Analysis of integrity policies using soft constraints

Abstract

An integrity policy defines the situations when modification of information is authorized and is enforced by the security mechanisms of the system. However, in a complex application system it is possible that an integrity policy may have been incorrectly specified and, as a result, a user may be authorized to modify information that can lead to an unexpected system compromise. We outline a scalable and quantitative technique that uses constraint solving to model and analyze the effectiveness of application system integrity policies.