Research proof index

The verifyAlwaysAllows analysis is sound: if the assertions verifyAlwaysAllows ps₁ εnv are satisfiable for the policies ps₁ and the strongly well-formed symbolic environment εnv, then there exists a strongly well-formed concrete environment env ∈ᵢ εnv such that the authorizer will not return allow when applied to ps₁ and env.

The verifyAlwaysAllows analysis is sound: if the assertions verifyAlwaysAllows ps₁ εnv are unsatisfiable for the policies ps₁ and the strongly well-formed symbolic environment εnv, then the authorizer will return allow when applied to ps₁ and any strongly well-formed concrete environment env ∈ᵢ εnv.

The verifyAlwaysDenies analysis is sound: if the assertions verifyAlwaysDenies ps₁ εnv are satisfiable for the policies ps₁ and the strongly well-formed symbolic environment εnv, then there exists a strongly well-formed concrete environment env ∈ᵢ εnv such that the authorizer will not return deny when applied to ps₁ and env.

The verifyAlwaysDenies analysis is sound: if the assertions verifyAlwaysDenies ps₁ εnv are unsatisfiable for the policies ps₁ and the strongly well-formed symbolic environment εnv, then the authorizer will return deny when applied to ps₁ and any strongly well-formed concrete environment env ∈ᵢ εnv.

The verifyAlwaysMatches analysis is complete: if the assertions verifyAlwaysMatches p εnv are satisfiable for the policy p and the strongly well-formed symbolic environment εnv, then there exists a strongly well-formed concrete environment env ∈ᵢ εnv such that the evaluator will not return .ok true when applied to p and env.

Alternate definition of completeness for alwaysMatches: For a singleton policyset, if symcc says the policy does not alwaysMatch, then there exists a concrete environment where the policy does not appear in determiningPolicies.