DePLOI：应用NL2SQL合成与审计数据库访问控制
DePLOI: Applying NL2SQL to Synthesize and Audit Database Access Control
AI总结：
本文提出DePLOI，一个基于LLM的系统，利用NL2SQL技术从IBAC-DB抽象中合成和审计数据库访问控制，并引入首个基准IBACBench，实验表明其性能显著优于其他LLM策略。
摘要：
在每个企业数据库中，管理员必须定义访问控制策略，以规定哪些用户有权访问哪些表。访问控制横跨两个世界：策略（定义谁应具有访问权限的组织级原则）和过程（实际实施该策略的数据库级原语）。评估并强制过程符合策略是一项手动且临时性的任务。本文引入了一种新的访问控制模型，称为基于意图的数据库访问控制（IBAC-DB）。在IBAC-DB中，访问控制策略使用能够扩展到大量数据库对象的抽象来表达，并且相对于实现是可追踪的。本文提出了DePLOI（组织意图的部署策略检查器），一个基于LLM的系统，利用访问控制特定的任务分解，从IBAC-DB抽象中准确合成和审计访问控制实现。由于据我们所知，DePLOI是同类系统中的首个，本文进一步提出了IBACBench，这是第一个用于评估DePLOI合成和审计能力的基准。IBACBench结合了当前的NL2SQL基准、真实世界的角色层次结构和访问控制策略，以及LLM生成的数据。我们发现，DePLOI总体上实现了高合成准确率和审计F1分数，并且大大优于其他LLM提示策略（例如，高出10个F1点）。
英文摘要：
In every enterprise database, administrators must define an access control policy that specifies which users have access to which tables. Access control straddles two worlds: policy (organization-level principles that define who should have access) and process (database-level primitives that actually implement the policy). Assessing and enforcing process compliance with a policy is a manual and ad-hoc task. This paper introduces a new access control model called Intent-Based Access Control for Databases (IBAC-DB). In IBAC-DB, access control policies are expressed using abstractions that scale to high numbers of database objects, and are traceable with respect to implementations. This paper proposes DePLOI (Deployment Policy Linter for Organization Intents), a LLM-backed system leveraging access control-specific task decompositions to accurately synthesize and audit access control implementation from IBAC-DB abstractions. As DePLOI is the first system of its kind to our knowledge, this paper further proposes IBACBench, the first benchmark for evaluating the synthesis and auditing capabilities of DePLOI. IBACBench leverages a combination of current NL2SQL benchmarks, real-world role hierarchies and access control policies, and LLM-generated data. We find that DePLOI achieves high synthesis accuracies and auditing F1 scores overall, and greatly outperforms other LLM prompting strategies (e.g., by 10 F1 points).
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
