Automata-Based Bottom-Up Design of Conflict-Free Security Policies Specified as Policy Expressions

Abstract

Security policies (or more briefly: policies) are used to filter accesses to computing resources. A policy is usually specified by a table of rules, where each rule specifies conditions to accept or reject an access request. Since the acceptance of malicious requests or the rejection of legitimate requests may lead to serious consequences, the correct design of policies is very important. The present paper is inspired by two works: the first one uses an automata-based method to design policies, while the second one suggests a bottom-up design method of policies specified as policy expressions. A policy expression looks like a boolean expression, where policies are composed using three operators: $\lnot$, $\wedge$, $\vee$. In this paper, we generalize the automata-based method for the bottom-up design of policies specified as policy expressions. In our context, designing a policy specified as a policy expression $PE$ amounts to constructing an automaton $\varGamma _{ PE }$ that models the access control specified in $PE$. To respect the essence of bottom-up design, the automaton $\varGamma _{ PE }$ is constructed incrementally, by first constructing the automata that model the basic policies that compose $PE$, and then constructing incrementally the automata that model the subexpressions that compose $PE$, until we obtain $\varGamma _{ PE }$. Then we show how to use $\varGamma _{ PE }$ to determine whether $PE$ verifies several properties, namely adequacy, implication, and equivalence. Also, we study the problem of conflicting rules, i.e. policy rules that do not agree on whether some request must be accepted or rejected. We show that our bottom-up design supports any strategy of conflict resolution.