Towards

Reasonability

Properties

for

Access-Control

Policy

Languages

The

growing

importance

of

access

control

has

led

to

the

definition

of

numerous

languages

for

specifying

policies

Since

these

languages

are

based

on

different

foundations

language

users

and

designers

would

benefit

from

formal

means

to

compare

them

We

present

a

set

of

properties

that

examine

the

behavior

of

policies

under

enlarged

requests

policy

growth

and

policy

decomposition

They

therefore

suggest

whether

policies

written

in

these

languages

are

easier

or

harder

to

reason

about

under

various

circumstances

We

then

evaluate

multiple

policy

languages

including

XACML

and

Lithium

using

these

properties

D.

-LSB-

Operating

Systems

-RSB-

Security

and

Protection

Access

Controls

Languages

Security

Access-control

policies

should

not

be

write-only

Because

they

govern

both

the

containment

and

availability

of

critical

information

they

must

be

highly

amenable

to

analysis

by

both

humans

and

by

reasoning

software

such

as

verifiers

An

access-control

policy

dictates

a

function

from

requests

for

access

to

decisions

about

whether

or

not

to

grant

access

The

competing

requirements

of

expressive

power

and

computational

speed

makes

the

design

of

policy

languages

a

delicate

balancing

act

Contemporary

policy

languages

have

Current

affiliation

Computer

Science

Department

Carnegie

Mellon

University

Permission

to

make

digital

or

hard

copies

of

all

or

part

of

this

work

for

personal

or

classroom

use

is

granted

without

fee

provided

that

copies

are

not

made

or

distributed

for

profit

or

commercial

advantage

and

that

copies

bear

this

notice

and

the

full

citation

on

the

first

page

To

copy

otherwise

to

republish

to

post

on

servers

or

to

redistribute

to

lists

requires

prior

specific

permission

and/or

a

fee

SACMAT

June

Lake

Tahoe

California

USA

Copyright

ACM

largely

followed

one

of

two

routes

Some

are

based

on

logics

restricting

first-order

logic

-LRB-

e.g.

Lithium

-LSB-

-RSB-

-RRB-

or

augmenting

Datalog

-LRB-

e.g.

Cassandra

-LSB-

-RSB-

-RRB-

Others

are

custom

languages

such

as

XACML

-LSB-

-RSB-

and

EPAL

-LSB-

-RSB-

which

behave

roughly

by

rule-evaluation

and

do

not

depend

on

theorem-proving

capabilities

to

determine

a

response

to

a

query

The

custom

language

approach

often

produces

fairly

limited

languages

For

example

to

express

hierarchical

role-based

access-control

-LRB-

RBAC

-RRB-

-LSB-

-RSB-

in

XACML

requires

a

fairly

cumbersome

encoding

-LSB-

-RSB-

On

the

other

hand

its

more

direct

request

evaluation

strategy

suggests

that

policies

written

in

XACML

are

more

transparent

than

policies

written

in

languages

based

on

first-order

logic

-LRB-

as

we

motivate

in

Section

-RRB-

How

then

do

we

distinguish

different

policy

languages

Studies

of

complexity

and

expressive

power

may

ensure

tractable

verification

and

the

ability

to

capture

certain

policies

but

do

not

directly

classify

the

ease

of

reasoning

about

policies

in

a

language

In

this

paper

we

take

a

step

towards

formalizing

reasonability

properties

that

make

languages

more

amenable

to

reasoning

We

then

apply

these

properties

to

actual

policy

languages

Such

properties

are

useful

even

when

verification

is

computationally

tractable

because

they

provide

a

guide

to

where

and

how

to

edit

a

policy

for

a

desired

effect

Concretely

our

properties

study

three

main

questions

how

decisions

change

as

requests

include

more

information

how

decisions

change

as

policies

grow

and

how

amenable

policies

are

to

compositional

reasoning

The

last

of

these

is

especially

important

for

two

reasons

First

organizations

in-creasingly

have

different

divisions

creating

policy

fragments

that

must

be

combined

into

a

whole

while

preserving

the

intent

of

each

division

second

to

mirror

these

use

cases

and

to

scale

better

as

policies

grow

in

size

it

becomes

important

for

analysis

and

verification

tools

to

function

modularly

These

properties

codify

our

observations

made

while

writing

and

studying

policies

for

non-trivial

systems

-LRB-

We

do

not

however

presume

to

make

broad

statements

about

the

impact

of

these

properties

for

manual

reasoning

-RRB-

They

are

meant

to

be

descriptive

rather

than

prescriptive

which

ones

a

language

should

satisfy

depends

on

the

context

of

its

use

We

do

expect

these

properties

to

help

both

language

designers

and

policy

authors

the

former

to

set

goals

and

the

latter

to

evaluate

languages

We

first

motivate

the

work

with

an

example

Section

presents

background

on

policy

languages

Section

presents

the

heart

of

our

formalism

Section

applies

this

framework

to

XACML

and

Section

to

logical

approaches

such

as

Lithium

The

remainder

discusses

related

work

and

offers

concluding

remarks

Consider

the

following

natural-language

policy

If

the

subject

is

a

faculty

member

then

permit

that

subject

to

assign

grades

If

the

subject

is

a

student

then

do

not

permit

that

subject

to

assign

grades

If

the

subject

is

not

a

faculty

member

then

permit

that

subject

to

enroll

in

courses

We

might

represent

this

policy

as

follows

faculty

-LRB-

s

-RRB-

Permit

-LRB-

s

grades

assign

-RRB-

-LRB-

p

-RRB-

student

-LRB-

s

-RRB-

Permit

-LRB-

s

grades

assign

-RRB-

-LRB-

p

-RRB-

faculty

-LRB-

s

-RRB-

Permit

-LRB-

s

courses

enroll

-RRB-

-LRB-

p

-RRB-

Let

the

above

formalization

be

p

and

the

first

line

of

the

policy

be

sub-policy

p

the

second

p

and

the

third

p

Consider

the

following

natural-language

request

A

student

requests

to

enroll

in

courses

Assume

that

requests

list

the

subject

resource

and

action

by

name

if

possible

and

by

variable

if

the

name

is

unknown

along

with

any

other

known

facts

In

this

representation

the

request

becomes

-LRB-

s

courses

enroll

-RRB-

with

student

-LRB-

s

-RRB-

-LRB-

q

-RRB-

Should

the

policy

grant

access

At

least

three

interpretations

of

the

policy

are

possible

p

grants

access

due

to

p

The

request

does

not

show

the

subject

being

a

faculty

member

thus

p

applies

and

p

produces

the

decision

to

permit

access

This

relies

on

the

assumption

that

since

the

request

does

not

show

the

subject

being

faculty

that

the

subject

is

in

fact

not

faculty

One

could

drop

this

assumption

The

policy

does

not

apply

to

the

request

One

would

reason

that

p

and

p

do

not

apply

since

they

are

dealing

with

assigning

grades

and

not

enrolling

in

courses

Furthermore

one

could

conclude

that

p

does

not

apply

since

the

request

does

not

prove

that

the

subject

is

not

faculty

To

do

so

the

request

would

have

been

-LRB-

s

courses

enroll

-RRB-

with

student

-LRB-

s

-RRB-

faculty

-LRB-

s

-RRB-

Since

the

policy

does

not

apply

to

the

request

the

system

should

have

and

enact

some

default

behavior

By

reasoning

different

than

that

used

in

the

first

interpretation

p

could

still

grant

the

request

As

in

the

second

interpretation

one

could

conclude

that

the

request

alone

fails

to

establish

that

the

subject

is

not

a

faculty

member

However

if

the

subject

were

a

faculty

member

then

the

first

two

lines

together

would

yield

a

contradiction

p

would

imply

that

the

subject

could

enroll

in

courses

and

p

would

imply

that

the

subject

could

not

Thus

student-faculty

members

do

not

exist

Since

the

subject

of

the

request

is

clearly

a

student

he

must

not

be

faculty

member

Thus

p

applies

to

grant

access

This

example

is

adapted

from

Halpern

and

Weissman

-LSB-

-RSB-

In

the

first

two

interpretations

the

user

may

limit

his

reasoning

to

each

sub-policy

independent

of

one

another

However

under

the

third

interpretation

-LRB-

which

in

fact

is

the

one

chosen

by

Halpern

and

Weissman

-RRB-

the

user

must

reason

about

all

three

sub-policies

at

once

Furthermore

under

Interpretation

the

user

must

reason

about

both

positive

and

negative

attributes

unlike

under

Interpretation

These

semantic

differences

drastically

affect

a

reader

's

ability

to

comprehend

policies

For

example

Interpretation

requires

both

global

analysis

and

demands

rich

reasoning

power

to

deduce

the

contradiction

This

paper

formalizes

these

differences

and

their

burdens

Despite

the

differences

between

access-control

policy

languages

we

can

still

identify

many

common

elements

First

we

describe

features

common

to

most

languages

and

then

we

discuss

in

detail

two

areas

in

which

many

languages

differ

the

available

decisions

and

policy

combinators

Common

Features

A

policy

language

must

provide

a

way

of

describing

the

different

forms

of

access

and

the

environment

in

which

they

could

occur

This

information

forms

a

request

Many

languages

break

requests

into

four

different

parts

Subject

the

person

or

process

making

the

request

Resource

the

object

subsystem

person

or

process

that

the

subject

would

like

to

affect

-LRB-

e.g.

a

file

name

or

a

process

id

-RRB-

Action

the

command

or

change

that

the

subject

would

like

to

execute

on

the

resource

and

Environment

describes

any

other

relevant

information

including

the

time

of

day

location

or

the

previous

actions

of

the

subject

The

first

three

make

up

the

form

of

access

requested

while

the

last

gives

the

context

in

which

this

access

would

occur

Each

of

these

parts

lists

attributes

associated

with

its

respective

topic

In

some

languages

the

absence

or

negation

of

an

attribute

might

also

be

explicitly

listed

-LRB-

see

Section

-RRB-

Languages

must

also

provide

a

set

of

decisions

Such

a

set

must

include

some

decisions

that

grant

access

and

some

that

prohibit

access

A

policy

will

associate

with

each

request

a

decision

-LRB-

or

in

the

case

of

nondeterministic

policies

a

policy

will

relate

each

request

with

some

number

of

decisions

-RRB-

Definition

An

access-control

policy

language

is

a

tuple

L

-LRB-

P

Q

G

N

-RRB-

with

P

a

set

of

policies

Q

a

family

of

sets

of

requests

indexed

by

policies

G

the

set

of

decisions

that

stipulate

that

the

system

should

grant

access

-LRB-

granting

decisions

-RRB-

N

the

set

of

decisions

that

stipulate

that

the

system

should

not

grant

access

-LRB-

non-granting

decisions

-RRB-

a

function

taking

a

policy

p

P

to

a

relation

between

Q

p

and

G

N

where

G

N

When

clear

from

context

the

above

symbols

will

be

ref-erenced

without

explicitly

relating

them

to

L

and

D

will

represent

G

N

The

function

gives

the

meaning

of

policy

p

and

we

write

q

p

d

for

p

P

q

Q

p

and

d

D

when

p

assigns

a

decision

of

d

to

the

request

q

If

for

a

language

Q

p

Q

p

for

all

p

and

p

in

P

then

we

drop

the

subscript

on

Q

and

treat

it

as

a

set

of

requests

common

to

all

policies

Given

L

define

the

partial

order

on

D

to

be

such

that

d

d

if

either

d

d

N

d

d

G

or

d

N

and

d

G.

Decisions

Policy

languages

must

provide

decisions

to

indicate

a

pol-icy

's

intent

to

grant

or

not

to

grant

a

request

Some

languages

might

just

provide

two

decisions

permit

for

granting

access

and

deny

for

not

granting

access

A

policy

in

such

a

language

associates

various

subsets

of

requests

with

one

of

these

two

decisions

For

example

p

explicitly

identifies

a

subset

of

permitted

requests

and

p

gives

denied

requests

However

a

policy

might

assign

some

requests

to

neither

permit

nor

deny

-LRB-

e.g.

q

under

Interpretation

of

p

-RRB-

To

err

on

the

side

of

safety

the

policy

language

should

provide

for

such

requests

a

default

decision

that

does

not

imply

a

grant

of

access

creating

a

closed

policy

-LSB-

-RSB-

However

assigning

them

the

decision

of

deny

may

limit

the

ability

to

compose

policies

For

example

while

combining

the

policies

of

two

departments

one

would

like

to

distinguish

between

those

requests

that

each

department

really

would

like

to

prohibit

and

those

about

which

they

do

not

care

-LSB-

-RSB-

The

decision

of

not

applicable

serves

this

purpose

With

a

decision

of

not

applicable

sufficing

to

prevent

access

some

languages

elect

not

to

include

statements

associating

requests

with

deny

This

leaves

only

statements

permitting

some

set

of

requests

The

uniformity

of

statements

in

such

languages

might

make

the

policy

easier

to

read

and

compose

-LRB-

see

Section

-RRB-

However

allowing

for

the

explicate

denial

of

requests

can

quickly

rule

out

exceptional

cases

and

provides

a

means

to

determine

when

a

policy

does

not

grant

access

by

desire

rather

than

by

default

Some

requests

might

not

have

a

logical

interpretation

under

a

given

policy

For

example

a

request

of

-LRB-

s

grades

assign

-RRB-

with

faculty

-LRB-

s

-RRB-

student

-LRB-

s

-RRB-

-LRB-

q

-RRB-

under

Interpretation

of

p

contradicts

the

policy

itself

A

request

might

even

contain

illogical

values

or

require

undefined

computation

-LRB-

such

as

division

by

zero

-RRB-

For

generality

a

system

might

like

to

assign

a

decision

to

such

inputs

rather

than

excluding

them

from

the

set

of

requests

and

leaving

the

policy

undefined

on

them

In

such

cases

a

decision

of

error

or

some

refinement

of

it

might

be

appropriate

One

may

view

the

fact

that

an

error

state

is

reached

given

a

request

to

be

a

weakness

in

the

policy

However

one

may

also

take

it

to

be

a

statement

about

the

world

in

which

the

policy

is

to

function

that

no

such

requests

may

logically

exist

Error

decisions

can

enforce

these

preconditions

or

assumptions

that

the

policy

has

made

Policy

Combinators

The

policy

of

an

organization

often

consists

of

the

composition

of

policy

fragments

or

sub-policies

from

a

variety

of

internal

units

-LRB-

e.g.

legal

accounting

and

execute

departments

of

a

corporation

-RRB-

Thus

policy

languages

provide

combinators

to

create

a

single

policy

from

these

fragments

Under

p

the

request

given

above

-LRB-

q

-RRB-

is

permitted

by

p

but

denied

p

The

method

used

to

combine

the

three

sub-policies

of

p

into

one

policy

determines

how

to

resolve

this

conflict

Some

languages

like

the

hypothetical

language

in

which

p

is

written

might

have

only

one

policy

combinator

that

is

implicitly

applied

Other

languages

provide

multiple

combinators

If

a

policy

has

sub-policies

nested

inside

of

sub-policies

the

different

layers

may

be

resolved

differently

Some

of

the

possible

policy

combinators

are

Permit

Overrides

If

any

of

the

sub-policies

produces

a

permit

return

only

permit

Otherwise

if

any

produces

a

deny

return

only

deny

Else

return

not

applicable

Deny

Overrides

If

any

of

the

sub-policies

produces

a

deny

return

only

deny

Otherwise

if

any

produces

a

permit

return

only

permit

Else

return

not

applicable

First

Applicable

Return

the

decision

reached

by

the

first

sub-policy

to

reach

one

other

than

not

applicable

All

Seen

Return

a

set

containing

the

decisions

reached

by

all

the

sub-policies

Either

Permit

or

Deny

Nondeterministically

return

one

of

the

produced

decisions

Error

Return

a

error

if

the

sub-policies

produces

both

permit

and

deny

Otherwise

return

permit

if

produced

or

deny

if

produced

Else

return

not

applicable

And

Conjoin

the

sub-policies

together

by

logical

And

and

return

the

implied

decision

-LRB-

s

-RRB-

De

Capitani

di

Vimercati

et

al.

-LSB-

-RSB-

list

additional

combinators

The

nature

of

the

combinators

available

in

a

language

can

greatly

impact

the

clarity

of

policies

written

in

it

Notice

that

many

of

the

above

combinators

behave

the

same

in

the

absence

of

the

decision

of

deny

One

might

conclude

from

this

observation

that

allowing

the

explicit

denial

of

a

request

is

an

undesirable

complication

in

a

language

To

formalize

the

role

of

policy

combinators

let

policies

be

either

an

atomic

policy

or

a

set

of

sub-policies

combined

by

some

policy

combinator

Let

p

be

a

policy

that

consists

of

sub-policies

p

i

with

i

n

Then

p

-LRB-

p

p

p

n

-RRB-

represents

the

composition

of

the

sub-policies

using

Since

sub-policies

are

themselves

policies

one

may

apply

to

them

The

relationship

between

-LRB-

p

p

p

n

-RRB-

and

meaning

of

each

sub-policy

p

i

affects

the

clarity

of

the

policy

and

is

studied

in

the

next

section

Having

formalized

policy

languages

we

are

now

ready

to

describe

properties

of

them

We

assume

that

the

set

of

combinators

in

a

given

language

L

-LRB-

Q

P

G

N

-RRB-

is

clear

from

the

structure

of

P

and

If

this

is

not

the

case

for

a

language

one

could

explicitly

add

it

to

the

definition

of

an

policy

language

Some

languages

may

permit

contextual

information

from

enclosing

policies

to

affect

the

meaning

of

the

sub-policies

For

example

a

language

might

have

a

notation

of

variable

binding

For

such

a

language

might

be

extended

to

take

a

second

argument

that

carries

such

contextual

information

All

the

following

definitions

could

be

extended

e.g.

monadically

to

deal

with

such

an

extended

Determinism

and

Totality

Definition

A

language

L

-LRB-

P

Q

G

N

-RRB-

is

deterministic

if

p

P

q

Q

p

d

d

D

q

p

d

q

p

d

d

d

For

a

deterministic

language

we

can

define

a

function

which

takes

a

policy

p

P

and

returns

a

function

from

Q

p

to

D

as

p

q

d

D

s.t.

q

p

d.

For

a

deterministic

language

may

be

given

instead

of

to

define

the

language

-LRB-

We

only

even

mention

nondeterministic

languages

due

to

the

existence

of

one

XACML

with

obligations

-RRB-

Definition

A

language

L

-LRB-

P

Q

G

N

-RRB-

is

total

if

p

P

q

Q

p

d

D

s.t.

q

p

d

The

policies

of

total

languages

will

always

make

a

decision

Safety

Under

Interpretation

the

request

contained

too

little

information

to

determine

which

of

the

sub-policies

of

p

applied

Interpretation

avoids

such

indecision

by

having

requests

implicitly

refute

the

presence

of

any

attribute

not

listed

These

two

interpretations

produce

different

meanings

for

statements

like

faculty

-LRB-

s

-RRB-

found

in

p

Under

Interpretation

faculty

-LRB-

s

-RRB-

holds

if

faculty

-LRB-

s

-RRB-

is

not

in

the

request

while

under

the

second

the

request

must

explicitly

list

faculty

-LRB-

s

-RRB-

for

it

to

hold

We

call

the

former

implicit

and

the

latter

explicit

The

explicit

approach

permits

distinguishing

between

unknown

information

and

attributes

known

to

be

absent

The

explicit

interpretation

however

incurs

the

cost

of

listing

a

possibly

large

set

of

absent

attributes

and

can

lead

to

indecision

as

shown

above

Such

indecision

however

allows

the

system

to

recognize

when

the

policy

requires

more

information

to

yield

a

decision

In

contrast

the

implicit

interpretation

can

grant

undue

access

If

for

example

a

request

does

not

list

faculty

-LRB-

s

-RRB-

simply

because

the

system

did

not

determine

whether

s

was

a

faculty

member

or

not

then

the

system

might

erroneously

allow

s

to

enroll

in

courses

Thus

the

sub-system

producing

requests

must

be

sure

to

include

all

the

relevant

facts

in

each

request

For

large

scale

systems

collecting

or

even

determining

the

germane

information

might

consume

large

amounts

of

time

For

such

systems

the

explicate

approach

might

prove

better

since

requests

may

leave

out

information

safely

and

be

refined

until

the

policy

yields

a

decision

Furthermore

overzealous

optimizations

and

other

coding

errors

might

result

in

the

system

producing

requests

that

do

not

contain

all

the

relevant

facts

Having

a

policy

drive

which

information

requests

include

allows

for

the

system

to

collect

only

the

information

really

needed

to

reach

a

decision

from

the

policy

Under

this

approach

the

sub-system

evaluating

the

policy

starts

with

a

request

that

contains

only

the

readily

available

information

If

this

sub-system

needs

additional

information

to

reach

a

decision

from

the

policy

it

requests

the

necessary

additional

information

Thus

the

system

does

not

need

to

know

what

information

the

policy

requires

at

the

time

of

generating

the

initial

request

This

approach

may

allow

for

more

efficient

implementations

Once

a

datum

has

been

published

it

can

not

easily

be

retracted

Therefore

preventing

unwanted

access

is

usually

preferable

to

granting

it

As

a

result

such

incomplete

requests

should

only

result

in

a

grant

of

access

if

the

complete

one

would

have

We

can

formally

state

this

safety

concern

Definition

Let

be

a

family

of

partial

ordering

on

requests

of

a

language

L

-LRB-

P

Q

G

N

-RRB-

indexed

by

the

policies

of

L.

L

is

safe

with

respect

to

iff

p

P

q

q

Q

p

q

p

q

p

-LRB-

q

-RRB-

p

-LRB-

q

-RRB-

Due

to

differences

in

the

contents

of

a

requests

for

each

language

a

different

family

of

partial

orderings

will

interest

users

The

relation

should

be

such

that

if

q

p

q

then

q

contains

all

the

information

contained

in

q

and

possibly

more

Often

one

partial

ordering

may

serve

every

policy

For

example

consider

a

language

in

which

requests

are

sets

of

non-contradictory

facts

and

the

set

of

decisions

is

-LCB-

permit

deny

-RCB-

Then

using

the

subset

partial

ordering

for

p

-LRB-

for

every

policy

p

-RRB-

will

make

sense

since

it

matches

the

intuition

of

information

content

If

the

language

is

safe

with

respect

to

such

a

defined

then

one

may

omit

facts

from

a

request

without

causing

undue

access

Informally

in

a

safe

language

undue

access

is

impossible

provided

that

requests

tell

no

lies

whereas

in

an

unsafe

language

the

requests

must

additionally

tell

the

whole

truth

The

choice

between

these

is

a

function

of

trust

in

the

program

generating

requests

comprehensiveness

of

analysis

to

generate

requests

efficiency

and

so

on

Nevertheless

the

ability

to

conclude

given

a

request

that

will

yield

access

that

all

requests

with

more

information

will

also

yield

access

can

potentially

be

a

great

boon

to

policy

reasoning

Some

languages

might

choose

to

avoid

the

complications

introduced

by

a

policy

testing

for

the

absence

of

an

attribute

all

together

In

some

contexts

such

as

certificate

passing

systems

in

which

a

certificate

may

be

withheld

negated

attributes

may

not

make

sense

In

such

a

context

requests

would

not

list

negated

attributes

and

the

policy

would

not

test

for

the

absence

of

an

attributes

at

all

Independent

Composition

Consider

the

third

interpretation

of

p.

Under

this

interpretation

the

meaning

of

p

can

only

be

determined

by

looking

at

the

interactions

of

the

different

sub-policies

as

a

whole

Notice

that

any

one

of

these

sub-policies

would

produce

a

decision

of

not

applicable

in

isolation

and

yet

together

they

interact

to

produce

a

permit

decision

The

third

interpretation

thus

inhibits

the

easy

use

of

local

reasoning

to

reach

conclusions

about

the

policy

as

a

whole

This

increases

the

possibility

of

unintended

results

from

combining

sub-policies

into

a

policy

The

alternative

as

found

in

the

first

two

interpretations

is

for

the

sub-policies

to

be

combined

in

such

a

way

that

only

the

result

of

each

in

isolation

matters

This

property

is

formalized

as

follows

Definition

A

policy

combinator

of

a

language

L

-LRB-

P

Q

G

N

-RRB-

independently

composes

its

One

may

argue

that

certificate

passing

systems

may

use

negative

certificates

to

achieve

the

checking

of

attribute

absence

Whether

this

captures

the

notion

of

the

absence

of

an

attribute

or

just

the

presence

of

another

related

attribute

is

unclear

For

example

one

could

conceivably

hold

both

a

positive

and

a

negative

certificate

for

an

attribute

policies

iff

p

p

p

n

P

i

i

n

Q

-LRB-

p

p

p

n

-RRB-

Q

p

i

-LRB-

-RRB-

and

there

exists

a

function

Q

D

D

such

that

p

p

p

n

P

q

Q

-LRB-

p

p

p

n

-RRB-

-LRB-

p

p

p

n

-RRB-

-LRB-

q

-RRB-

-LRB-

q

-RRB-

-LRB-

p

-LRB-

q

-RRB-

p

-LRB-

q

-RRB-

p

n

-LRB-

q

-RRB-

-RRB-

-LRB-

-RRB-

If

all

the

combinators

of

L

independently

compose

then

L

has

the

independent

composition

property

The

first

requirement

forces

a

request

defined

for

a

policy

to

also

be

defined

on

each

of

its

sub-policies

This

is

necessary

for

the

second

requirement

to

be

well

defined

The

second

requirement

ensures

that

one

can

determine

the

decision

of

the

whole

policy

from

the

request

and

decisions

of

its

sub-policies

on

that

request

no

other

properties

of

the

sub-policies

matter

One

might

alternatively

be

tempted

to

define

independent

composition

thus

Definition

A

policy

combinator

of

a

language

L

-LRB-

P

Q

G

N

-RRB-

semantically

composes

its

sub-policies

iff

-LRB-

Q

D

-RRB-

-LRB-

Q

D

-RRB-

p

p

p

n

P

-LRB-

p

p

p

n

-RRB-

-LRB-

p

p

p

n

-RRB-

-LRB-

-RRB-

If

all

the

combinators

of

L

semantically

compose

then

L

has

the

semantic

composition

property

Semantic

composition

ensures

that

all

sub-policies

with

the

same

meaning

in

isolation

will

behave

the

same

under

the

combinator

A

language

with

the

semantic

composition

property

is

arguably

more

clear

than

one

without

it

since

only

the

isolated

meaning

of

the

sub-policy

must

known

to

reason

about

its

use

under

the

combinator

Theorem

If

a

policy

combinator

of

an

policy

language

L

has

independent

composition

then

it

has

semantic

composition

Proof

To

prove

that

has

semantic

composition

-LRB-

Q

D

-RRB-

-LRB-

Q

D

-RRB-

required

for

Equation

will

be

constructed

from

the

Q

D

D

known

to

exist

since

independently

composes

Let

-LRB-

f

f

f

n

-RRB-

q

-LRB-

q

-RRB-

-LRB-

f

-LRB-

q

-RRB-

f

-LRB-

q

-RRB-

f

n

-LRB-

q

-RRB-

-RRB-

Then

-LRB-

p

p

p

n

-RRB-

q

-LRB-

q

-RRB-

-LRB-

p

-LRB-

q

-RRB-

p

-LRB-

q

-RRB-

p

-LRB-

q

-RRB-

-RRB-

q

-LRB-

p

p

p

n

-RRB-

-LRB-

q

-RRB-

-LRB-

p

p

p

n

-RRB-

Theorem

The

semantic

composition

of

a

policy

combinator

does

not

imply

that

it

independently

composes

Proof

Consider

a

rather

odd

language

that

has

only

one

unary

policy

combinator

atomic

policies

that

are

sets

of

values

G

-LCB-

permit

-RCB-

N

-LCB-

deny

-RCB-

and

requests

that

are

sets

of

values

Let

the

semantics

be

-LRB-

p

-RRB-

q

-LRB-

permit

p

-LRB-

-LCB-

v

-RCB-

-RRB-

permit

deny

p

-LRB-

-LCB-

v

-RCB-

-RRB-

deny

for

some

distinguished

value

v

and

for

atomic

policies

p

p

-LRB-

q

-RRB-

equals

permit

iff

p

q

and

equals

deny

otherwise

The

language

has

semantic

composition

for

such

that

-LRB-

f

-RRB-

-LRB-

permit

f

-LRB-

-LCB-

v

-RCB-

-RRB-

permit

deny

f

-LRB-

-LCB-

v

-RCB-

-RRB-

deny

clearly

-LRB-

p

-RRB-

-LRB-

p

-RRB-

To

show

that

the

language

does

not

have

independent

composition

assume

that

it

does

Then

there

exists

such

a

Q

D

D

to

satisfy

Equation

Let

p

-LCB-

v

-RCB-

and

p

-LCB-

v

v

-RCB-

for

some

value

v

such

that

v

v

Then

deny

-LRB-

-LCB-

v

-RCB-

-RRB-

-LRB-

-LCB-

v

-RCB-

-RRB-

-LRB-

-LCB-

v

-RCB-

-RRB-

-LRB-

-LCB-

v

-RCB-

-LRB-

-LCB-

v

-RCB-

-RRB-

-RRB-

-LRB-

-LCB-

v

-RCB-

-RRB-

-LRB-

permit

-RRB-

-LRB-

-LCB-

v

-RCB-

-RRB-

-LRB-

-LCB-

v

v

-RCB-

-LRB-

-LCB-

v

-RCB-

-RRB-

-RRB-

-LRB-

-LCB-

v

v

-RCB-

-RRB-

-LRB-

-LCB-

v

-RCB-

-RRB-

permit

A

contradiction

is

reached

since

permit

deny

Only

with

independent

composition

can

a

policy

reader

with

a

specific

request

in

mind

know

the

decision

of

the

whole

policy

from

each

of

the

component

policies

This

enables

a

reader

to

ask

what-if

questions

like

What

if

Bob

requests

to

write

the

log

and

determine

the

answer

from

recursively

asking

that

question

of

the

sub-policies

Such

an

ability

is

particularly

helpful

to

readers

interested

in

only

a

subset

of

the

possible

requests

or

already

familiar

with

some

of

the

sub-policies

Monotonicity

As

noted

at

the

end

of

Section

the

decision

of

deny

complicates

the

policy

combinators

One

of

the

reasons

for

this

is

that

under

combinators

like

Deny

Overrides

a

back-and

forth

pattern

can

arise

when

considering

the

decision

of

the

whole

policy

from

the

sub-policies

Consider

each

sub-policy

in

p

with

the

request

q

Under

a

reasonable

interpretation

p

yields

a

decision

of

permit

p

a

decision

of

deny

and

p

not

applicable

Thus

if

the

order

of

p

was

changed

to

p

p

p

and

we

assume

a

Deny

Overrides

policy

combinator

the

apparent

decision

would

go

from

non-granting

to

granting

to

non-granting

Note

that

Permit

Overrides

does

not

exhibit

this

pattern

since

it

is

impossible

to

go

from

a

granting

decision

to

a

non-granting

one

under

it

Thus

the

formalization

of

this

pattern

focuses

on

the

transition

from

a

granting

to

a

non-granting

decision

Definition

A

policy

combinator

of

a

language

L

-LRB-

P

Q

G

N

-RRB-

is

monotonic

iff

p

p

n

p

P

q

Q

-LRB-

p

p

n

-RRB-

-LRB-

q

-RRB-

-LRB-

p

p

i

p

p

i

p

n

-RRB-

-LRB-

q

-RRB-

where

Q

Q

-LRB-

p

p

n

-RRB-

Q

-LRB-

p

p

i

p

p

i

p

n

-RRB-

We

say

L

is

monotonic

if

every

combinator

is

monotonic

Adding

another

sub-policy

to

a

monotonic

combinator

can

not

change

the

decision

from

granting

to

non-granting

Having

motivated

and

established

these

criteria

we

now

apply

them

to

concrete

access

control

languages

In

its

entirety

XACML

-LSB-

-RSB-

exceeds

the

bounds

of

the

definitions

given

in

Section

Full

XACML

includes

obligations

which

act

as

annotations

on

the

decisions

of

permit

and

deny

These

annotations

specify

actions

that

the

system

enforcing

the

access

controls

must

preform

before

granting

access

or

upon

prohibiting

access

Thus

an

XACML

policy

may

have

effects

beyond

just

granting

or

prohibiting

access

that

the

model

presented

fails

to

address

Handling

all

of

XACML

is

beyond

the

scope

of

this

paper

For

illustrative

purposes

we

employ

a

formalized

subset

of

XACML

which

we

will

call

Core

XACML

-LRB-

CXACML

-RRB-

which

corresponds

to

the

input

of

the

tool

Margrave

-LSB-

-RSB-

This

subset

is

expressive

enough

to

capture

RBAC

-LSB-

-RSB-

Syntax

CXACML

has

two

syntaxes

one

for

policies

and

one

for

requests

We

present

the

policy

syntax

first

with

the

start

non-terminal

P.

For

syntactic

brevity

we

use

a

Lisp-like

parenthetical

syntax

in

place

of

XML

notation

P

-LRB-

Policy

C

T

P

-RRB-

-LRB-

Rule

T

F

-RRB-

C

FirstApp

DenyOver

PermitOver

T

-LRB-

-LRB-

L

-RRB-

-LRB-

L

-RRB-

-LRB-

L

-RRB-

-LRB-

L

-RRB-

-RRB-

L

-LRB-

A

-RRB-

A

-LRB-

id

val

-RRB-

F

Permit

Deny

Those

policies

formed

by

using

solely

the

right

choice

of

the

production

rule

for

P

are

called

rules

XACML

does

not

consider

rules

to

be

policies

However

since

the

semantics

assigned

to

rules

allows

them

to

behave

as

policies

we

will

consider

them

policies

The

elements

of

the

syntax

category

T

are

called

targets

The

four

parts

of

the

target

are

the

requirements

placed

on

the

subject

resource

action

and

environment

respectively

for

the

policy

to

apply

to

a

request

The

non-terminals

id

and

val

are

strings

representing

the

attribute

IDs

and

values

Example

The

following

is

a

CXACML

policy

-LRB-

Policy

FirstApp

-LRB-

-LRB-

-LRB-

-RRB-

-RRB-

-LRB-

-LRB-

-LRB-

name

log

-RRB-

-RRB-

-RRB-

-LRB-

-LRB-

-RRB-

-RRB-

-LRB-

-LRB-

-RRB-

-RRB-

-RRB-

-LRB-

Rule

-LRB-

-LRB-

-LRB-

role

dr

-RRB-

-RRB-

-LRB-

-LRB-

-RRB-

-RRB-

-LRB-

-LRB-

-RRB-

-RRB-

-LRB-

-LRB-

-RRB-

-RRB-

-RRB-

Deny

-RRB-

-LRB-

Rule

-LRB-

-LRB-

-LRB-

-RRB-

-RRB-

-LRB-

-LRB-

-RRB-

-RRB-

-LRB-

-LRB-

-RRB-

-RRB-

-LRB-

-LRB-

-RRB-

-RRB-

-RRB-

Permit

-RRB-

-RRB-

This

policy

permits

all

requests

for

access

to

a

log

except

those

made

by

doctors

which

it

denies

In

detail

the

policy

is

composed

of

two

sub-policies

using

the

combinator

First

Applicable

and

applies

only

to

requests

where

the

resource

has

the

name

of

log

The

first

sub-policy

denies

requests

where

the

subject

has

the

role

of

dr

regardless

of

the

resource

action

or

environment

The

second

permits

all

requests

The

syntax

for

requests

is

-LRB-

with

start

non-terminal

Q

-RRB-

Q

-LRB-

-LRB-

A

-RRB-

-LRB-

A

-RRB-

-LRB-

A

-RRB-

-LRB-

A

-RRB-

-RRB-

They

simply

list

the

attributes

possessed

by

the

subject

resource

action

and

environment

in

turn

Semantics

In

the

following

natural

semantics

we

will

use

the

convention

that

a

lower-case

letter

represents

an

element

of

the

set

or

syntactic

category

represented

by

the

upper-case

equivalent

For

example

P

is

the

set

of

all

policies

and

p

is

a

policy

Let

D

be

the

set

of

all

decisions

-LRB-

D

-LCB-

permit

deny

-RCB-

-RRB-

The

core

of

the

semantics

of

CX

ACML

compares

requests

to

targets

We

will

denote

this

relation

by

qt

for

request

q

and

target

t

The

natural

semantics

of

Table

defines

Next

we

define

Table

gives

the

result

of

evaluating

rules

The

following

tables

defines

over

policies

Table

deals

with

two

cases

where

a

policy

does

not

apply

to

a

request

Finally

we

must

define

the

policy

combinators

Permit

Overrides

in

Table

Deny

Overrides

in

Table

and

First

Applicable

in

Table

Analysis

The

syntax

and

semantics

of

CXACML

defines

L

CXACML

-LRB-

P

Q

G

N

-RRB-

The

syntax

determines

P

and

Q

where

the

same

set

of

requests

is

used

for

every

policy

-LRB-

and

thus

we

treat

Q

as

a

set

of

requests

-RRB-

From

the

semantics

G

-LCB-

permit

-RCB-

N

-LCB-

deny

-RCB-

CXACML

allows

for

explicit

denials

and

the

checking

of

the

implicit

absence

of

attributes

Theorem

L

CXACML

is

deterministic

Proof

Inspection

of

the

inference

rules

for

atomic

policies

-LRB-

Table

-RRB-

shows

that

only

one

of

them

can

hold

at

a

time

Thus

atomic

policies

are

deterministic

Table

combined

with

Table

gives

the

semantics

of

the

policy

combinator

Permit

Overrides

The

antecedents

of

all

these

inference

rules

are

disjoint

that

is

at

most

one

them

can

hold

for

any

policy

and

request

Thus

Permit

Overrides

is

deterministic

The

same

argument

holds

for

Deny

Overrides

and

First

Applicable

using

Tables

and

Thus

all

the

combinators

are

deterministic

Thus

one

may

view

a

CXACML

policy

as

a

function

from

requests

to

decisions

with

in

place

of

Further

inspection

establishes

that

is

a

total

function

For

two

requests

q

-LRB-

s

r

a

e

-RRB-

and

q

-LRB-

s

r

a

e

-RRB-

let

q

p

q

-LRB-

for

every

policy

p

-RRB-

if

s

s

r

r

a

a

and

e

e

where

is

defined

in

Table

Theorem

CXACML

is

not

safe

with

respect

to

Proof

Consider

the

policy

p

shown

in

Example

and

the

requests

q

-LRB-

-LRB-

-RRB-

-LRB-

-LRB-

name

log

-RRB-

-RRB-

-LRB-

-RRB-

-LRB-

-RRB-

-RRB-

and

q

-LRB-

-LRB-

-LRB-

role

dr

-RRB-

-RRB-

-LRB-

-LRB-

name

log

-RRB-

-RRB-

-LRB-

-RRB-

-LRB-

-RRB-

-RRB-

Clearly

q

p

q

Yet

p

-LRB-

q

-RRB-

permit

deny

p

-LRB-

q

-RRB-

Theorem

L

CXACML

has

independent

composition

Proof

A

combination

algorithm

c

and

target

t

together

determine

a

policy

combinator

For

each

pair

of

values

for

c

and

t

the

needed

function

t

c

Q

D

D

exists

to

provide

the

meaning

of

the

policy

-LRB-

Policy

c

t

p

p

-RRB-

and

satisfy

Equation

For

Permit

Overrides

-LRB-

when

c

PermitOver

or

PO

for

short

-RRB-

the

function

t

PO

-LRB-

q

-RRB-

-LRB-

d

d

-RRB-

is

equal

to

if

q

t

permit

else

if

d

permit

t

PO

-LRB-

q

-RRB-

-LRB-

d

-RRB-

permit

deny

else

if

d

deny

t

PO

-LRB-

q

-RRB-

-LRB-

d

-RRB-

deny

otherwise

The

function

t

DO

-LRB-

q

-RRB-

-LRB-

d

d

-RRB-

for

Deny

Overrides

is

equal

to

if

q

t

deny

else

if

d

deny

t

DO

-LRB-

q

-RRB-

-LRB-

d

-RRB-

deny

permit

else

if

d

permit

t

DO

-LRB-

q

-RRB-

-LRB-

d

-RRB-

permit

otherwise

For

First

Applicable

t

FA

-LRB-

q

-RRB-

-LRB-

d

d

-RRB-

is

-LRB-

a

-RRB-

-LRB-

l

-RRB-

-LRB-

a

-RRB-

-LRB-

l

-RRB-

-LRB-

a

-RRB-

-LRB-

l

-RRB-

-LRB-

a

-RRB-

-LRB-

l

-RRB-

-LRB-

-LRB-

a

-RRB-

-LRB-

a

-RRB-

-LRB-

a

-RRB-

-LRB-

a

-RRB-

-RRB-

-LRB-

-LRB-

l

-RRB-

-LRB-

l

-RRB-

-LRB-

l

-RRB-

-LRB-

l

-RRB-

-RRB-

i

s.t.

l

i

-LRB-

a

-RRB-

-LRB-

a

-RRB-

-LRB-

l

l

l

n

-RRB-

i

j

s.t.

a

i

a

j

-LRB-

a

a

a

n

-RRB-

-LRB-

a

a

a

m

-RRB-

Table

The

Match

Relationship

q

t

q

-LRB-

Rule

t

f

-RRB-

qt

q

-LRB-

Rule

t

Permit

-RRB-

permit

qt

q

-LRB-

Rule

t

Deny

-RRB-

deny

Table

on

Rules

q

-LRB-

Policy

c

t

-RRB-

q

t

q

-LRB-

Policy

c

t

p

-RRB-

Table

Default

Inference

Rules

qt

i

s.t.

q

p

i

permit

q

-LRB-

Policy

PermitOver

t

p

p

p

n

-RRB-

permit

qt

i

s.t.

q

p

i

deny

j

-LRB-

q

p

j

permit

-RRB-

q

-LRB-

Policy

PermitOver

t

p

p

p

n

-RRB-

deny

qt

i

q

p

i

q

-LRB-

Policy

PermitOver

t

p

p

p

n

-RRB-

Table

Inference

Rules

for

Permit

Overrides

qt

i

s.t.

q

p

i

deny

q

-LRB-

Policy

DenyOver

t

p

p

p

n

-RRB-

deny

qt

i

s.t.

q

p

i

permit

j

-LRB-

q

p

j

deny

-RRB-

q

-LRB-

Policy

DenyOver

t

p

p

p

n

-RRB-

permit

qt

i

q

p

i

q

-LRB-

Policy

DenyOver

t

p

p

p

n

-RRB-

Table

Inference

Rules

for

Deny

Overrides

qt

q

p

permit

q

-LRB-

Policy

FirstApp

t

p

p

p

n

-RRB-

permit

qt

q

p

deny

q

-LRB-

Policy

FirstApp

t

p

p

p

n

-RRB-

deny

qt

q

p

q

-LRB-

Policy

FirstApp

t

p

p

n

-RRB-

d

q

-LRB-

Policy

FirstApp

t

p

p

p

n

-RRB-

d

Table

Inference

Rules

for

First

Applicable

if

q

t

d

else

if

d

permit

d

deny

t

FA

-LRB-

q

-RRB-

-LRB-

d

-RRB-

otherwise

where

t

PO

-LRB-

-RRB-

t

DO

-LRB-

-RRB-

t

FA

-LRB-

-RRB-

for

the

empty

sequence

Theorem

L

CXACML

is

not

monotonic

Proof

Consider

the

policy

p

in

Example

and

the

policy

p

that

would

be

p

without

the

first

rule

Let

the

request

q

be

-LRB-

-LRB-

-LRB-

role

dr

-RRB-

-RRB-

-LRB-

-LRB-

name

log

-RRB-

-RRB-

-LRB-

-RRB-

-LRB-

-RRB-

-RRB-

p

-LRB-

q

-RRB-

permit

but

p

-LRB-

q

-RRB-

deny

Thus

adding

a

rule

to

p

results

in

a

request

going

from

being

granted

to

not

being

granted

Whereas

XACML

is

an

attempt

to

create

a

policy

language

from

whole

cloth

other

languages

are

adaptations

of

first-order

logic

Halpern

and

Weissman

present

several

schemata

for

such

languages

-LSB-

-RSB-

Here

we

present

and

analyze

the

languages

produced

by

two

of

their

schemata

Lithium

and

L

For

the

ease

presentation

first

we

define

the

language

schemata

FOL

a

more

readily

identifiable

restriction

of

first-order

logic

To

ensure

efficiency

-LRB-

and

decidability

-RRB-

the

languages

of

L

and

Lithium

use

additional

context-sensitive

constraints

to

restrict

FOL

We

discuss

these

restrictions

after

giving

a

semantics

to

FOL

-LRB-

The

semantics

of

L

and

Lithium

will

be

the

same

as

that

of

FOL

restricted

to

subsets

of

the

language

-RRB-

The

schemata

FOL

is

a

restriction

of

many-sorted

first-order

logic

Each

language

of

FOL

corresponds

to

giving

the

logic

a

different

vocabulary

-LRB-

the

parameters

including

quantifier

symbols

predicate

symbols

constant

symbols

and

function

symbols

-RRB-

We

assume

that

includes

the

sorts

S

for

subjects

R

for

resources

A

for

actions

and

the

predicate

symbol

Permit

of

the

sort

S

R

A

-LCB-

T

F

-RCB-

may

also

include

sorts

to

represent

environmental

data

such

as

the

current

time

and

location

Syntax

of

FOL

A

standard

policy

under

the

vocabulary

is

an

expression

with

one

of

the

following

forms

-LRB-

y

x

y

m

x

m

-LRB-

n

Permit

-LRB-

s

r

a

-RRB-

-RRB-

-RRB-

-LRB-

y

x

y

m

x

m

-LRB-

n

Permit

-LRB-

s

r

a

-RRB-

-RRB-

-RRB-

where

each

x

i

names

a

variable

over

the

sort

identified

by

y

i

s

is

a

term

over

the

sort

S

r

is

a

term

over

the

sort

R

a

is

a

term

over

the

sort

A

and

each

j

is

a

literal

over

that

may

include

the

variables

x

x

m

The

policies

of

the

language

FOL

-LRB-

-RRB-

are

the

standard

policies

under

and

conjunctions

of

policies

P

StandardPolicy

-LRB-

and

P

-RRB-

Example

Let

the

vocabulary

contain

the

sorts

S

-LCB-

amy

bob

joe

-RCB-

R

-LCB-

grades

courses

-RCB-

and

A

-LCB-

assign

enroll

-RCB-

Halpern

and

Weissman

treat

the

Permit

predicate

as

taking

two

arguments

a

subject

and

a

resource-action

instead

of

three

the

predicates

Permit

S

R

A

-LCB-

T

F

-RCB-

faculty

S

-LCB-

T

F

-RCB-

and

student

S

-LCB-

T

F

-RCB-

FOL

-LRB-

-RRB-

includes

the

following

policy

-LRB-

and

-LRB-

S

x

-LRB-

faculty

-LRB-

x

-RRB-

Permit

-LRB-

x

grades

assign

-RRB-

-RRB-

-RRB-

-LRB-

S

x

-LRB-

student

-LRB-

x

-RRB-

Permit

-LRB-

x

grades

assign

-RRB-

-RRB-

-RRB-

-LRB-

S

x

-LRB-

faculty

-LRB-

x

-RRB-

Permit

-LRB-

x

courses

enroll

-RRB-

-RRB-

-RRB-

-RRB-

where

S

identifies

the

sort

S

As

the

semantics

will

soon

show

this

policy

has

the

same

meaning

as

policy

p

from

Section

does

under

Interpretation

The

requests

of

FOL

-LRB-

-RRB-

have

the

form

-LRB-

s

r

a

e

-RRB-

where

s

S

is

the

subject

making

the

request

r

R

is

the

requested

resource

a

A

is

the

action

the

subject

would

like

to

preform

on

the

resource

and

e

is

a

conjunction

of

ground

literals

and

universal

formulas

of

the

form

y

x

y

m

x

m

-LRB-

n

n

-RRB-

where

each

x

i

names

a

variable

over

the

sort

identified

by

y

i

and

each

i

is

a

literal

over

that

may

include

the

variables

x

l

x

m

The

expression

e

provides

information

about

s

r

a

and

the

environment

Example

The

four-tuple

-LRB-

bob

courses

enroll

student

-LRB-

bob

-RRB-

faculty

-LRB-

amy

-RRB-

student

-LRB-

amy

-RRB-

-RRB-

is

a

request

of

FOL

-LRB-

-RRB-

where

is

defined

in

Example

Semantics

of

FOL

The

semantics

of

a

policy

follows

from

interpreting

it

as

a

formula

in

many-sorted

first-order

logic

The

policy

combinator

and

becomes

conjunction

The

standard

policies

and

e

are

interpreted

as

the

corresponding

logic

formulas

A

policy

p

defines

a

relation

p

between

requests

and

-LCB-

permit

deny

-RCB-

as

follows

-LRB-

s

r

a

e

-RRB-

p

permit

iff

p

e

Permit

-LRB-

s

r

a

-RRB-

-LRB-

s

r

a

e

-RRB-

p

deny

iff

p

e

Permit

-LRB-

s

r

a

-RRB-

where

is

interpreted

as

the

standard

proves

relation

for

many-sorted

first-order

logic

over

To

define

a

deterministic

and

total

version

of

FOL

we

expand

the

set

of

decisions

to

D

-LCB-

permit

deny

error

-RCB-

and

define

p

-LRB-

-LRB-

s

r

a

e

-RRB-

-RRB-

to

be

error

if

pe

Permit

-LRB-

s

r

a

-RRB-

and

pe

Permit

-LRB-

s

r

a

-RRB-

permit

if

pe

Permit

-LRB-

s

r

a

-RRB-

and

pe

Permit

-LRB-

s

r

a

-RRB-

deny

if

pe

Permit

-LRB-

s

r

a

-RRB-

and

pe

Permit

-LRB-

s

r

a

-RRB-

if

pe

Permit

-LRB-

s

r

a

-RRB-

and

pe

Permit

-LRB-

s

r

a

-RRB-

Since

a

policy

composed

of

sub-policies

each

composed

of

standard

policies

is

semantically

equivalent

to

a

policy

composed

of

all

the

standard

policies

without

the

intermediate

sub-policies

we

will

henceforth

treat

all

policies

as

either

a

standard

policy

or

a

conjunction

of

standard

policies

Analysis

of

FOL

The

language

FOL

-LRB-

-RRB-

defines

the

deterministic

and

total

policy

language

-LRB-

P

Q

G

N

-RRB-

The

syntax

determines

P

and

Q

where

Q

may

be

treated

as

a

set

of

requests

since

for

all

policies

p

and

p

Q

p

Q

p

The

semantics

requires

that

G

-LCB-

permit

-RCB-

and

N

-LCB-

deny

error

-RCB-

The

languages

of

FOL

has

the

policy

combinator

and

FOL

allows

for

explicit

denials

and

checking

for

the

explicit

absence

of

attributes

Given

two

requests

q

-LRB-

s

r

a

e

-RRB-

and

q

-LRB-

s

r

a

e

-RRB-

if

s

s

r

r

or

a

a

we

consider

the

two

requests

incomparable

If

s

s

r

r

and

a

a

then

we

would

like

to

order

requests

according

to

their

information

content

One

might

conclude

that

q

p

q

if

e

e.

However

suppose

e

where

is

logical

contradiction

Then

e

contains

no

information

and

yet

it

implies

e.

Similarly

if

p

e

then

e

contains

no

information

with

respect

to

p.

Thus

we

define

p

as

follows

Let

-LRB-

s

r

a

e

-RRB-

p

-LRB-

s

r

a

e

-RRB-

iff

s

s

r

r

and

a

a

and

p

e

implies

p

e

but

not

or

p

e

implies

Theorem

FOL

-LRB-

-RRB-

is

safe

with

respect

to

for

any

vocabulary

Proof

Assume

FOL

-LRB-

-RRB-

is

not

safe

Then

there

must

exist

p

P

and

q

q

Q

such

that

q

p

q

and

p

-LRB-

q

-RRB-

p

-LRB-

q

-RRB-

Let

q

-LRB-

s

r

a

e

-RRB-

and

q

-LRB-

s

r

a

e

-RRB-

Since

permit

is

the

only

granting

decision

p

-LRB-

q

-RRB-

permit

and

thus

p

e

Permit

-LRB-

s

r

a

-RRB-

Since

N

-LCB-

deny

error

-RCB-

p

-LRB-

q

-RRB-

must

be

either

deny

or

error

Since

q

p

q

two

cases

arise

pe

implies

pe

but

not

Since

pe

pe

and

pe

Permit

-LRB-

s

r

a

-RRB-

pe

Permit

-LRB-

s

r

a

-RRB-

Thus

p

-LRB-

q

-RRB-

is

either

permit

or

error

However

if

p

-LRB-

q

-RRB-

error

then

pe

a

contradiction

Furthermore

p

-LRB-

q

-RRB-

permit

N

is

also

a

contradiction

p

e

implies

In

this

case

p

-LRB-

q

-RRB-

error

permit

a

contradiction

We

can

thus

conclude

that

FOL

-LRB-

-RRB-

must

be

safe

Theorem

FOL

-LRB-

-RRB-

does

not

have

independent

composition

for

some

Proof

Consider

the

policy

p

a

-LRB-

and

-LRB-

S

x

student

-LRB-

x

-RRB-

Permit

-LRB-

x

log

read

-RRB-

-RRB-

-LRB-

S

x

student

-LRB-

x

-RRB-

Permit

-LRB-

x

log

read

-RRB-

-RRB-

-RRB-

the

policy

p

b

-LRB-

and

-LRB-

S

x

student

-LRB-

x

-RRB-

Permit

-LRB-

x

log

edit

-RRB-

-RRB-

-LRB-

S

x

student

-LRB-

x

-RRB-

Permit

-LRB-

x

log

edit

-RRB-

-RRB-

-RRB-

and

request

q

-LRB-

bob

log

read

T

-RRB-

On

q

p

a

produces

the

decision

of

permit

while

its

sub-policies

yield

However

p

b

produces

the

decision

of

while

its

sub-policies

also

yield

on

q.

Thus

the

required

function

and

would

have

to

satisfy

permit

and

-LRB-

q

-RRB-

-LRB-

-RRB-

A

contradiction

and

hence

and

can

not

exist

Theorem

FOL

-LRB-

-RRB-

is

not

monotonic

for

some

Proof

Consider

the

policy

p

c

-LRB-

and

-LRB-

S

x

student

-LRB-

x

-RRB-

Permit

-LRB-

x

log

read

-RRB-

-RRB-

-LRB-

S

x

student

-LRB-

x

-RRB-

Permit

-LRB-

x

log

read

-RRB-

-RRB-

-RRB-

with

and

without

the

second

sub-policy

and

the

request

-LRB-

bob

log

read

student

-LRB-

bob

-RRB-

-RRB-

In

the

absence

of

the

second

sub-policy

the

decision

is

permit

whereas

p

c

produces

error

Analysis

of

Lithium

Halpern

and

Weissman

restrict

FOL

to

create

the

language

they

dub

Lithium

A

slightly

modified

form

follows

Lithium

relies

heavily

on

the

notion

of

bipolarity

A

literal

of

f

is

labeled

bipolar

in

f

relative

to

the

equality

statements

in

e

if

the

following

holds

there

exists

a

term

in

f

and

variable

substitutions

and

such

that

it

follows

from

e

that

Lithium

also

makes

use

of

the

notion

of

equality-safety

-LRB-

p

e

e

-RRB-

is

equality-safe

if

e

p

when

written

in

CNF

-LRB-

i.e.

of

the

form

c

c

n

where

each

c

j

has

the

form

y

x

y

m

x

m

-LRB-

-RRB-

where

is

a

qualifier-free

disjunction

of

literals

-RRB-

has

no

clause

with

a

disjunct

of

the

form

t

t

and

it

is

not

the

case

that

f

t

t

where

f

is

the

conjunction

of

the

equality

statements

in

e

where

t

and

t

are

closed

terms

such

that

-LRB-

-RRB-

they

both

appear

in

e

and

-LRB-

-RRB-

either

t

is

a

sub-term

of

t

or

both

t

and

t

mention

function

symbols

Like

FOL

Lithium

is

a

set

of

languages

each

with

a

different

vocabulary

Let

Li

-LRB-

-RRB-

be

the

instance

of

Lithium

using

the

vocabulary

Li

-LRB-

-RRB-

has

the

same

set

of

policies

as

FOL

-LRB-

-RRB-

However

each

policy

p

of

Li

-LRB-

-RRB-

has

a

different

set

of

requests

for

which

it

is

defined

-LRB-

a

different

value

for

Q

p

-RRB-

A

request

-LRB-

s

r

a

e

e

-RRB-

of

FOL

-LRB-

-RRB-

is

in

Q

p

iff

e

is

a

basic

environment

-LRB-

a

conjunction

of

ground

terms

-RRB-

e

is

a

conjunction

of

universally

quantified

formulas

-LRB-

p

e

e

-RRB-

is

equality-safe

and

every

conjunct

of

e

p

has

at

most

one

literal

that

is

bipolar

in

e

p

relative

to

the

equality

statements

in

e

Lithium

is

safe

since

its

requests

are

a

subset

of

those

of

FOL

Theorem

Lithium

does

not

have

independent

composition

for

some

Proof

Consider

the

policies

p

a

and

p

b

and

the

request

given

with

them

in

the

proof

of

Theorem

The

request

is

in

Q

p

a

To

show

this

we

check

that

the

request

satisfies

all

four

of

the

requirements

for

a

request

to

be

in

Q

p

a

given

above

Since

e

e

T

the

first

three

requirements

hold

The

last

requirement

holds

since

student

-LRB-

x

-RRB-

and

student

-LRB-

x

-RRB-

are

the

only

bipolars

and

they

are

each

in

a

different

conjunct

By

similar

reasoning

the

request

is

also

in

Q

p

b

Thus

the

proof

follows

as

before

Analysis

of

L

In

their

work

Halpern

and

Weissman

define

a

further

restriction

of

FOL

which

they

call

L

Like

Lithium

L

-LRB-

-RRB-

includes

all

the

policies

of

FOL

-LRB-

-RRB-

with

each

policy

having

a

different

set

of

requests

for

which

it

is

defined

For

a

policy

p

of

L

-LRB-

-RRB-

Q

p

consists

of

all

the

requests

-LRB-

s

r

a

e

-RRB-

of

FOL

-LRB-

-RRB-

such

that

The

name

Lithium

only

appears

in

the

version

of

their

work

-LSB-

-RSB-

e

is

a

basic

environment

equality

is

not

used

in

e

or

p

for

every

atomic

policy

p

in

p

all

variables

appearing

in

p

appears

as

an

argument

to

Permit

in

p

and

there

are

no

bipolars

in

p

relative

to

the

empty

set

of

equality

statements

As

with

Lithium

L

-LRB-

-RRB-

is

safe

since

it

is

a

subset

of

a

safe

language

Halpern

and

Weissman

have

proven

the

following

theorem

-LRB-

Proposition

in

their

updated

document

-LSB-

-RSB-

-RRB-

Theorem

Let

p

be

a

compound

policy

and

-LRB-

s

r

a

e

-RRB-

be

a

request

of

L

Then

e

p

Permit

-LRB-

s

r

a

-RRB-

iffthere

is

a

sub-policy

p

of

p

such

that

e

p

Permit

-LRB-

s

r

a

-RRB-

Using

the

same

approach

as

given

in

their

proof

one

can

generalize

this

proof

to

include

statements

of

the

form

ep

Permit

-LRB-

s

r

a

-RRB-

also

Theorem

L

-LRB-

-RRB-

has

independent

composition

for

all

Proof

Allowing

p

i

to

range

over

the

sub-policies

of

p

the

above

result

yields

p

-LRB-

q

-RRB-

error

i

j

p

i

-LRB-

q

-RRB-

permit

p

j

-LRB-

q

-RRB-

deny

permit

else

if

i

p

i

-LRB-

q

-RRB-

permit

deny

else

if

i

p

i

-LRB-

q

-RRB-

deny

deny

otherwise

From

this

it

is

easy

to

construct

an

appropriate

value

for

and

-LRB-

q

-RRB-

-LRB-

d

d

d

n

-RRB-

error

if

i

j

d

i

permit

d

j

deny

permit

else

if

i

d

i

permit

deny

else

if

i

d

i

deny

deny

otherwise

Notice

that

and

does

not

use

the

value

of

q

it

merely

composes

the

results

from

its

sub-policies

A

policy

author

concerned

solely

with

expressive

power

would

select

Lithium

over

L

However

the

choice

becomes

more

complicated

when

concerned

about

the

ability

to

reason

about

policies

because

only

L

features

independent

composition

We

hope

that

elucidating

this

trade-off

with

a

combination

of

proof

and

illustrative

examples

as

we

have

done

above

will

help

authors

choose

better

between

the

policy

languages

they

use

even

when

the

languages

are

within

the

same

family

De

Capitani

di

Vimercati

et

al.

discuss

explicit

denial

and

how

it

introduces

the

need

for

policy

combinators

that

reduce

the

clarity

of

the

language

-LSB-

-RSB-

The

authors

list

various

policy

combinators

that

are

possible

many

of

which

are

more

complex

than

those

we

present

The

paper

includes

discussion

of

a

few

policy

languages

including

XACML

and

a

language

grounded

in

first-order

logic

The

paper

does

not

however

attempt

to

systemically

compare

them

The

work

of

Mark

Evered

and

Serge

B

ogeholz

concerns

the

quality

of

a

policy

language

-LSB-

-RSB-

After

conducting

a

case

study

of

the

access-control

requirements

of

a

health

information

system

they

proposed

a

list

of

criteria

for

policy

languages

They

state

that

languages

should

be

concise

clear

aspect-oriented

-LRB-

i.e.

separate

from

the

application

code

-RRB-

fundamental

-LRB-

i.e.

integrated

with

the

middleware

not

an

ad

hoc

addition

-RRB-

positive

-LRB-

i.e.

lists

what

is

allowed

not

what

is

prohibited

-RRB-

supportive

of

needs-to-know

and

efficient

Although

they

compare

four

languages

based

on

these

criteria

they

do

not

formalize

the

criteria

Some

authors

have

considered

formal

treatments

of

programming

language

expressiveness

-LSB-

-RSB-

Felleisen

's

is

the

closest

in

spirit

to

ours

His

framework

examines

the

ability

to

translate

the

features

of

one

language

in

the

other

with

only

local

transformations

That

work

does

not

however

directly

address

reasoning

This

paper

presents

our

analysis

framework

and

its

findings

Some

differences

between

languages

lie

in

the

realms

of

decision

sets

policy

combinators

and

checking

for

the

absence

of

attributes

but

these

are

clear

from

the

language

definitions

Our

framework

highlights

the

following

more

subtle

semantic

differences

Independence

Core

XACML

and

L

feature

independent

composition

of

polices

into

compound

policies

and

thus

allow

for

reasoning

about

a

policy

by

reasoning

about

the

sub-policies

separately

Lithium

in

contrast

does

not

exhibit

this

property

and

therefore

potentially

requires

reasoning

about

a

policy

all

at

once

Safety

L

and

Lithium

provide

safety

for

the

most

natural

definition

of

the

contains

more

information

ordering

Core

XACML

in

contrast

does

not

which

implies

that

information

missing

from

a

Core

XACML

request

could

result

in

unintended

access

being

granted

These

differences

are

not

orthogonal

Clearly

the

combinators

selected

determine

whether

the

language

will

have

independent

composition

Furthermore

implicit

checking

of

attributes

will

result

in

the

loss

of

safety

These

properties

may

guide

policy

language

designers

For

example

suppose

a

designer

wishes

to

create

a

safe

variant

of

XACML

One

way

to

achieve

this

would

be

to

eliminate

rules

that

deny

access

and

thus

the

decision

of

deny

-LRB-

We

provide

further

details

in

an

extended

version

of

this

work

-LSB-

-RSB-

-RRB-

As

noted

in

Section

the

comparison

framework

must

be

generalized

to

treat

language

with

more

exotic

constructs

like

obligations

More

importantly

we

need

to

perform

user

studies

to

determine

whether

and

how

well

our

properties

correlate

with

policy

comprehension

by

humans

Lastly

this

framework

should

be

coupled

with

one

for

measuring

the

expressive

power

of

a

policy

language

before

fair

judgment

may

be

passed

on

languages

We

thank

Joe

Halpern

and

Vicky

Weissman

for

useful

conversations

and

for

sharing

their

ongoing

work

We

also

thank

Konstantin

Beznosov

Kathi

Fisler

and

Steve

Reiss

This

work

was

partially

supported

by

NSF

grant

to

Brown

University

and

by

the

Army

Research

Office

through

grant

number

-LRB-

Perpetually

Available

and

Secure

Information

Systems

-RRB-

to

Carnegie

Mellon

Uni-versity

's

CyLab

-LSB-

-RSB-

A.

Anderson

Core

and

hierarchical

role

based

access

control

-LRB-

RBAC

-RRB-

profile

of

XACML

version

Technical

report

OASIS

Sept.

-LSB-

-RSB-

M.

Y.

Becker

and

P.

Sewell

Cassandra

Flexible

trust

management

applied

to

electronic

health

records

In

IEEE

Computer

Security

Foundations

Workshop

pages

-LSB-

-RSB-

E.

Bertino

P.

Samarati

and

S.

Jajodia

Authorizations

in

relational

database

management

systems

In

ACM

Conference

on

Computer

and

Communications

Security

pages

-LSB-

-RSB-

S.

De

Capitani

di

Vimercati

P.

Samarati

and

S.

Jajodia

Policies

models

and

languages

for

access

control

In

Databases

in

Networked

Information

Systems

International

Workshop

volume

of

Lecture

Notes

in

Computer

Science

Springer-Verlag

Mar.

-LSB-

-RSB-

M.

Evered

and

S.

B

ogeholz

A

case

study

in

access

control

requirements

for

a

health

information

system

In

Workshop

on

Australasian

Information

Security

Data

Mining

and

Web

Intelligence

and

Software

Internationalisation

pages

-LSB-

-RSB-

M.

Felleisen

On

the

expressive

power

of

programming

languages

Science

of

Computer

Programming

-LSB-

-RSB-

K.

Fisler

S.

Krishnamurthi

L.

A.

Meyerovich

and

M.

C.

Tschantz

Verification

and

change-impact

analysis

of

access-control

policies

In

International

Conference

on

Software

Engineering

pages

May

-LSB-

-RSB-

M.

M.

Greenberg

C.

Marks

L.

A.

Meyerovich

and

M.

C.

Tschantz

The

soundness

and

completeness

of

Margrave

with

respect

to

a

subset

of

XACML

Technical

Report

Department

of

Computer

Science

Brown

University

Apr.

-LSB-

-RSB-

J.

Halpern

and

V.

Weissman

Using

first-order

logic

to

reason

about

policies

In

IEEE

Computer

Security

Foundations

Workshop

pages

Updated

version

available

at

cgi-bin/citations

id

oai

arXiv.org

-LSB-

-RSB-

S.

Jajodia

P.

Samarati

V.

S.

Subrahmanian

and

E.

Bertino

A

unified

framework

for

enforcing

multiple

access

control

policies

In

ACM

SIGMOD

International

Conference

on

Management

of

Data

pages

-LSB-

-RSB-

J.

C.

Mitchell

On

abstraction

and

the

expressive

power

of

programming

languages

Science

of

Computer

Programming

-LSB-

-RSB-

OASIS

eXtensible

Access

Control

Markup

Language

-LRB-

XACML

-RRB-

version

OASIS

Standard

Feb.

-LSB-

-RSB-

C.

Powers

and

M.

Schunter

Enterprise

privacy

authorization

language

-LRB-

EPAL

-RRB-

Member

Submission

Nov.

-LSB-

-RSB-

R.

S.

Sandhu

E.

J.

Coyne

H.

L.

Feinstein

and

C.

E.

Youman

Role-based

access

control

models

IEEE

Computer

-LRB-

-RRB-

-LSB-

-RSB-

M.

C.

Tschantz

and

S.

Krishnamurthi

Towards

reasonability

properties

for

access-control

policy

languages

with

extended

XACML

analysis

Technical

Report

Department

of

Computer

Science

Brown

University

Apr.

policy language
security
xacml
policy combinator
lithium
properties
formalize
policy decomposition
access control
policy
common features

first order logic
modularity
reasonability property
access-control policy
multiple policy language
policy language property
comtemporary policy
policy languague