Skip to main content
SpringerLink
Log in
Book cover

International Conference on Integrated Formal Methods

IFM 2018: Integrated Formal Methods pp 69–88Cite as

Efficiently Characterizing the Undefined Requests of a Rule-Based System

  • Conference paper
  • First Online:

Part of the book series: Lecture Notes in Computer Science ((LNPSE,volume 11023))

Abstract

Rule-based systems are used to define complex policies in several contexts, because of the flexibility and modularity they provide. This is especially critical for security systems, which may require to compose evolving policies for privacy, accountability, access control, etc. The inclusion of conflicting rules in complex policies, results in the inability of the system to unambiguously answer to certain requests, with possibly unpredictable effects. The static identification of these undefined requests is particularly challenging for unconstrained rule-based systems, including quantifiers, computations and chaining of rules. In this paper we introduce a static method to precisely characterize the set of all undefined requests for a given unconstrained rule-based system, providing the user with a global view of the rule conflicts. We propose an enumerative approach, made usable in practice by two key performance optimizations: a finer classification of the rules and the resort of the topological sorting. We demonstrate its application on a well-known policy with more than fifty rules.

This is a preview of subscription content, log in via an institution.

Chapter
USD   29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD   39.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD   54.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Learn about institutional subscriptions

Notes

  1. 1.

    To improve readability, we simplify the actual output from our prototype in Listing 1.2. The complete output and our prototype can be found in https://github.com/atlanmod/ACP.

  2. 2.

    Efficiently characterizing the undefined requests of a rule-based system (on-line). https://github.com/atlanmod/ACP.git.

  3. 3.

    http://cs.brown.edu/research/plt/software/margrave/versions/01-01/examples/.

  4. 4.

    RBAC and ARBAC policies for a small health care facility. http://www3.cs.stonybrook.edu/~stoller/ccs2007/.

References

  1. Zacharias, V.: Development and verification of rule based systems - a survey of developers. In: Bassiliades, N., Governatori, G., Paschke, A. (eds.) RuleML 2008. LNCS, vol. 5321, pp. 6–16. Springer, Heidelberg (2008). https://doi.org/10.1007/978-3-540-88808-6_4

    Chapter  Google Scholar 

  2. Coenen, F., Eaglestone, B., Ridley, M.J.: Verification, validation, and integrity issues in expert and database systems: two perspectives. Int. J. Intell. Syst. 16(3), 425–447 (2001)

    Article  Google Scholar 

  3. Paschke, A.: Verification, validation and integrity of distributed and interchanged rule based policies and contracts in the semantic web. In: Semantic Web, 2nd International Semantic Web Policy Workshop (SWPW 2006). CEUR-WS.org (2006)

    Google Scholar 

  4. Han, W., Lei, C.: A survey on policy languages in network and security management. Comput. Netw. 56(1), 477–489 (2012)

    Article  Google Scholar 

  5. Hanamsagar, A., Jane, N., Borate, B., Wasvand, A., Darade, S.: Firewall anomaly management: a survey. Int. J. Comput. Appl. 105(18), 1–5 (2014)

    Google Scholar 

  6. Aqib, M., Shaikh, R.A.: Analysis and comparison of access control policies validation mechanisms. I.J. Comput. Netw. Inf. Secur. 7(1), 54–69 (2015)

    Google Scholar 

  7. Lin, D., Rao, P., Bertino, E., Li, N., Lobo, J.: Exam: a comprehensive environment for the analysis of access control policies. Int. J. Inf. Sec 9(4), 253–273 (2010)

    Article  Google Scholar 

  8. Hwang, J., Xie, T., Hu, V.C.: Detection of multiple-duty-related security leakage in access control policies. In: Secure Software Integration and Reliability Improvement, pp. 65–74. IEEE Computer Society (2009)

    Google Scholar 

  9. Montangero, C., Reiff-Marganiec, S., Semini, L.: Logic-based conflict detection for distributed policies. Fundamantae Informatica 89(4), 511–538 (2008)

    MathSciNet  MATH  Google Scholar 

  10. Halpern, J.Y., Weissman, V.: Using first-order logic to reason about policies. ACM Trans. Inf. Syst. Secur. 11(4), 1–41 (2008)

    Article  Google Scholar 

  11. Craven, R., Lobo, J., Ma, J., Russo, A., Lupu, E.C., Bandara, A.K.: Expressive policy analysis with enhanced system dynamicity. In: Li, W., Susilo, W., Tupakula, U.K., Safavi-Naini, R., Varadharajan, V. (eds.) Proceedings of the 2009 ACM Symposium on Information, Computer and Communications Security, pp. 239–250. ACM (2009)

    Google Scholar 

  12. Turkmen, F., den Hartog, J., Ranise, S., Zannone, N.: Analysis of XACML policies with SMT. In: Focardi, R., Myers, A. (eds.) POST 2015. LNCS, vol. 9036, pp. 115–134. Springer, Heidelberg (2015). https://doi.org/10.1007/978-3-662-46666-7_7

    Chapter  Google Scholar 

  13. Ni, Q., et al.: Privacy-aware role-based access control. ACM Trans. Inf. Syst. Secur. 13(3), 24:1–24:31 (2010)

    Article  Google Scholar 

  14. Neri, M.A., Guarnieri, M., Magri, E., Mutti, S., Paraboschi, S.: Conflict detection in security policies using semantic web technology. In: Satellite Telecommunications (ESTEL), pp. 1–6. IEEE (2012)

    Google Scholar 

  15. Armando, A., Ranise, S.: Automated and efficient analysis of role-based access control with attributes. In: Cuppens-Boulahia, N., Cuppens, F., Garcia-Alfaro, J. (eds.) DBSec 2012. LNCS, vol. 7371, pp. 25–40. Springer, Heidelberg (2012). https://doi.org/10.1007/978-3-642-31540-4_3

    Chapter  Google Scholar 

  16. Hu, H., Ahn, G.J., Kulkarni, K.: Discovery and resolution of anomalies in web access control policies. IEEE Trans. Dependable Sec. Comput. 10(6), 341–354 (2013)

    Article  Google Scholar 

  17. Shaikh, R.A., Adi, K., Logrippo, L.: A data classification method for inconsistency and incompleteness detection in access control policy sets. Int. J. Inf. Sec. 16(1), 91–113 (2017)

    Article  Google Scholar 

  18. Deng, F., Zhang, L.Y.: Elimination of policy conflict to improve the PDP evaluation performance. J. Netw. Comput. Appl. 80, 45–57 (2017)

    Article  Google Scholar 

  19. Xia, X.: A conflict detection approach for XACML policies on hierarchical resources. In: Conference on Green Computing and Communications, Conference on Internet of Things, and Conference on Cyber, Physical and Social Computing, pp. 755–760. IEEE Computer Society (2012)

    Google Scholar 

  20. Royer, J.-C., Santana De Oliveira, A.: AAL and static conflict detection in policy. In: Foresti, S., Persiano, G. (eds.) CANS 2016. LNCS, vol. 10052, pp. 367–382. Springer, Cham (2016). https://doi.org/10.1007/978-3-319-48965-0_22

    Chapter  Google Scholar 

  21. Liffiton, M.H., Malik, A.: Enumerating infeasibility: finding multiple MUSes quickly. In: Gomes, C., Sellmann, M. (eds.) CPAIOR 2013. LNCS, vol. 7874, pp. 160–175. Springer, Heidelberg (2013). https://doi.org/10.1007/978-3-642-38171-3_11

    Chapter  Google Scholar 

  22. Previti, A., Marques-Silva, J.: Partial MUS enumeration. In: 27th AAAI Conference on Artificial Intelligence, Bellevue, Washington, pp. 818–825. AAAI Press (2013)

    Google Scholar 

  23. Wu, H.: Finding achievable features and constraint conflicts for inconsistent metamodels. In: Anjorin, A., Espinoza, H. (eds.) ECMFA 2017. LNCS, vol. 10376, pp. 179–196. Springer, Cham (2017). https://doi.org/10.1007/978-3-319-61482-3_11

    Chapter  Google Scholar 

  24. Adi, K., Bouzida, Y., Hattak, I., Logrippo, L., Mankovskii, S.: Typing for conflict detection in access control policies. In: Babin, G., Kropf, P., Weiss, M. (eds.) MCETECH 2009. LNBIP, vol. 26, pp. 212–226. Springer, Heidelberg (2009). https://doi.org/10.1007/978-3-642-01187-0_17

    Chapter  Google Scholar 

  25. Dunlop, N., Indulska, J., Raymond, K.: Methods for conflict resolution in policy-based management systems. In: Enterprise Distributed Object Computing Conference, pp. 98–111. IEEE Computer Society (2003)

    Google Scholar 

  26. de Moura, L., Bjørner, N.: Z3: an efficient SMT solver. In: Ramakrishnan, C.R., Rehof, J. (eds.) TACAS 2008. LNCS, vol. 4963, pp. 337–340. Springer, Heidelberg (2008). https://doi.org/10.1007/978-3-540-78800-3_24

    Chapter  Google Scholar 

  27. Fisler, K., Krishnamurthi, S., Meyerovich, L.A., Tschantz, M.C.: Verification and change-impact analysis of access-control policies. In: International Conference on Software Engineering (2005)

    Google Scholar 

Download references

Author information

Authors and Affiliations

  1. Inria Rennes - Bretagne Atlantique, LS2N (UMR CNRS 6004), Rennes, France

    Zheng Cheng

  2. IMT Atlantique, LS2N (UMR CNRS 6004), Nantes, France

    Jean-Claude Royer & Massimo Tisi

Authors
  1. Zheng Cheng
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Jean-Claude Royer
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Massimo Tisi
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Zheng Cheng .

Editor information

Editors and Affiliations

  1. Università della Svizzera Italiana, Lugano, Switzerland

    Carlo A. Furia

  2. University of Queensland, Brisbane, Queensland, Australia

    Kirsten Winter

Rights and permissions

Reprints and permissions

Copyright information

© 2018 Springer Nature Switzerland AG

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Cheng, Z., Royer, JC., Tisi, M. (2018). Efficiently Characterizing the Undefined Requests of a Rule-Based System. In: Furia, C., Winter, K. (eds) Integrated Formal Methods. IFM 2018. Lecture Notes in Computer Science(), vol 11023. Springer, Cham. https://doi.org/10.1007/978-3-319-98938-9_5

Download citation

  • DOI: https://doi.org/10.1007/978-3-319-98938-9_5

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-319-98937-2

  • Online ISBN: 978-3-319-98938-9

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation