Abstract:Attributed-based access control (ABAC) is widely used in systems with large resources and users such as the Industrial Internet of Things (IIoT), Industrial information integration system, and so on. Attribute-based security policy is highly flexible and expressive, but conflicts between policies occur frequently, affecting the security and availability of the system. Based on analyzing the ABAC security policies represented by the eXtensible Access Control Markup Language (XACML), this study proposes a formal definition of explicit conflicting rules, probable-conflicting rules, and never-conflicting rules. Also, we found that conflicts occur on a pair of rules in which attribute expressions have overlapping values and that be applied to the same request. A new conflict detection method is proposed in which implicit conflicting rules are converted to explicit conflicting rules by completing the absent attribute expressions and then compare all the rules in pairs to detect all the probable conflicting rules in a rule set. In this way, we can analyze the conflicting probability of each pair of policy rules. Furthermore, we define two metrics to evaluate the conflict level of a rule set. Experiment results show that implicit conflicting rules are more numerous than explicit conflicting rules in the policy set. Also, with an increase in the number of attribute expressions in each rule, the conflicting level of a rule set is significantly reduced, which provides a reference for policymaking. With this method, administrators can formulate more robust and efficient security policies, improve the security and availability of systems.

Research on Network Security Policy Refinement Consistency of Detection and Conflict Resolution Mechanisms

New Study and Implementation of Policy Based Network Management System

Techniques of Distributed Application Access Control Policy Refinement and Policy Conflict Analysis

A Computer Network Defense Policy Refinement Method

Style Refinement and Detection Improvement of Policy Conflict

A Model Based on Domain for Access Control Policy Refinement and Its Implementation

Study on the Policy Conflict Detection in the Security Management Model

Research On Modeling For Network Security Policy Confliction Based On Network Topology

A method for avoiding policy conflicts in policy based network management

Model for access control policy refinement based on domain and its implementation

A network security policy model and its realization mechanism

A Dynamic and Self-Adaptive Network Security Policy Realization Mechanism

Research and Implementation of Policy Conflict Detection Based on Description Logic

A New Approach of Resolving Policy Conflicts

Detecting conflict of heterogeneous access control policies

An automatic policy refinement mechanism for policy-driven grid service systems

A Novel Conflict Detection Method for ABAC Security Policies

Dynamic Policy Access Model Based on Formal Concept Analysis

Research on key technologies of network security management policy

Research Status and Development Trends of Access Control Model

Analysis And Classification of IPSec Security Policy Conflicts