Robust access control is a cornerstone of secure software, systems, and networks. An access control mechanism is as effective as the policy it enforces. However, authoring effective policies that satisfy desired properties such as the principle of least privilege is a challenging task even for experienced administrators, as evidenced by many real instances of policy misconfiguration. In this paper, we set out to address this pain point by proposing Restricter, which automatically tightens each (permit) policy rule of a policy with respect to an access log, which captures some already exercised access requests and their corresponding access decisions (i.e., allow or deny). Restricter achieves policy tightening by reducing the number of access requests permitted by a policy rule without sacrificing the functionality of the underlying system it is regulating. We implement Restricter for Amazon's Cedar policy language and demonstrate its effectiveness through two realistic case studies.

翻译：稳健的访问控制是保障软件、系统和网络安全的重要基石。访问控制机制的有效性取决于其所执行策略的质量。然而，即使对于经验丰富的管理员而言，编写满足最小权限原则等理想属性的有效策略仍是一项具有挑战性的任务，众多实际策略配置失误的案例即证明了这一点。本文针对这一痛点提出Restricter，该系统能够依据访问日志自动收紧策略中的每一条（允许类）规则；该日志记录了已执行的访问请求及其对应的访问决策（即允许或拒绝）。Restricter通过减少策略规则所允许的访问请求数量来实现策略收紧，同时确保其管控的基础系统功能不受影响。我们基于亚马逊Cedar策略语言实现了Restricter，并通过两项真实案例研究验证了其有效性。