Abstract:Manually generating access control policies from an organization's high-level requirement specifications poses significant challenges. It requires laborious efforts to sift through multiple documents containing such specifications and translate their access requirements into access control policies. Also, the complexities and ambiguities of these specifications often result in errors by system administrators during the translation process, leading to data breaches. However, the automated policy generation frameworks designed to help administrators in this process are unreliable due to limitations, such as the lack of domain adaptation. Therefore, to improve the reliability of access control policy generation, we propose RAGent, a novel retrieval-based access control policy generation framework based on language models. RAGent identifies access requirements from high-level requirement specifications with an average state-of-the-art F1 score of 87.9%. Through retrieval augmented generation, RAGent then translates the identified access requirements into access control policies with an F1 score of 77.9%. Unlike existing frameworks, RAGent generates policies with complex components like purposes and conditions, in addition to subjects, actions, and resources. Moreover, RAGent automatically verifies the generated policies and iteratively refines them through a novel verification-refinement mechanism, further improving the reliability of the process by 3%, reaching the F1 score of 80.6%. We also introduce three annotated datasets for developing access control policy generation frameworks in the future, addressing the data scarcity of the domain.

Automated Test Generation for Access Control Policies Via Change-Impact Analysis

Automatic XACML Requests Generation for Testing Access Control Policies.

Toward Systematic Testing of Access Control Policies

Defining and Measuring Policy Coverage in Testing Access Control Policies.

Security policy testing via automated program code generation

A Fault Model and Mutation Testing of Access Control Policies

Testing Access Control Policies

On-line tracing of XACML-based policy coverage criteria

RAGent: Retrieval-based Access Control Policy Generation

ACPT: A Tool for Modeling and Verifying Access Control Policies

Selective Regression Test for Access Control System Employing RBAC

Conformance Checking of Access Control Policies Specified in XACML

Exploring Critical Testing Scenarios for Decision-Making Policies: An LLM Approach

Automated Extraction of Security Policies from Natural-Language Software Documents

Inferring Access-Control Policy Properties via Machine Learning

An Automated Test Generation Technique for Software Quality Assurance

Automated Analysis of Scenario-based Specifications of Distributed Access Control Policies with Non-Mechanizable Activities (Extended Version)

A Methodology for Automating Assurance Case Generation

Guided test generation for coverage criteria

Multiple-implementation testing for XACML implementations.

Generating Stack-based Access Control Policies