An algebra for composing access control policies

TLDR

Current access‑control systems rely on monolithic specifications, which is too restrictive when policies come from multiple independent authorities and their details may be unknown, necessitating a nontrivial combination and translation process. This article tackles the problem of combining independently stated authorization specifications, possibly in different languages and policy frameworks. The authors introduce an algebra of security policies with formal semantics, illustrate its use for composing complex policies, and provide a translation of policy expressions into equivalent logic programs to support implementation. The algebra’s expressiveness is shown to be comparable to first‑order logic through a formal comparison.

Abstract

Despite considerable advancements in the area of access control and authorization languages, current approaches to enforcing access control are all based on monolithic and complete specifications. This assumption is too restrictive when access control restrictions to be enforced come from the combination of different policy specifications, each possibly under the control of independent authorities, and where the specifics of some component policies may not even be known apriori. Turning individual specifications into a coherent policy to be fed into the access control system requires a nontrivial combination and translation process. This article addresses the problem of combining authorization specifications that may be independently stated, possibly in different languages and according to different policies. We propose an algebra of security policies together with its formal semantics and illustrate how to formulate complex policies in the algebra and reason about them. A translation of policy expressions into equivalent logic programs is illustrated, which provides the basis for the implementation of the algebra. The algebra's expressiveness is analyzed through a comparison with first-order logic.