Visualization Analysis of Multi-Domain Access Control Policy Integration Based on Tree-Maps and Semantic Substrates

Abstract

The complexity of multi-domain access control policy integration makes it difficult to understand and manage the policy conflict information. The policy information visualization technology can express the logical relation of the complex information intuitively which can effectively improve the management ability of the multi-domain policy integration. Based on the role-based access control model, this paper proposed two policy analyzing methods on the separated domain statistical information of multi-domain policy integration conflicts and the policy element levels of inter-domain and element mapping of cross-domain respectively. In addition, the corresponding visualization tool is developed. We use the tree-maps algorithm to statistically analyze quantity and type of the policy integration conflicts. On that basis, the semantic substrates algorithm is applied to concretely analyze the policy element levels of inter-domain and role and permission mapping of cross-domain. Experimental result shows tree-maps and semantic substrates can effectively analyze the conflicts of multi-domain policy integration and have a good application value.

V3SPA: A visual analysis, exploration, and diffing tool for SELinux and SEAndroid security policies

“…Pan and Xu [15] proposed using treemaps and semantic substrates for visually analyzing multi-domain access control and cross-domain information exchange, a related but different usecase from MAC. Xu et al [23,22] also used semantic substrates, but in the specific context of SELinux security policies.…”

Hyperion: A Visual Analytics Tool for an Intrusion Detection and Prevention System

“…Besides, several techniques for visualizing other security policies using tree maps [28] or grids [29] have been studied.…”