Comparing Rule-Based Policies

Policy comparison is useful for a variety of applications, including policy validation and policy-aware service selection. While policy comparison is somewhat natural for policy languages based on description logics, it becomes rather difficult for rule-based policies. When policies have recursive r...

Full description

Saved in:
Bibliographic Details
Main Authors: Bonatti, P.A., Mogavero, F.
Format: Conference Proceeding
Language:English
Subjects:
Algebra
Arithmetic
Authorization
Automata
Conferences
Datalog query containment
Logic functions
Network servers
Policy comparison
Policy compliance
Policy verification
Policy-aware service selection
Privacy
Query processing
Rule-based policies
Security
Online Access:Request full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:Policy comparison is useful for a variety of applications, including policy validation and policy-aware service selection. While policy comparison is somewhat natural for policy languages based on description logics, it becomes rather difficult for rule-based policies. When policies have recursive rules, the problem is in general undecidable. Still most policies require some form of recursion to model - say - subject and object hierarchies, and certificate chains. In this paper, we show how policies with recursion can be compared by adapting query optimization techniques developed for the relational algebra. We prove soundness and completeness of our method, discuss the compatibility of the restrictive assumptions we need w.r.t. our reference application scenarios, and report the results of a preliminary set of experiments to prove the practical applicability of our approach.
DOI:10.1109/POLICY.2008.16