Access-Control Policies via Belnap Logic: Effective and Efficient Composition and Analysis

Abstract

It is difficult to develop and manage large, multi-author access control policies without a means to compose larger policies from smaller ones. Ideally, an access-control policy language will have a small set of simple policy combinators that allow for all desired policy compositions. In [5], a policy language was presented having policy combinators based on Belnap logic, a four-valued logic in which truth values correspond to policy results of "grant", "deny", "conflict", and "undefined". We show here how policies in this language can be analyzed, and study the expressiveness of the language. To support policy analysis, we define a query language in which policy analysis questions can be phrased. Queries can be translated into a fragment of first-order logic for which satisfiability and validity checks are computable by SAT solvers or BDDs. We show how policy analysis can then be carried out through model checking, validity checking, and assume-guarantee reasoning over such translated queries. We also present static analysis methods for the particular questions of whether policies contain gaps or conflicts. Finally, we establish expressiveness results showing that all data independent policies can be expressed in our policy language.

An Authorization Framework Resilient to Policy Evaluation Failures

“…From a technical perspective, it is important to establish whether our language can accommodate a fourth decision value to represent conflicting decisions from sub-policies [6]. Equally important is to establish what set of binary operators would be sufficient to articulate any desired policy.…”

“…Informally, when evaluating a request q with respect to some policy p, we first determine whether p is applicable to q. The role of π in our policy language is similar to that of <Target> and <Condition> elements in XACML rules and policies [12], or of access predicates in [6]. We refer to π as the applicability predicate.…”

PTaCL: A Language for Attribute-Based Access Control in Open Systems

“…Although there is a substantial body of work on policy specification [1,4,5,13,17], this prior work assumes a very restricted format for access requests and targets. To the best of our knowledge, there is no previous work on a formal language for target specification and evaluation, let alone the consideration of missing attributes names.…”

“…Our main objective is to define a policy language that addresses the same problem space as XACML 3.0 [15] while retaining the formality of recent work on policy algebras [1,4,5,6,17]. XACML (eXtensible access control markup language) is a standardized language: XACML 2.0 was ratified in 2005; XACML 3.0 will add support for attribute-based access control and policy administration.…”

Expressive policy analysis with enhanced system dynamicity

“…Finally, in [9,10] the authors define a simple but powerful framework for representing and reasoning about accesscontrol policy composition. The semantics for access requests is four-valued: permit, deny, undefined, and conflict.…”