用大模型自动把自然语言权限规则转成机器可执行的安全策略
LMN: A Tool for Generating Machine Enforceable Policies from Natural Language Access Control Rules using LLMs
- 基于GPT-3.5和精心设计提示词，将自然语言访问控制规则转化为机器可执行策略
- 在多组提示实验中验证了转换准确率，支持复杂规则的自动化处理
- 免费在线工具，适合安全人员快速实现策略自动化，无需编程基础
组织常制定称为自然语言访问控制策略（NLACP）的规则，用于规定谁在何时能访问哪些信息。但这些规则无法直接用于属性基访问控制（ABAC）等目标访问控制系统。手动翻译为机器可执行安全策略（MESPs）耗时费力，尤其对大型组织不现实。现有自动化流程又要求信息安全人员具备特定技能。为此，我们开发了名为LMN的免费、公开可访问的在线工具，输入NLACP即可生成对应MESPs。LMN内部调用GPT-3.5 API，并采用优化提示词设计。通过多种提示和性能指标的实验，充分验证了其有效性。
原文摘要 · Abstract (English)
Organizations often lay down rules or guidelines called Natural Language Access Control Policies (NLACPs) for specifying who gets access to which information and when. However, these cannot be directly used in a target access control model like Attribute-based Access Control (ABAC). Manually translating the NLACP rules into Machine Enforceable Security Policies (MESPs) is both time consuming and resource intensive, rendering it infeasible especially for large organizations. Automated machine translation workflows, on the other hand, require information security officers to be adept at using such processes. To effectively address this problem, we have developed a free web-based publicly accessible tool called LMN (LLMs for generating MESPs from NLACPs) that takes an NLACP as input and converts it into a corresponding MESP. Internally, LMN uses the GPT 3.5 API calls and an appropriately chosen prompt. Extensive experiments with different prompts and performance metrics firmly establish the usefulness of LMN.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。