Safety analysis of usage control authorization models

TLDR

The usage control (UCON) model extends traditional access control by allowing attribute changes as side‑effects of access, but its safety properties have remained unexplored despite prior work on its expressive power. This study establishes two core safety results for the UCONA sub‑model, which considers only authorizations. We prove that UCONA’s safety problem is undecidable in general, yet becomes decidable when attribute values are finite and attribute creation is acyclic, and the decidable variant still supports expressive applications such as RBAC and DRM with consumable rights.

Abstract

The usage control (UCON) model was introduced as a unified approach to capture a number of extensions for traditional access control models. While the policy specification flexibility and expressive power of this model have been studied in previous work, as a related and fundamental problem, the safety analysis of UCON has not been explored. This paper presents two fundamental safety results for UCONA, a sub-model of UCON only considering authorizations. In UCONA, an access control decision is based on the subject and/or the object attributes, which can be changed as the side-effects of using the access right, resulting in possible changes to future access control decisions. Hence the safety question in UCONA is all the more pressing since every access can potentially enable additional permissions due to the mutability of attributes in UCON. In this paper, first we show that the safety problem is in general undecidable. Then, we show that a restricted form of UCONA with finite attribute value domains and acyclic attribute creation relation has a decidable safety property. The decidable model maintains good expressive power as shown by specifying an RBAC system with a specific user-role assignment scheme and a DRM application with consumable rights.