Abstract:Attributed-based access control (ABAC) is widely used in systems with large resources and users such as the Industrial Internet of Things (IIoT), Industrial information integration system, and so on. Attribute-based security policy is highly flexible and expressive, but conflicts between policies occur frequently, affecting the security and availability of the system. Based on analyzing the ABAC security policies represented by the eXtensible Access Control Markup Language (XACML), this study proposes a formal definition of explicit conflicting rules, probable-conflicting rules, and never-conflicting rules. Also, we found that conflicts occur on a pair of rules in which attribute expressions have overlapping values and that be applied to the same request. A new conflict detection method is proposed in which implicit conflicting rules are converted to explicit conflicting rules by completing the absent attribute expressions and then compare all the rules in pairs to detect all the probable conflicting rules in a rule set. In this way, we can analyze the conflicting probability of each pair of policy rules. Furthermore, we define two metrics to evaluate the conflict level of a rule set. Experiment results show that implicit conflicting rules are more numerous than explicit conflicting rules in the policy set. Also, with an increase in the number of attribute expressions in each rule, the conflicting level of a rule set is significantly reduced, which provides a reference for policymaking. With this method, administrators can formulate more robust and efficient security policies, improve the security and availability of systems.

An Approach for Resolving Inconsistency Conflicts in Access Control Policies

Inconsistency resolving of safety and utility in access control

Inconsistency Management of Role Base Access Control Policy

Consistency Checking of Safety and Availability in Access Control

A New Approach of Resolving Policy Conflicts

Detecting conflict of heterogeneous access control policies

A method for avoiding policy conflicts in policy based network management

A dynamic solution for fine-grained policy conflict resolution

Available Separation-of-Duty Policies in Access Control

Approach for Resolution of Exceptional Conflicts in Authorization

A Novel Conflict Detection Method for ABAC Security Policies

Conflict Detection and Resolution for Authorization Policies in Workflow Systems

A first-order logic based approach for authorization with the treatment ofpolicy inconsistency

Attribute-based Lightweight Reconfigurable Access Control Policy

An Approach for Harmonizing Conflicting Policies in Multiple Self-Adaptive Modules

Style Refinement and Detection Improvement of Policy Conflict

Policy consistency in automated trust negotiation

Resolving Access Conflicts: an Auction-Based Incentive Approach.

A Priority-Based Negotiations Approach for Handling Inconsistencies in Multi-Perspective Software Requirements

Intent-based Service Policy Conflict Management Algorithm

Static Enforcement Of Static Separation-Of-Duty Policies In Usage Control Authorization Models