Clark-Wilson policies in ACP : controlling information flow between solid apps

Tools

Forsyth, Ellie and Horne, Ross (2025) Clark-Wilson policies in ACP : controlling information flow between solid apps. CEUR Workshop Proceedings, 3947. pp. 100-108. ISSN 1613-0073

[thumbnail of Forsyth-and-Horne-2024-Clark-Wilson-Policies-in-ACP]
Preview
 Text. Filename: Forsyth-and-Horne-2024-Clark-Wilson-Policies-in-ACP.pdf
Final Published Version
License: Creative Commons Attribution 4.0 logo
Download (463kB)| Preview

Abstract

This paper explains how to avoid certain unintended information flows between apps connected to the same Solid pod. We draw attention to threats faced if security policies for Solid pods omit the identities of clients, resulting in confidential information intended for one app leaking to other apps. We also explain good practice usage of ACP for avoiding such insecure configurations and draw parallels with the famous Clark-Wilson policy model for enterprise security. We propose that trusted apps enforcing security policy models should be developed so that pod owners need not be policy experts to operate secure pods.

ORCID iDs

Forsyth, Ellie and Horne, Ross ORCID logoORCID: https://orcid.org/0000-0003-0162-1901;
CORE (COnnecting REpositories)