Abstract:Manually generating access control policies from an organization's high-level requirement specifications poses significant challenges. It requires laborious efforts to sift through multiple documents containing such specifications and translate their access requirements into access control policies. Also, the complexities and ambiguities of these specifications often result in errors by system administrators during the translation process, leading to data breaches. However, the automated policy generation frameworks designed to help administrators in this process are unreliable due to limitations, such as the lack of domain adaptation. Therefore, to improve the reliability of access control policy generation, we propose RAGent, a novel retrieval-based access control policy generation framework based on language models. RAGent identifies access requirements from high-level requirement specifications with an average state-of-the-art F1 score of 87.9%. Through retrieval augmented generation, RAGent then translates the identified access requirements into access control policies with an F1 score of 77.9%. Unlike existing frameworks, RAGent generates policies with complex components like purposes and conditions, in addition to subjects, actions, and resources. Moreover, RAGent automatically verifies the generated policies and iteratively refines them through a novel verification-refinement mechanism, further improving the reliability of the process by 3%, reaching the F1 score of 80.6%. We also introduce three annotated datasets for developing access control policy generation frameworks in the future, addressing the data scarcity of the domain.

Automatic XACML Requests Generation for Testing Access Control Policies.

Toward Systematic Testing of Access Control Policies

Automated Test Generation for Access Control Policies Via Change-Impact Analysis

Defining and Measuring Policy Coverage in Testing Access Control Policies.

Multiple-implementation testing for XACML implementations.

Designing Fast and Scalable XACML Policy Evaluation Engines

Conformance Checking of Access Control Policies Specified in XACML

Xengine: A Fast And Scalable Xacml Policy Evaluation Engine

On-line tracing of XACML-based policy coverage criteria

A Fault Model and Mutation Testing of Access Control Policies

Automated Extraction of Security Policies from Natural-Language Software Documents

Testing Access Control Policies

Using XACML to Define Access Control Policy in Information System

Security policy testing via automated program code generation

Inferring Access-Control Policy Properties via Machine Learning

ACPT: A Tool for Modeling and Verifying Access Control Policies

Detection of Multiple-Duty-Related Security Leakage in Access Control Policies

Exploring Critical Testing Scenarios for Decision-Making Policies: An LLM Approach

Automatic Policy Generation for Inter-Service Access Control of Microservices

RAGent: Retrieval-based Access Control Policy Generation

XUAT-Copilot: Multi-Agent Collaborative System for Automated User Acceptance Testing with Large Language Model