On the specification and evolution of access control policies

Abstract

A uniform and precise framework for the specification of access control policies is proposed. The uniform framework allows the detailed comparison of different policy models, the precise description of the evolution of a policy, and an accurate analysis of the interaction between policies and of the behavior of their integration. The evolution and integration of policies are illustrated using a Discretionary Access Control policy and a Lattice Based Access Control policy. The framework is based on the theory of graph transformations.