against the policy even if they are authored using differing attributes. (2) A-ACPTS ingests, analyzes, merges, and normalizes information about the functional environment and flexibly relates access policy testing closer to the actual access control policy implementation on the functional environment. (3) A-ACPTS automatically ingests many information sources required for testing with semantic consistency, so that the policy testing becomes more automated, fast, easy, and correct. (4) A-ACPTS can automatically re-test when the ingested information changes, minimizing re-testing efforts. A-ACPTS has already been partly implemented during Phase 1, and will be rapidly developed towards commercial viability during Phase 2 as both a cloud service (SaaS) and an on-premises installed product based on the Eclipse/OpenPMF platform.