SR2ACM: A Methodical Approach for Translating Natural Language Security Requirements to Access Control Model

Access control policies (ACPs), embedded in the security requirements of an enterprise, are typically expressed in natural languages. Security administrators manually extract ACPs, interpret them, and construct a formal access control model which is later enforced by security mechanisms. The manual process is tedious, complex, expensive, labor-intensive, and error-prone. To address these limitations, we introduce a Natural Language Processing (NLP) pipeline called Security Requirements to Access Control Model (SR2ACM). This pipeline is designed to extract ACPs from statements in natural language automatically, convert these ACPs into the Next Generation Access Control (NGAC) model that we represent in the form of a graph, propose a set of properties that can be tested on the graph to assess the quality of the NGAC model so derived. SR2ACM performs downstream NLP tasks that include identifying ACP sentences, identifying NGAC relations, and identifying NGAC user and object attributes. The experimental results are promising as we achieved, on average, F1-score of 93% when identifying ACP sentences, F1-score of 97% when extracting NGAC relations between attributes, and F1-score of 96% when extracting user attributes and 89% for object attributes from natural language access control policies that we obtained from real-world applications. We utilize six diverse datasets representing access control policies of various domains to ensure a comprehensive evaluation. To assess the correctness of the NGAC policies generated, we propose a set of formal properties, namely, completeness (checks no ACPs have been omitted), well-formedness (checks the ACP construct), minimality (checks for absences of redundancies), and consistency (checks for absence of conflicts). Our formal analysis on our dataset reveals a completeness rate of 95% on average, a perfect rate of 100% of well-formedness, non-redundancy in 98% of NGAC ACPs, and an absence of inconsistencies. Our research is unique as it combines machine learning with software testing to assure the quality of the extracted model.