{"id":"https://openalex.org/W4284675888","doi":"https://doi.org/10.1145/3510003.3510233","title":"Quantifying permissiveness of access control policies","display_name":"Quantifying permissiveness of access control policies","publication_year":2022,"publication_date":"2022-05-21","ids":{"openalex":"https://openalex.org/W4284675888","doi":"https://doi.org/10.1145/3510003.3510233"},"language":"en","primary_location":{"id":"doi:10.1145/3510003.3510233","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3510003.3510233","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3510003.3510233","source":{"id":"https://openalex.org/S4363608872","display_name":"Proceedings of the 44th International Conference on Software Engineering","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 44th International Conference on Software Engineering","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://dl.acm.org/doi/pdf/10.1145/3510003.3510233","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5088950037","display_name":"William Eiers","orcid":"https://orcid.org/0009-0007-0235-2332"},"institutions":[{"id":"https://openalex.org/I2803209242","display_name":"University of California System","ror":"https://ror.org/00pjdza24","country_code":"US","type":"education","lineage":["https://openalex.org/I2803209242"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"William Eiers","raw_affiliation_strings":["University of California"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of California","institution_ids":["https://openalex.org/I2803209242"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5037136651","display_name":"Ganesh Sankaran","orcid":"https://orcid.org/0000-0001-5231-2725"},"institutions":[{"id":"https://openalex.org/I2803209242","display_name":"University of California System","ror":"https://ror.org/00pjdza24","country_code":"US","type":"education","lineage":["https://openalex.org/I2803209242"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Ganesh Sankaran","raw_affiliation_strings":["University of California"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of California","institution_ids":["https://openalex.org/I2803209242"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101761418","display_name":"Albert Li","orcid":"https://orcid.org/0009-0006-6638-917X"},"institutions":[{"id":"https://openalex.org/I2803209242","display_name":"University of California System","ror":"https://ror.org/00pjdza24","country_code":"US","type":"education","lineage":["https://openalex.org/I2803209242"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Albert Li","raw_affiliation_strings":["University of California"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of California","institution_ids":["https://openalex.org/I2803209242"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5070831204","display_name":"Emily O'Mahony","orcid":"https://orcid.org/0000-0003-0894-9774"},"institutions":[{"id":"https://openalex.org/I2803209242","display_name":"University of California System","ror":"https://ror.org/00pjdza24","country_code":"US","type":"education","lineage":["https://openalex.org/I2803209242"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Emily O'Mahony","raw_affiliation_strings":["University of California"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of California","institution_ids":["https://openalex.org/I2803209242"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5003352860","display_name":"Benjamin Prince","orcid":null},"institutions":[{"id":"https://openalex.org/I2803209242","display_name":"University of California System","ror":"https://ror.org/00pjdza24","country_code":"US","type":"education","lineage":["https://openalex.org/I2803209242"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Benjamin Prince","raw_affiliation_strings":["University of California"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of California","institution_ids":["https://openalex.org/I2803209242"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5039991493","display_name":"Tevfik Bultan","orcid":"https://orcid.org/0000-0003-2993-1215"},"institutions":[{"id":"https://openalex.org/I2803209242","display_name":"University of California System","ror":"https://ror.org/00pjdza24","country_code":"US","type":"education","lineage":["https://openalex.org/I2803209242"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Tevfik Bultan","raw_affiliation_strings":["University of California"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of California","institution_ids":["https://openalex.org/I2803209242"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I2803209242"],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":18,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"1805","last_page":"1817"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10927","display_name":"Access Control and Trust","score":0.9993000030517578,"subfield":{"id":"https://openalex.org/subfields/3312","display_name":"Sociology and Political Science"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},"topics":[{"id":"https://openalex.org/T10927","display_name":"Access Control and Trust","score":0.9993000030517578,"subfield":{"id":"https://openalex.org/subfields/3312","display_name":"Sociology and Political Science"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9968000054359436,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.9901000261306763,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/access-control","display_name":"Access control","score":0.7235870361328125},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7224181890487671},{"id":"https://openalex.org/keywords/permissiveness","display_name":"Permissiveness","score":0.6154357194900513},{"id":"https://openalex.org/keywords/confidentiality","display_name":"Confidentiality","score":0.5833192467689514},{"id":"https://openalex.org/keywords/policy-analysis","display_name":"Policy analysis","score":0.5539490580558777},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.528924822807312},{"id":"https://openalex.org/keywords/heuristic","display_name":"Heuristic","score":0.4623715877532959},{"id":"https://openalex.org/keywords/security-policy","display_name":"Security policy","score":0.4289032220840454},{"id":"https://openalex.org/keywords/outsourcing","display_name":"Outsourcing","score":0.4211837649345398},{"id":"https://openalex.org/keywords/constraint","display_name":"Constraint (computer-aided design)","score":0.4184764325618744},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.18068969249725342},{"id":"https://openalex.org/keywords/law","display_name":"Law","score":0.12381091713905334},{"id":"https://openalex.org/keywords/engineering","display_name":"Engineering","score":0.10579416155815125}],"concepts":[{"id":"https://openalex.org/C527821871","wikidata":"https://www.wikidata.org/wiki/Q228502","display_name":"Access control","level":2,"score":0.7235870361328125},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7224181890487671},{"id":"https://openalex.org/C2777890099","wikidata":"https://www.wikidata.org/wiki/Q7169345","display_name":"Permissiveness","level":4,"score":0.6154357194900513},{"id":"https://openalex.org/C71745522","wikidata":"https://www.wikidata.org/wiki/Q2476929","display_name":"Confidentiality","level":2,"score":0.5833192467689514},{"id":"https://openalex.org/C123587114","wikidata":"https://www.wikidata.org/wiki/Q2101508","display_name":"Policy analysis","level":2,"score":0.5539490580558777},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.528924822807312},{"id":"https://openalex.org/C173801870","wikidata":"https://www.wikidata.org/wiki/Q201413","display_name":"Heuristic","level":2,"score":0.4623715877532959},{"id":"https://openalex.org/C154908896","wikidata":"https://www.wikidata.org/wiki/Q2167404","display_name":"Security policy","level":2,"score":0.4289032220840454},{"id":"https://openalex.org/C46934059","wikidata":"https://www.wikidata.org/wiki/Q61515","display_name":"Outsourcing","level":2,"score":0.4211837649345398},{"id":"https://openalex.org/C2776036281","wikidata":"https://www.wikidata.org/wiki/Q48769818","display_name":"Constraint (computer-aided design)","level":2,"score":0.4184764325618744},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.18068969249725342},{"id":"https://openalex.org/C199539241","wikidata":"https://www.wikidata.org/wiki/Q7748","display_name":"Law","level":1,"score":0.12381091713905334},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.10579416155815125},{"id":"https://openalex.org/C17744445","wikidata":"https://www.wikidata.org/wiki/Q36442","display_name":"Political science","level":0,"score":0.0},{"id":"https://openalex.org/C140704245","wikidata":"https://www.wikidata.org/wiki/Q3933202","display_name":"Viral replication","level":3,"score":0.0},{"id":"https://openalex.org/C81885089","wikidata":"https://www.wikidata.org/wiki/Q189082","display_name":"Cell culture","level":2,"score":0.0},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.0},{"id":"https://openalex.org/C78519656","wikidata":"https://www.wikidata.org/wiki/Q101333","display_name":"Mechanical engineering","level":1,"score":0.0},{"id":"https://openalex.org/C54355233","wikidata":"https://www.wikidata.org/wiki/Q7162","display_name":"Genetics","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3510003.3510233","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3510003.3510233","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3510003.3510233","source":{"id":"https://openalex.org/S4363608872","display_name":"Proceedings of the 44th International Conference on Software Engineering","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 44th International Conference on Software Engineering","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.1145/3510003.3510233","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3510003.3510233","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3510003.3510233","source":{"id":"https://openalex.org/S4363608872","display_name":"Proceedings of the 44th International Conference on Software Engineering","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 44th International Conference on Software Engineering","raw_type":"proceedings-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G200098691","display_name":null,"funder_award_id":"CCF-1901098, CCF-1817242","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G2014798942","display_name":"Collaborative Research: SHF: Small: Automated Quantitative Assessment of Testing Difficulty","funder_award_id":"2008660","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G3850684886","display_name":"SHF: Medium: Collaborative Research: HUGS: Human-Guided Software Testing and Analysis for Scalable Bug Detection and Repair","funder_award_id":"1901098","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G417020745","display_name":null,"funder_award_id":"CCF-1901098","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G4242646364","display_name":"SHF: Small: Differential Policy Verification and Repair for Access Control in the Cloud","funder_award_id":"1817242","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G4294274658","display_name":null,"funder_award_id":"CCF-2008660","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G5936121604","display_name":null,"funder_award_id":"CCF-2008660, CCF-1901098, CCF-1817242","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"}],"funders":[{"id":"https://openalex.org/F4320306076","display_name":"National Science Foundation","ror":"https://ror.org/021nxhr62"}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4284675888.pdf","grobid_xml":"https://content.openalex.org/works/W4284675888.grobid-xml"},"referenced_works_count":39,"referenced_works":["https://openalex.org/W1023119160","https://openalex.org/W1480909796","https://openalex.org/W1545038039","https://openalex.org/W1599739130","https://openalex.org/W1980694458","https://openalex.org/W1997199359","https://openalex.org/W2007237548","https://openalex.org/W2007842496","https://openalex.org/W2012419258","https://openalex.org/W2025704776","https://openalex.org/W2033084216","https://openalex.org/W2033182255","https://openalex.org/W2038997378","https://openalex.org/W2060573639","https://openalex.org/W2064070192","https://openalex.org/W2084621663","https://openalex.org/W2124694173","https://openalex.org/W2128325590","https://openalex.org/W2130308071","https://openalex.org/W2130514924","https://openalex.org/W2132218308","https://openalex.org/W2138224468","https://openalex.org/W2145587189","https://openalex.org/W2147050153","https://openalex.org/W2154061425","https://openalex.org/W2156585713","https://openalex.org/W2162720432","https://openalex.org/W2164950969","https://openalex.org/W2511961348","https://openalex.org/W2546922927","https://openalex.org/W2615071493","https://openalex.org/W2617837836","https://openalex.org/W2725449579","https://openalex.org/W2899008271","https://openalex.org/W2908957302","https://openalex.org/W3032535963","https://openalex.org/W3108419307","https://openalex.org/W4239249613","https://openalex.org/W4243905521"],"related_works":["https://openalex.org/W2393973626","https://openalex.org/W2107355607","https://openalex.org/W2105261429","https://openalex.org/W2012419258","https://openalex.org/W318167434","https://openalex.org/W1482564230","https://openalex.org/W4285408982","https://openalex.org/W2127259385","https://openalex.org/W2004929657","https://openalex.org/W4238719493"],"abstract_inverted_index":{"Due":[0],"to":[1,54,60,65,146],"ubiquitous":[2],"use":[3],"of":[4,10,35,102,109,140],"software":[5],"services,":[6],"protecting":[7,33],"the":[8,99,132,138],"confidentiality":[9,34],"private":[11],"information":[12],"stored":[13],"in":[14,46,149],"compute":[15],"clouds":[16],"is":[17,90],"becoming":[18],"an":[19],"increasingly":[20],"critical":[21],"problem.":[22],"Although":[23],"access":[24,64,103,126],"control":[25,104,127],"specification":[26],"languages":[27],"and":[28,39,62,78,129,153,159],"libraries":[29],"provide":[30],"mechanisms":[31],"for":[32],"information,":[36],"without":[37],"verification":[38],"validation":[40],"techniques":[41],"that":[42,57,83,121],"can":[43,58],"assist":[44],"developers":[45],"writing":[47],"policies,":[48],"complex":[49],"policy":[50,80,89,157,162],"specifications":[51],"are":[52],"likely":[53],"have":[55],"errors":[56],"lead":[59],"unintended":[61],"unauthorized":[63],"data,":[66],"possibly":[67],"with":[68],"disastrous":[69],"consequences.":[70],"In":[71],"this":[72],"paper,":[73],"we":[74],"present":[75,118],"a":[76,112,119],"quantitative":[77],"differential":[79],"analysis":[81],"framework":[82],"not":[84],"only":[85],"identifies":[86],"if":[87],"one":[88],"more":[91],"permissive":[92],"than":[93],"another":[94],"policy,":[95],"but":[96],"also":[97],"quantifies":[98],"relative":[100],"permissiveness":[101,108],"policies.":[105],"We":[106,117,136],"quantify":[107],"policies":[110,128,147],"using":[111],"model":[113,133],"counting":[114,134],"constraint":[115],"solver.":[116],"heuristic":[120],"transforms":[122],"constraints":[123],"extracted":[124],"from":[125],"significantly":[130],"improves":[131],"performance.":[135],"demonstrate":[137],"effectiveness":[139],"our":[141],"approach":[142],"by":[143],"applying":[144],"it":[145],"written":[148],"Amazon's":[150],"AWS":[151],"Identity":[152],"Access":[154],"Management":[155],"(IAM)":[156],"language":[158],"Microsoft's":[160],"Azure":[161],"language.":[163]},"counts_by_year":[{"year":2026,"cited_by_count":4},{"year":2025,"cited_by_count":5},{"year":2024,"cited_by_count":5},{"year":2023,"cited_by_count":2},{"year":2022,"cited_by_count":2}],"updated_date":"2026-07-17T09:13:05.818461","created_date":"2025-10-10T00:00:00"}