Detecting Covert Channels in Cloud Access Control Policies Using Large Language Models

In the realm of cloud computing, the task of configuring access control policies is a critical aspect of ensuring security of cloud resources. However, policy configuration remains a complex task with a high cognitive load as it requires a simultaneous understanding of the cloud environment and security requirements of the organization. This often creates gaps between intended and actual policy configuration leading to misconfigurations of policies. A misconfigured policy can introduce subtle and unexpected vulnerabilities that can be exploited by malicious entities to gain unauthorized access to cloud resources. In this paper, we model and analyze a particular class of access control vulnerabilities that arise due to the creation of covert channels in role-based access control policies. We present a tool CovertHunter that uses a Large Language Model to recognize intent behind policy configuration described in natural language and check it against actual cloud policies to automatically detect vulnerabilities arising due to the presence of covert channels.