Conflict Detection and Resolution in Access Control Policy Specifications

Transcription

1 Conflict Detection and Resolution in Access Contol Policy Specifications Manuel Koch 1, Luigi V. Mancini 2, and Fancesco Paisi-Pesicce 2,3 1 Feie Univesität Belin, Belin (DE) mkoch@inf.fu-belin.de 2 Univ. di Roma La Sapienza, Rome (IT) lv.mancini@dsi.unioma1.it 3 Geoge Mason Univesity, Faifax VA (USA) paisi@dsi.unioma1.it, fpaisi@ise.gmu.edu Abstact. Gaph-based specification fomalisms fo Access Contol (AC) policies combine the advantages of an intuitive visual famewok with a igoous semantical foundation. A secuity policy famewok specifies a set of (constuctive) ules to build the system states and sets of positive and negative (declaative) constaints to specify wanted and unwanted substates. Models fo AC (e.g. ole-based, lattice-based o an access contol list) have been specified in this famewok elsewhee. Hee we addess the poblem of inconsistent policies within this famewok. Using fomal popeties of gaph tansfomations, we can systematically detect inconsistencies between constaints, between ules and between a ule and a constaint and lay the foundation fo thei esolutions. 1 Intoduction Access Contol (AC) deals with decisions involving the legitimacy ofequests to access files and esouces on the pat ofuses and pocesses. One ofthe main advantages ofsepaating the logical stuctue fom the implementation ofa system is the possibility to eason about its popeties. In [KMPP00,KMPP01a] we have poposed a fomalism based on gaphs and gaph tansfomations fo the specification ofac policies. This conceptual famewok, that we have used in [KMPP00,KMPP01a] to specify well-known secuity models such as olebased policies [San98], lattice-based access contol (LBAC) policies (examples ofmandatoy policies) [San93] and access contol lists (ACL) (examples ofdiscetionay policies) [SS94], allows fo the unifom compaison of these diffeent models, often specified in ad hoc languages and equiing ad hoc convesions to compae thei elative stength and weaknesses. Ou gaph-based specification fomalism fo AC policies combines the advantages ofan intuitive visual famewok with a igo and pecision ofa semantics patially suppoted by the EC unde TMR Netwok GETGRATS and unde Espit WG APPLIGRAPH, and by the Italian MURST. M. Nielsen and U. Engbeg (Eds.): Fossacs 2002, LNCS 2303, pp , c Spinge-Velag Belin Heidelbeg 2002

2 224 Manuel Koch, Luigi V. Mancini, and Fancesco Paisi-Pesicce founded on categoy theoy. In addition, tools developed fo geneic gaph tansfomation engines can be adapted to o can fom the basis fo applications that can assist in the development ofa specific policy. We use in this pape examples fom the LBAC and the ACL models to illustate the diffeent concepts, with no petense ofgiving complete o unique solutions by these examples. The main goal ofthis pape is to pesent some basic popeties ofa fomal model fo AC policies based on gaphs and gaph tansfomations and to addess the poblem ofdetecting and esolving conflicts in a categoical setting. A system state is epesented by a gaph and gaph tansfomation ules descibe how a system state evolves. The specification ( famewok ) of an AC policy contains also declaative infomation ( invaiants ) on what a system gaph must contain (positive) and what it cannot contain (negative). A cucial popety ofa famewok is that it specifies a coheent policy, that is one without intenal contadictions. Fomal esults ae pesented to help in ecognizing when the positive and the negative constaints ofa famewok cannot be simultaneously satisfied, when two ules, possibly coming fom peviously distinct subfamewoks, do (patly) the same things but unde diffeent conditions, and when the application ofa ule poduces a system gaph that violates one ofthe constaints (afte one o the othe has been added to a famewok duing the evolution ofa policy). The solutions poposed on a fomal level can be made pat ofa methodology and incopoated into an Access Contol Policy Assistant. The pape is oganized as follows: the next section eviews the basic notations of gaph tansfomations and ecalls the fomal famewok to specify AC policies [KMPP01a]; Sect.3 discusses the notion ofa conflict ofconstaints, Sect.4 intoduces conflicts between ules and mentions stategies to esolve conflicts; Sect.5 discusses how to modify a ule so that its application does not contadict one ofthe constaints; the last section mentions elated and futue wok. 2 Gaph-Based Secuity Policy Famewoks We assume that the eade is familia with the basic notation fo gaph tansfomations as in [Roz97] and in [KMPP01a]. Pats of a LBAC model ae used thoughout the section to illustate the explanations by examples. Gaphs G =(G V,G E,s G,t G,l G ) cay labels taken fom a set X of vaiables and a set C of constants. A path ofunspecified length between nodes a and b is indicated by an edge a b as an abbeviation fo a set containing all possible paths fom a to b though the gaph. A total mophism f : G H is a pai (f V : G V H V, f E : G E H E ) oftotal mappings that espect the gaph stuctue and may eplace a vaiable with othe vaiables o constants. A patial gaph mophism f : G His a total gaph mophism f : dom(f) H fom a subgaph dom(f) G to H. Gaphs can be typed by defining a total mophism t G : G TG to a fixed type gaph TG that epesents the type infomation in a gaph tansfomation system [CELP96] and specifies the node and edge types which may occu in the

3 Conflict Detection and Resolution in Access Contol Policy Specifications 225 U P O val Fig. 1. The type gaph fo the LBAC model. instance gaphs modeling system states. Fo example, the type gaph in Figue 1 shows the possible types fo the LBAC gaph model. The node U is the type ofnodes epesenting uses, the node O the objects, the node val the actual infomation of objects and the node P the pocesses that un on behalfofuses. The node with its loop epesents a whole secuity lattice, and thee is an edge fom secuity level 1 to 2 if 1 > 2. The attachment ofsecuity levels to objects, uses and pocesses is modeled by an edge to a secuity level ofthe secuity lattice. The typing mophism t G maps a node with label Tx to the type T, and mophisms must peseve the typing. A ule p : consists ofa name p, and a label peseving injective mophism : L R. The left-hand side L descibes the elements a gaph must contain fo p to be applicable. The patial mophism is undefined on nodes/edges that ae intended to be deleted, defined on nodes/edges that ae intended to be peseved. Nodes and edges of R, ight-hand side, without a pe-image ae newly ceated. Note that the actual deletions/additions ae pefomed on the gaphs to which the ule is applied. The application ofa ule p : to a gaph G equies a total gaph mophism m : L G, called match, and the diect deivation G p,m H is given by the pushout of and m in the categoy ofgaphs typed ove TG [EHK + 97]. Example 1 (LBAC gaph ules). Figue 2 shows the ules fo the LBAC policy. The labels fo the nodes (, P x, x, y,...) ofthe ules ae vaiables. x x * new pocess * y y delete pocess new object Sx x Sx x delete object valx Fig. 2. Gaph ules fo the LBAC policy. The ule new object ceates a new object connected to a node valx (the initial value ofthe object) and assigned to the secuity level x. The label x is geneic and is substituted by the actual secuity level ofthe pocess

4 226 Manuel Koch, Luigi V. Mancini, and Fancesco Paisi-Pesicce when the ule is applied. The ule delete object fo the deletion of objects is epesented by evesing the patial mophism ofthe ule new object. The ule new pocess ceates a pocess on behalfofa use. The new pocess is attached to a secuity level y that is no highe in the secuity lattice gaph than the secuity level x ofthe use. This equiement is specified by the path fom x to y. Pocesses ae emoved by the ule delete pocess. Fo the specification ofac policies by gaph tansfomations, negative application conditions fo ules ae needed. A negative application condition (NAC) fo a ule p : L Rconsists ofa set A(p) ofpais (L, N), whee the gaph L is a subgaph of N. The pat N \ L epesents a stuctue that must not occu in a gaph G fo the ule to be applicable. In the figues, we epesent (L, N) with N, whee the subgaph L is dawn with solid and N \ L with dashed lines. A ule p : L Rwith a NAC A(p) is applicable to G if L occus in G via m and it is not possible to extend m to N fo each (L, N) ina(p). Example 2 (NAC). Figue 3 shows the ules fo modifying the secuity lattice. New secuity levels can be inseted above an existing secuity level (ule new level 1), below (new level 2) o between existing levels (new level 3). (Notice that the lattice stuctue is not peseved by these ules.) The ule delete level emoves a secuity level. Since uses, pocesses and objects need a secuity level, secuity levels cannot be emoved ifa use, pocess o object possesses this level. Thus, the NAC ofthe ule delete level, whose left-hand side contains the node x, has thee pais (L, N): the fist one pevents the deletion ofsecuity levels that ae assigned to a pocess, the second one concens uses and the last one objects. Only ifthe NAC is satisfied, a secuity level can be emoved. x new level 1 y x x new level 2 x y x y new level 3 x y z x x x delete level Fig. 3. LBAC ules fo modifying the secuity lattice. Negative application conditions ae a fom of constaint on the applicability ofa ule. Constaints can be defined independently ofules. Definition 1 (Constaints). A constaint (positive o negative) is given by a total mophism c : X Y.A total mophism p : X G satisfies a positive (negative) constaint c if thee exists (does not exist) a total mophism q : Y G such that X c Y q G = X p G. A gaph G satisfies a constaint c if each total mophism p : X G satisfies c. A gaph G vacuously satisfies c if thee is no total mophism p : X G; G popely satisfies c othewise.

5 Conflict Detection and Resolution in Access Contol Policy Specifications 227 Example 3 (Constaints fo LBAC). Figue 4 shows a positive and a negative constaint fo the LBAC model. The mophism fo the negative constaint is the identity on the gaph shown (to simplify the pesentation, we depict only the gaph). The constaints equie that objects always have one (the positive constaint) and only one (negative constaint) secuity level. positive constaint: O negative constaint: O O Fig. 4. Positive and negative constaints fo LBAC. We now eview the specification ofac policies based on gaph tansfomations [KMPP00]. The famewok is called secuity policy famewok and consists ofa type gaph that povides the type infomation ofthe AC policy, a set ofules (specifying the policy ules) that geneate the gaphs epesenting the states accepted by the AC policy, a set of negative constaints to specify gaphs that shall not be contained in any system gaph and a set of positive constaints to specify gaphs that must be explicitly constucted as pats ofa system gaph. Definition 2 (Secuity Policy Famewok). A secuity policy famewok, o just famewok, is a tuple SP =(TG,(P, ules P ), P os, Neg), whee TG is a type gaph, P a set of ule names, ules P : P Rule(TG) a total mapping fom names to TG typed ules, Pos is a set of positive constaints, and Neg is a set of negative constaints. The gaphs constucted by the ules ofa famewok epesent the system states possible within the policy model. These gaphs ae called system gaphs. Definition 3 (Coheence). A secuity policy famewok is coheent if all system gaphs satisfy the constaints in Pos and Neg. Integation is concened with the meging ofac policies and consists oftwo levels, a syntactical level, i.e. a mege ofthe secuity policy famewoks, and a semantical level, i.e. the mege ofthe system gaphs epesenting the state at mege time. The integation oftwo AC policies on the syntactical level is a pushout ofthe famewoks in the categoy SP. It has been shown in [KMPP01b] that the categoy SP of famewoks and famewok mophisms is closed unde finite colimit constuctions. An impotant aspect ofintegation is the pesevation ofcoheence: iftwo famewoks ae coheent, is thei gluing also coheent? Geneally, this is not the case. Conflicts also aise when modifying a famewok by adding/emoving a ule o by adding/emoving a positive/negative constaint. In the next thee sections, the poblems ofconflicting constaints, conflicting ules and conflicts between a ule and a constaint ae addessed.

6 228 Manuel Koch, Luigi V. Mancini, and Fancesco Paisi-Pesicce 3 Constaint-Constaint Conflict One way to detemine whethe a famewok is contadictoy is to analyze constaints in pais. Definition 4 (Conflict ofconstaints). Given constaints c i : X i Y i fo i =1, 2, c 1 is in conflict with c 2 iff thee exist mophisms f X : X 1 X 2 and f Y : Y 1 Y 2 such that f Y c 1 = c 2 f X and f X does not satisfy c 1.The conflict is stict if the diagam is a pushout. X 1 c 1 Y 1 f X f Y X 2 c 2 Y 2 When two constaints contain edundant estictions, the conflict is hamless. Poposition 1 (Hamless Conflicts). Let c 1 be in conflict with c 2 and G satisfy c 1.Then G satisfies c 2 wheneve eithe c 1,c 2 Neg o c 1,c 2 Pos and c 1 is in stict conflict with c 2. When the two constaints in conflict ae one positive and one negative, then any gaph satisfying one cannot popely satisfy the othe one. Poposition 2 (Citical Conflicts). Let c 1 be in conflict with c 2 and G popely satisfy c 2.If eithe c 1 Pos, c 2 Neg and the conflict is stict, o c 1 Neg, then G does not popely satisfy c 1. Citical conflicts between constaints can be esolved by emoving o weakening one ofthe constaints by adding a condition. Definition 5 (Conditional Constaint). A positive (negative) conditional constaint (x, c) consists of a negative constaint x : X N, called constaint condition, and a positive (negative) constaint c : X Y.A total mophism p : X G satisfies (x, c) iff wheneve p satisfies x, p satisfies c.a gaph G satisfies (x, c) iff each total mophism p:x G satisfies (x, c). A conditional constaint solves the conflict of c 1 with c 2 (via f X and f Y )by intoducing a constaint condition fo c 1 that equies the satisfaction of c 1 if and only if c 2 is vacuously satisfied. Poposition 3. Let c 1 : X 1 Y 1 be in conflict with c 2 : X 2 Y 2 via f X and f Y, then G satisfies f X if and only if G vacuously satisfies c 2. Definition 6 (Weak Constaint). If c 1 is in conflict with c 2 via f X and f Y, then the weak constaint c 1 (c 2 ) fo c 1 with espect to c 2 is the conditional constaint c 1 (c 2 )=(f X,c 1 ).

7 Conflict Detection and Resolution in Access Contol Policy Specifications 229 Poposition 4. If c 1 is in conflict with c 2, then the weak constaint c 1 (c 2 ) is not in conflict with c 2. Weakening a constaint is one stategy to solve conflicts. A geneal discussion ofstategies is outlined in [KMPP01b]. It is woth stessing that detemining a conflict between constaints can be pefomed statically and automatically. 4 Rule-Rule Conflicts Two ules ae in a potential-conflict (p-conflict) ifthey do (patly) the same things but unde diffeent conditions. A conflict occus ifp-conflicting ules can be applied to a common gaph. Ifthe choice fo one ule in a conflict may pevent the applicability ofthe othe ule, the conflict is called citical, othewise it is a choice conflict. The LBAC ule new object and the access contol list (ACL) ule ceate object in Figue 5 ae in p-conflict, since both ules ceate a new object node. An ACL (such as the one in UNIX) is a stuctue that stoes the access ights to an object with the object itself. The ule ceate object specifies the ceation ofan object by a pocess that uns on behalfofa use. Initially, thee ae no access ights to the new object and the use becomes the owne ofthe new object 1. LBAC ACL x new object x ceate object Vx Fig. 5. The LBAC ule new object and the ACL ule ceate object. The ule new object ceates an object with a secuity level, the ule ceate object an object without one. Which ule shall be applied to intoduce a new object in the system? A static analysis ofthe ules can detect the citical and the choice conflicts befoe un-time so that ules can be changed to avoid conflicts. Definition 7 (p-conflict, Conflict Pai, Conflict). Rules p i : L i i Ri, i = 1,2, with NAC A(p i ) ae in p-conflict if thee is a common non-empty subule 2 fo p 1 and p 2.Each pai of matches (m 1 : L 1 G,m 2 : L 2 G) is a conflict pai fo p 1 and p 2.The ules p 1 and p 2 ae in conflict, if they ae in p-conflict and thee is a conflict pai fo p 1 and p 2.Othewise, they ae called conflict-fee. Geneally, thee exist an infinite numbe ofmatches fo one ule, so the set ofmatches must be educed fo a static analysis. To detect a ule conflict, it is sufficient to conside the left-hand sides of the ules. 1 The complete specification of the famewok fo the ACL is given in [KMPP01a]. 2 A ule p 0 : L 0 R0 0 is a subule of ule p : L Rif thee ae total mophisms f L : L 0 L and f R : R 0 R with f L = f R 0.

8 230 Manuel Koch, Luigi V. Mancini, and Fancesco Paisi-Pesicce Definition 8 (Set ofconflict Pais). The set CP(p 1,p 2 ) ofconflict pais fo ules (p i : L i i Ri,A(p i )), i =1, 2, consists of all pais of matches (m 1 : L 1 G, m 2 : L 2 G), whee m 1 and m 2 ae jointly sujective. The set ofconflict pais fo two ules in a p-conflict consists ofa finite numbe ofpais since the left-hand side ofa ule is a finite gaph. Poposition 5 (Conflict Feeness). Let CP(p 1,p 2 ) be the set of conflict pais fo the p-conflicting ules (p 1 : L 1 1 R1,A(p 1 )) and (p 2 : L 2 2 R2,A(p 2 )). Then, the ules p 1 and p 2 ae conflict-fee if and only if CP(p 1,p 2 ) is empty. The set ofconflict pais fo ules may be split into choice and conflict citical pais: in the latte, afte applying p 1 at match m 1, the ule p 2 is no longe applicable at m 2 o vice vesa, while in the fome, the ode does not matte and afte applying p 1 at m 1, p 2 is still applicable and vice vesa. Citical and choice conflict pais ae detected by the concept of paallel independence [EHK + 97]. Definition 9 (Paallel Independence). Given ules (p i : L i i Ri,A(p i )), i =1, 2, the deivations G p1 H 1 and G p2 H 2 ae paallel independent if 2 m 1 is total and satisfies A(p 1 ) and 1 m 2 is total and satisfies A(p 2 ).Othewise, the deivations ae called paallel dependent. R 1 H 1 1 L L 2 m 1 m 2 G 2 R 2 H2 In the case ofpaallel independence, the application ofp 1 at m 1 and the delayed application of p 2 at 1 m 2 esults in the same gaph (up to isomophism) as the application of p 2 at m 2 and the delayed application of p 1 at 2 m 1. Definition 10 (Choice and Citical Conflict Pai). A conflict pai (m 1,m 2 ) fo ules p 1 and p 2 is a choice conflict if the deivations G p1,m1 H 1 and G p2,m2 H 2 ae paallel independent.it is a citical conflict othewise. We popose two stategies to solve ule conflicts. In the fist stategy, we take one ule p 1 as majo ule, and one p 2 as mino ule. Fo a conflict pai (m 1,m 2 ), p 2 is changed by adding a NAC that fobids its application at match m 2 if p 1 can be applied at m 1. The second stategy integates the ules into one ule. Definition 11 (Weak Condition, Weak Rule). Given a conflict pai (m 1,m 2 ) fo ules (p i : L i i Ri,A(p i )), i =1, 2, the weak condition fo p 2 w..t. (m 1,m 2 ), denoted by WC(p 1,p 2, (m 1,m 2 )), is given by the NAC (L 2,N),

9 Conflict Detection and Resolution in Access Contol Policy Specifications 231 whee the oute diagam is a pullback and the diagam (1) is a pushout diagam. S L 1 (1) N n L2 m 1 m 2 G The ule p 2 with this added NAC is called weak ule. The weak condition fo the mino ule ensues that the majo and the mino ule cannot be both applied to a common system gaph at match m 1 and m 2. Example 4 (weak ule). The top offigue 6 shows the p-conflicting ACL ule ceate object and the LBAC ule new object. Conflict pais fo these ules ae the inclusions (in 1 : L 1 L 1 L 2,in 2 : L 2 L 1 L 2 ) ofthe left-hand sides into thei disjoint union, and the inclusions (in 1 : L 1 G, in 2 : L 2 G) ofthe left-hand sides into the gaph G (the gluing ofthe left-hand sides ove the node ). Figue 6 shows the weak ules with espect to the second conflict pai. The weak ule fo ceate object w..t. new object has a NAC that fobids the application when thee is a secuity level fo the pocess. Theefoe, the weak ule fo ceate object is only applicable to pocesses ceated with the ACL ule and without a countepat in the LBAC model. The weak ule fo new object w..t. ceate object has a NAC that fobids the pesence of a use connected to the pocess. Since each use is connected to a pocess, the ule is not applicable to pocesses ceated by ACL ules. LBAC x new object x ACL ceate object Vx weak "new object" w..t. "ceate object" weak "ceate object" w..t. "new object" x x x Vx Fig. 6. The weak ules fo new object and ceate object. Theoem 1 (Weak Rule is Conflict-fee). Given the set of conflict pais CP(p 1,p 2 ) fo p 1 and p 2, the ule p 1 and the ule p 2, extended by WC(p 1,p 2, (m 1,m 2 )) fo each (m 1,m 2 ) CP(p 1,p 2 ), ae conflict-fee.

10 232 Manuel Koch, Luigi V. Mancini, and Fancesco Paisi-Pesicce The second solution fo solving conflicts between ules is the amalgamation ofthe p-conflicting ules ove thei common subule. Definition 12 (Integated Rule). Let (p i : L i i Ri,A(p i )) fo i =1, 2 be p-conflicting ules and p 0 : L 0 R0 0 with f Li : L 0 L i and f Ri : R 0 R i thei common subule (cf.figue 7). The integated ule is given by (p : L R,A(p)), whee diagam (1) is the pushout of f L1 and f L2, diagam (2) is the pushout of f R1 and f R2 and is the univesal pushout mophism. The set A(p) contains a NAC n : L N fo each pai of NACs n 1 : L 1 N 1 A(p 1 ) and n 2 : L 2 N 2 A(p 2 ), whee N is the pushout of n 1 f L1 and n 2 f L2 and n is the univesal pushout mophism. L 0 0 R 0 N 1 N 2 L 1 (1) L 2 R 1 (2) R 2 N n L R Fig. 7. Amalgamation of p-conflicting ules. Example 5. Figue 8 shows the integated ule fo the ules ceate object and new object. Thei common subule is maked in the ules and contains the pocess node in the left-hand side and the nodes and in the ighthand side. The integated ule ceates an object that belongs to a use, as well as a pocess, and that caies a secuity level. LBAC ACL x new object x ceate object Vx integated ule x x Vx Fig. 8. Amalgamation of p-conflicting ules ceate object and new object.

11 Conflict Detection and Resolution in Access Contol Policy Specifications Rule-Constaint Conflict Rules can be classified into deleting ules that only delete gaph elements, without adding anything (i.e., dom() =R L) and expanding ules that only add gaph elements, but do not delete anything (i.e., dom() = L R). A conflict between a ule and a constaint occus when the application of the ule poduces a gaph which does not satisfy the constaint. The potential fo conflict can be checked statically diectly with the ule and the constaint without knowledge ofspecific gaphs and deivations. A deleting ule p and a positive constaint c ae in conflict ifthe added pat equied by c (i.e., Y \c(x)) ovelaps with what p emoves (i.e., L \ dom()). Similaly, an expanding ule p conflicts with a negative constaint c ifwhat is added by p (i.e., R\(L)) ovelaps with something fobidden by c (i.e., Y \ c(x)). Definition 13 (Rule-Constaint Conflicts). Let p : L Rbe an expanding ule and c : X Y a constaint, then p and c ae in conflict if thee exists a nonempty gaph S and injective total mophisms s 1 : S R and s 2 : S X so that s 1 (S) (R \ (L)). Let p : L Rbe a deleting ule and c : X Y a positive constaint, then p and c ae in conflict if thee exists a nonempty gaph S and injective total mophisms s 1 : S L and s 2 : S Y so that s 1 (S) (L \ dom()) and s 2 (S) (Y \ c(x)). Conflicts between ules p and constaints c : X Y can be esolved (in favo of the constaint) by adding NACs to the ules p. Fo the conflict between expanding ules and negative constaints, the NACs pevent the ule fom completing the conclusion ofthe constaint. Fo the conflict between expanding ules and positive constaints, the NACs pevent the ule fom completing the condition X, and fo the conflict between deleting ules and positive constaints, the NACs pevent the ule fom destoying the conclusion Y. Definition 14 (Reduction). Given a ule p : L Rand a nonempty ovelap S of R and the condition X of the constaint c : X Y. s 1 L R S s 2 X c N h C Y Let C be the pushout object of s 1 : S R and c s 2 : S Y in Gaph, and let C 1,h N be the deivation with the invese ule p 1 : R 1 L at match h. The eduction p(c) ofp by c consists of the patial mophism L Rand the set A(p, c) ={(L, N) C ( 1,h) N, C = R + S Y fo some ovelap S } of NACs. The constuction consides abitay ules and constaints, i.e., it is not esticted to deleting o expanding ules, espectively. This constuction educes to the one in [HW95] ifthe constaint c : X Y is the identity mophism.

12 234 Manuel Koch, Luigi V. Mancini, and Fancesco Paisi-Pesicce Theoem 2 (Reduction peseves Satisfaction). Let p : L Rbe a ule and G a gaph that satisfies the constaint c : X Y. 1.If c is negative, p is expanding, p(c) the eduction of p by c and G p(c) H is a deivation with p(c), then H satisfies c. 2.If c is positive, p is expanding, p(id X ) the eduction of p by id X : X X, and G p(id X ) H a deivation with p(id X ), then H satisfies c. 3.If c is positive, p is deleting, p(c) =(, A(id L,c)), and G p(c) H, then H satisfies c. Conside the negative constaint c(succ) in Figue 9 fobidding two (o moe) successo levels, and the (expanding) ule new level 2 in Figue 3 that may poduce an inconsistent state by adding a successo level. We descibe now, in algoithmic fom, the constuction of the eduction of new level 2 by c(succ): Fig. 9. Negative constaint c(succ) fobidding moe than two successo secuity levels. Step 1: Constuction ofall possible nonempty ovelaps ofr ofthe ule new level 2 and the gaph of c(succ). Figue 10 shows the nonempty ovelaps S1, S2 and S3 with mophisms s 1 and s 2. The emaining ovelaps of R and X use the same subgaphs S1,S2,S3, but diffeent mophisms s 1 and s 2. S 1 S 2 S3 R X R X R x y x y x y X Fig. 10. Nonempty ovelaps between new level 2 and c(succ). Step 2: Fo each ovelap S in step 1, the pushout C ofthe mophisms S R and S X is constucted. The application condition (L, N) is constucted by applying the invese ule of new level 2 at match R C esulting in gaph N. The invese ule of new level 2 deletes a secuity level. Figue 11 shows the pais (L, N) fo the thee ovelaps in Figue 10. The constuction in Definition 14 may geneate edundant application conditions. In fact, if we assume that G aleady satisfies the constaint c, some application conditions ae automatically satisfied. This coesponds to the case

13 Conflict Detection and Resolution in Access Contol Policy Specifications 235 NAC 1 NAC 2 NAC 3 Fig. 11. NACs constucted fom the ovelaps. whee the ovelap S R can be decomposed into S L R. The gaph N geneated fom such ovelap can be eliminated diectly fom Definition 14 by equiing only ovelaps S fo which s 1 (S) (R \ (L)). In this manne, the application condition NAC 1 offigue 11 can be emoved. Anothe fom of edundancy stems fom the fact that, if S 1 with mophisms s 1 1 and s 1 2 and S 2 with mophisms s 2 1 and s 2 2 ae ovelaps and, say, S 1 S 2, s 1 1 S1 = s 2 1, s 1 2 S1 = s 2 2 then C 2 = R + S2 Y C 1 = R + S1 Y and thus N 2 N 1. Hence, ifa match L G satisfies (L, N 2 ), then it also satisfies (L, N 1 ) and the application condition (L, N 1 ) can be emoved fom A(p, c). Fo example, the ovelap S 1 is included into the ovelap S 3 (cf. Figue 10). Theefoe, NAC3 NAC1 (cf. Figue 11) and we can emove NAC1. The solution ofconflicts between expanding ules and negative constaints and ofconflicts between deleting ules and positive constaints is a easonable eduction ofthe numbe ofsystem gaphs which the ules can poduce. The solution fo conflicts between expanding ules and positive constaints, howeve, is not vey satisfactoy, since it educes moe than necessay the numbe of system gaphs that can be geneated. Anothe solution is a constuction which extends the ight-hand side ofa ule so that the ule ceates the entie conclusion Y ofa constaint c : X Y and not only pats ofit. Definition 15 (Completing Rule). The completing ule fo an expanding ule p : L R and a positive constaint c is defined by p c (c) =v i h i, whee L R s i 1 S i s i 2 X p c (c) R v i h i C i y i Y c Ω = {R si 1 s S i 2 i X} is the set of all nonempty ovelaps of R and X so that s i 1(S i ) (R \ (L)), fo each S i Ω, (C i,h i,y i ) is the pushout of s i 1 and c s i 2 in Gaph, (R,v i : C i R ) is the pushout of the mophisms h i : R C i in Gaph. The completing ule fo the ACL ule ceate object and the positive constaint equiing a value fo each object is shown in Figue 12. Lemma 1. If p c (c) :L R is the completing ule fo p, c, then R satisfies c.

14 236 Manuel Koch, Luigi V. Mancini, and Fancesco Paisi-Pesicce L R N n * s2 s1 s1 S X s2 Oy c Y Oy val R u y val Fig. 12. Constuction of the completing ule. The completing ule, howeve, does not peseve consistency fo each positive constaint. Ifwe estict positive constaints to single (X contains at most one node) o edge-eticted (fo each edge s e t (Y \ c(x)), s, t (Y \ c(x))), the constuction esults always in a consistence peseving ule. Poposition 6. If c is a single o edge-eticted positive constaint, the completing ule p c (c) fo a ule p is consistent with espect to c. The constuction ofthe completing ule could be genealized to abitay constaints by using set nodes: a set node in the left-hand side of a ule matches all occuences ofthis node in a gaph and the ule is applied to all the occuences. Anothe possibility to solve conflicts between positive constaints and expanding ules p is to tansfom the constaint X Y into a ule and equie that this ule is applied (afte the application of p) as long as thee ae occuences of X not visited in H. The new ule is just the constaint X Y with negative application condition (X, Y ) to avoid its application epeatedly on the same pat of H. It is neccessay to add contol on the famewok to ensue that this new ule is applied as long as possible. Contol can be intoduced eithe by using ule expessions [GRPPS00] o tansfomation units [EKMR99] as an encapsulation mechanism used in a way simila to pocedue calls. 6 Concluding Remaks In a gaph-based appoach to the specification ofac policies, states ae epesented by gaphs and thei evolution by gaph tansfomations. A policy is fomalized by fou components: a type gaph, positive and negative constaints (a declaative way ofdescibing what is wanted and what is fobidden) and a

15 Conflict Detection and Resolution in Access Contol Policy Specifications 237 set ofules (an opeational way ofdescibing what can be constucted). An impotant poblem addessed hee is how to deal with inconsistencies caused by conflicts between two ofthe constaints, two ofthe ules o between a ule and a constaint. Often such poblems aise when tying to pedict the behavio of an AC policy obtained by integating two sepaate coheent policies [KMPP01a]. The conflict between a ule ofone policy and a simple constaint ofthe othe policy has been addessed in pat elsewhee [KMPP00], whee it is also shown the adequacy ofthis famewok to epesent a Role-based Access Contol policy. Hee we have tackled the poblem ofconflicts by making effective use ofthe gaph based fomalism. Conflicts ae detected and esolved statically by using standad fomal tools typical of this gaph based fomalism. In the pocess, we have intoduced the notions ofconditional constaint and ofweakening ofa ule. A tool, based on a geneic gaph tansfomation engine, is unde development to assist in the systematic detection and esolution ofconflicts and in the stepwise modification ofan evolving policy while maintaining its coheence. Refeences CELP96. A. Coadini, H. Ehig, M. Löwe, and J. Padbeg. The categoy of typed gaph gammas and thei adjunction with categoies of deivations. In 5th Int. Wokshop on Gaph Gammas and thei Application to Compute Science, numbe 1073 in LNCS, pages Spinge, EHK H. Ehig, R. Heckel, M. Koff, M. Löwe, L. Ribeio, A. Wagne, and A. Coadini. Handbook of Gaph Gammas and Computing by Gaph Tansfomations. Vol. I: Foundations, chapte Algebaic Appoaches to Gaph Tansfomation Pat II: Single Pushout Appoach and Compaison with Double Pushout Appoach. In Rozenbeg [Roz97], EKMR99. H. Ehig, H.-J. Keowski, U. Montanai, and G. Rozenbeg, editos. Handbook of Gaph Gammas and Computing by Gaph Tansfomations. Vol. III: Concuency, Paallelism, and Distibution. Wold Scientific, GRPPS00. M. Goße-Rhode, F. Paisi-Pesicce, and M. Simeoni. Refinements of Gaph Tansfomation Systems via Rule Expessions. In H. Ehig, G. Engels, H.-J. Keowski, and G. Rozenbeg, editos, Poc. of TAGT 98, numbe 1764 in Lect. Notes in Comp. Sci., pages Spinge, HW95. R. Heckel and A. Wagne. Ensuing consistency of conditional gaph gammas - a constuctive appoach. In Poc. SEGRAGRA 95 Gaph Rewiting and Computation, numbe 2. Electonic Notes of TCS, KMPP00. M. Koch, L.V. Mancini, and F. Paisi-Pesicce. A Fomal Model fo Role-Based Access Contol using Gaph Tansfomation. In F.Cuppens, Y.Deswate, D.Gollmann, and M.Waidne, editos, Poc. of the 6th Euopean Symposium on Reseach in Compute Secuity (ESORICS 2000), numbe 1895 in Lect. Notes in Comp. Sci., pages Spinge, KMPP01a. M. Koch, L. V. Mancini, and F. Paisi-Pesicce. On the Specification and Evolution of Access Contol Policies. In S. Osbone, edito, Poc. 6th ACM Symp. on Access Contol Models and Technologies, pages ACM, May 2001.

16 238 Manuel Koch, Luigi V. Mancini, and Fancesco Paisi-Pesicce KMPP01b. M. Koch, L.V. Mancini, and F. Paisi-Pesicce. Foundations fo a gaph-based appoach to the Specification of Access Contol Policies. In F.Honsell and M.Miculan, editos, Poc. of Foundations of Softwae Science and Computation Stuctues (FoSSaCS 2001), numbe 2030 in Lect. Notes in Comp. Sci., pages Spinge, Roz97. G. Rozenbeg, edito. Handbook of Gaph Gammas and Computing by Gaph Tansfomations. Vol. I: Foundations. Wold Scientific, San93. R. S. Sandhu. Lattice-based access contol models. IEEE Compute, 26(11):9 19, San98. R. S. Sandhu. Role-Based Access Contol. In Advances in Computes, volume 46. Academic Pess, SS94. R.S. Sandhu and P. Samaati. Access Contol: Pinciples and Pactice. IEEE Communication Magazine, pages 40 48, 1994.