Detecting Information Leakage Against Chinese Wall Policy Based on the Unfolding Technique of Colored Petri Nets
Hanqian Tu, Dongming Xiang, Zuohua Ding, Guanjun Liu · IEEE Transactions on Computational Social Systems · 2024
Information leakage easily occurs in large-scale information interactions and brings harm to individuals, enterprises, and society. As a well-known security policy, Chinese Wall (CW) provides a security guideline, which combines mandatory and discretionary access control to avoid information leakage. Colored Petri nets (CPNs) are a widely used formal method, well suited for verification of CW policy due to the capability of characterizing the concurrency. However, CPN easily suffers from the problem of state space explosion due to the interleaving semantics. The unfolding techniques can effectively alleviate this problem. In this article, we apply simplified CPN and their unfolding techniques to detect information leakage against CW policy. Specifically, we define a CPN-based CW model, propose an algorithm to generate the merged process of CPN, and detect the potential information leakage by analyzing the structural behaviors of its unfoldings. Furthermore, we conduct a case study and several experiments to show the advantages of our method. The results exhibit that our method can effectively detect information leakage against CW policy and alleviate the state space explosion.