Evidence-based Audit

Simple item page
dc.contributor.authorVaughan, Jeffrey A
dc.contributor.authorJia, Limin
dc.contributor.authorMazurak, Karl
dc.contributor.authorZdancewic, Stephan A
dc.date2023-05-17T07:15:34.000
dc.date.accessioned2023-05-22T12:49:42Z
dc.date.available2023-05-22T12:49:42Z
dc.date.issued2008-01-01
dc.date.submitted2012-07-18T10:46:46-07:00
dc.description.abstractAuthorization logics provide a principled and flexible approach to specifying access control policies. One of their compelling benefits is that a proof in the logic is evidence that an access-control decision has been made in accordance with policy. Using such proofs for auditing reduces the trusted computing base and enables the ability to detect flaws in complex authorization policies. Moreover, the proof structure is itself useful, because proof normalization can yield information about the relevance of policy statements. Untrusted, but well-typed, applications that access resources through an appropriate interface must obey the access control policy and create proofs useful for audit. This paper presents AURA, an authorization logic based on a dependently-typed variant of DCC and proves the metatheoretic properties of subject-reduction and normalization. It shows the utility of proof-based auditing in a number of examples and discusses several pragmatic issues that must be addressed in this context.
dc.description.commentsJeffrey A. Vaughan, Limin Jia, Karl Mazurak, and Steve Zdancewic. Evidence-based Audit. In Proc. of 21st IEEE Computer Security Foundations Symposium (CSF), pages 177-191. IEEE Computer Society Press, 2008 © 2011 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works. DOI: http://dx.doi.org/10.1109/CSF.2008.24
dc.identifier.urihttps://repository.upenn.edu/handle/20.500.14332/6646
dc.legacy.articleid1618
dc.legacy.fulltexturlhttps://repository.upenn.edu/cgi/viewcontent.cgi?article=1618&context=cis_papers&unstamped=1
dc.source.issue586
dc.source.journalDepartmental Papers (CIS)
dc.source.statuspublished
dc.subject.otherComputer Sciences
dc.titleEvidence-based Audit
dc.typeWorking Paper
digcom.contributor.authorVaughan, Jeffrey A
digcom.contributor.authorJia, Limin
digcom.contributor.authorMazurak, Karl
digcom.contributor.authorisAuthorOfPublication|email:stevez@cis.upenn.edu|institution:University of Pennsylvania|Zdancewic, Stephan A
digcom.identifiercis_papers/586
digcom.identifier.contextkey3110180
digcom.identifier.submissionpathcis_papers/586
digcom.typeworkingpaper
dspace.entity.typePublication
relation.isAuthorOfPublication6ea801ee-f26c-4409-9cc9-4fef4353d51d
relation.isAuthorOfPublication6ea801ee-f26c-4409-9cc9-4fef4353d51d
relation.isAuthorOfPublication.latestForDiscovery6ea801ee-f26c-4409-9cc9-4fef4353d51d
upenn.schoolDepartmentCenterDepartmental Papers (CIS)
Files
Original bundle
Now showing 1 - 1 of 1
Thumbnail Image
Name:
VJMZ08.pdf
Size:
321.92 KB
Format:
Adobe Portable Document Format
Download
Collection
Working Papers