Title: Exploring Large Language Models for Access Control Policy Synthesis and Summarization Show Chinese title

Title: 探索大型语言模型在访问控制策略合成和总结中的应用

Abstract: Cloud computing is ubiquitous, with a growing number of services being hosted on the cloud every day. Typical cloud compute systems allow administrators to write policies implementing access control rules which specify how access to private data is governed. These policies must be manually written, and due to their complexity can often be error prone. Moreover, existing policies often implement complex access control specifications and thus can be difficult to precisely analyze in determining their behavior works exactly as intended. Recently, Large Language Models (LLMs) have shown great success in automated code synthesis and summarization. Given this success, they could potentially be used for automatically generating access control policies or aid in understanding existing policies. In this paper, we explore the effectiveness of LLMs for access control policy synthesis and summarization. Specifically, we first investigate diverse LLMs for access control policy synthesis, finding that: although LLMs can effectively generate syntactically correct policies, they have permissiveness issues, generating policies equivalent to the given specification 45.8% of the time for non-reasoning LLMs, and 93.7% of the time for reasoning LLMs. We then investigate how LLMs can be used to analyze policies by introducing a novel semantic-based request summarization approach which leverages LLMs to generate a precise characterization of the requests allowed by a policy. Our results show that while there are significant hurdles in leveraging LLMs for automated policy generation, LLMs show promising results when combined with symbolic approaches in analyzing existing policies. Show Chinese abstract

Abstract: 云计算无处不在，每天都有越来越多的服务在云上托管。 典型的云计算系统允许管理员编写实现访问控制规则的策略，这些规则指定了如何管理对私有数据的访问。 这些策略必须手动编写，由于其复杂性，常常容易出错。 此外，现有的策略通常实现复杂的访问控制规范，因此在确定其行为是否完全符合预期时，往往难以精确分析。 最近，大型语言模型（LLMs）在自动代码合成和总结方面表现出巨大的成功。 鉴于这一成功，它们可能被用于自动生成访问控制策略，或帮助理解现有策略。 在本文中，我们探讨了LLMs在访问控制策略合成和总结方面的有效性。 具体而言，我们首先研究了多种LLMs在访问控制策略合成中的表现，发现尽管LLMs可以有效地生成语法正确的策略，但它们存在宽松性问题，对于非推理型LLMs，生成的策略与给定规范等价的比例为45.8%，而对于推理型LLMs，这一比例为93.7%。 然后，我们研究了如何利用LLMs分析策略，通过引入一种基于语义的请求总结方法，该方法利用LLMs生成策略允许的请求的精确描述。 我们的结果表明，虽然在利用LLMs进行自动策略生成方面存在重大障碍，但在将LLMs与符号方法结合分析现有策略时，LLMs表现出有希望的结果。