LLM Analysis of Cloud Access Policies for Covert Channel Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cloud access control policies are prone to misconfigurations, leading to covert channels that allow unauthorized access to restricted resources, which conventional methods fail to detect efficiently.
Innovation Solution
Utilize Large Language Models (LLMs) to analyze access control policies and generate access violation graphs, highlighting covert channels and potential thefts by identifying implicit access paths.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If manual formulation of access control policies is used, then policy configuration can be customized according to business rules, but misconfigurations and covert channels are introduced leading to security vulnerabilities
Solution Approach 1:
The system implements automated feedback mechanisms by using LLMs to continuously analyze access control policies and generate violation graphs that highlight covert channels. This feedback loop detects misconfigurations and implicit access paths, alerting administrators to security vulnerabilities while maintaining policy customization capabilities.
Solution Approach 2:
The patent replaces manual mechanical policy formulation with an automated LLM-based system. The LLM automatically generates and analyzes access control policies, substituting human manual configuration with intelligent automated systems that reduce human error while maintaining adaptability to business requirements.
2Ease of operation
If role based access control is implemented, then resource access can be managed through roles, but complexity of policy formulation increases leading to loop holes and implicit access violation paths
Solution Approach 1:
The LLM acts as an intermediary between role-based access requirements and policy formulation. It automatically translates business rules and role definitions into secure access control policies, managing the complexity of role assumptions and resource access relationships while maintaining ease of operation for administrators.
Solution Approach 2:
The system dynamically adjusts policy parameters by analyzing role assumptions, resource access rights, and principal permissions. The LLM modifies policy configurations based on detected violations and generates optimized policies that maintain operational simplicity while reducing formulation complexity and preventing security loopholes.
3Adaptability or versatility
If users are allowed to self-configure access control policies, then policy configuration becomes more flexible, but misconfigured policies lead to security breaches
Solution Approach 1:
The system performs preliminary analysis of user-configured policies using LLMs before they are deployed. By proactively generating violation graphs and detecting potential covert channels in advance, the system prevents misconfigured policies from being implemented, thereby maintaining self-configuration flexibility while eliminating security breach risks.
Solution Approach 2:
The automated violation detection system provides immediate feedback to users about misconfigurations in their self-defined policies. The LLM-generated alerts and violation graphs guide users to correct security issues, enabling safe self-configuration while preventing harmful misconfigurations from taking effect.
Data Source
Figure 1A
Figure 1B
Figure 1C
AI summary
Literature on access control policies in cloud computing has focused on the design of secure models of access or on the syntactic and semantic analysis of policies but not into aspect of covert channel. A method and system for detecting covert channels in role based cloud access control policies using Large Language Model (LLM) is disclosed. A set of access control policies and an access specification is analyzed by the LLM for presence of violation indicating an implicit path between an entity (principal) and a restricted resource. Further, the LLM is prompted to generate a script Python program, which in turn generates a graph to visually depict paths leading from principal to one or more resources in the cloud environment, wherein any implicit access to the restricted resource if detected is highlighted by introducing a path from the principal to the restricted resources with label as covert channel. The covert channel so depicted provides information on possible theft threats.