Access Control Policy Conflict Detection Method Based on XACML

Abstract

The present invention provides an access control policy conflict detection method based on XACML, comprising: step 1, establishing a policy tree based on rules, policies, and policy sets; step 2, establishing an index structure based on the established policy tree and the effects of the rules; step 3, obtaining the rules in the policy to be detected, and comparing the rules one by one with rules in different policy trees with opposite effects; step 4, if the comparison result is an intersection, it indicates that the rule pair conflicts, and the rule pair is stored in a queue to be output, and steps 3 and 4 are repeated until all rules in the policy to be detected are compared, and all rule pairs in the queue to be output are output. The solution proposed by the present invention adopts a new policy index structure based on expression tree comparison, which can realize conflict detection of complex policies and mark the causes of conflicts. Users can flexibly configure and resolve policy conflicts based on conflict markers to achieve efficient and accurate policy management and control.

Description

Technical Field

[0001] The present invention relates to the field of access control, and in particular to an access control policy conflict detection method based on XACML. Background Art

[0002] Many challenges that arise during the development and maintenance of access control policies arise from the inability of policy administrators to correctly translate high-level business requirements into low-level access control policies that can be implemented in access decisions. Several approaches to address this problem have been explored, including improving the policy language itself to provide a more direct expression of business requirements. Role-based access control (RBAC) and attribute-based access control (ABAC) languages ​​are representative achievements of this line of research. However, business rules are often flexible: exceptions sometimes arise, and cumbersome rules may be ignored or changed. Therefore, the process of selecting access decision functions based on business rules benefits from formalization and automatic support, which requires a lot of manual effort.

[0003] The access control language standard for current mainstream access rights management systems is XACML (eXtensible Access Control Markup Language), developed by the OASIS organization and expressed in XML. This standard, based on ABAC, contains numerous function and attribute definitions, a highly flexible structure, and six basic combination policy algorithms for resolving policy conflicts. While XACML has seen widespread development, it lacks a systematic mechanism for accurate conflict detection, making it difficult to ensure the correct configuration of policy combination algorithms.

[0004] There are a relatively large number of access control tools based on XACML, including Sun Java XACML, the earliest implementation by Sun, and the Balana open source library, which WSO2 later improved upon and widely adopted based on Sun's work. JBoss also launched the PicketLink unified identity management framework based on XACML 2.0, along with FrogerRock's openAM and openIDM products. The ATT XACML engine developed by AT&T and released in the Apache Incubator, and the ACPT access control policy tool developed by NIST, among others, also have shortcomings in policy conflict detection. While Balana offers a user-friendly PAP wizard, its overly simplified PAP setup makes it ineffective for detecting complex policy conflicts. The ATT engine, while a contributor to the Apache Incubator, has not gained traction or been packaged. ACPT, a conflict detection and analysis tool, can detect conflicts in three language logics, but its ABAC detection is still fundamentally based on RBAC.

[0005] In addition to analyzing policy sets using basic techniques such as SAT, description logic, policy description languages, and ontology reasoning, most research also proposes optimizations for the index structure used during detection. In attribute-based access control, the impact of resource attributes on access control authorization is often emphasized, and resource attribute structures are often more complex, resulting in authorization schemes with more fine-grained discrimination capabilities. Therefore, previous methods prioritized the impact of resources when building indexes to obtain solutions that are more conducive to conflict retrieval. However, this approach also has problems. Some methods do not compare fields that are not in the same resource semantic tree, but two such rules may actually have objects that satisfy them simultaneously in the object space. Other methods require traversing the entire resource space when building the index. The size of the index structure is proportional to the number of resources, and as resources increase, new indexes need to be continuously established, which has poor maintainability for application systems where access resources are constantly changing.

[0006] Research on conflict resolution algorithms typically uses a combination-prioritization algorithm to select specific conflicting rules. Many solutions employ a one-time conflict resolution approach based on directed acyclic graphs. While this approach is fast, the resolution process is not transparent to policy designers and difficult to modify flexibly. Furthermore, for situations with limited conflicts, designers must understand the causes of the conflicts and adjust the policy files accordingly. Summary of the Invention

[0007] To address the challenges of existing technologies, this paper proposes a method for detecting XACML policy rules. This method utilizes a novel policy index structure based on expression tree comparison, enabling conflict detection for complex policies and identifying the causes of conflicts. Users can flexibly configure and resolve policy conflicts based on conflict markers, achieving efficient and accurate policy management.

[0008] The technical solution adopted by the present invention is as follows: an access control policy conflict detection method based on XACML, comprising the following steps:

[0009] Step 1: Create a policy tree based on rules, policies, and policy sets.

[0010] Step 2: Create an index structure based on the established policy tree and the effects of the rules;

[0011] Step 3: Obtain the rules in the policy to be tested and compare each rule with the opposite rule in a different policy tree.

[0012] Step 4: If the comparison result is an intersection, it indicates that the rule pair conflicts. The rule pair is stored in the queue to be output. Steps 3 to 4 are repeated until all rules in the policy to be detected are compared and all rule pairs in the queue to be output are output.

[0013] The comparison method in step 3 is: establishing target expression trees for the rule pairs to be compared and comparing them to determine whether the two target expression trees have an intersection.

[0014] Furthermore, the policy tree includes rules, policies and policy sets; rules are leaf nodes, policy sets are root nodes of the tree, rules are combined to form policies through a rule combination algorithm, and policies are combined to form policy sets through a policy combination algorithm.

[0015] Furthermore, the rules consist of three parts: target, condition and effect. The four domain groups of the target are composed of resources, subjects, actions and environments. Each domain consists of multiple attribute fields and their attribute values. The effect defines the permission or denial of authorization of the access policy that meets the target and conditions. The combination of a certain attribute field of the target and its value rules is an expression.

[0016] Furthermore, step 2 specifically includes establishing an allow list and a deny list of the policy tree according to the effects of the rules, wherein the allow list includes rules whose effects are to allow authorization, and the deny list includes rules whose effects are to deny authorization.

[0017] Furthermore, the method for establishing the target expression tree is: for the multi-level expressions in each domain of the target, an expression tree is established based on the OR and AND relationships, wherein the non-leaf nodes are OR and AND relationships, and the leaf nodes are expressions; in the expression tree, a binary tree with only one non-leaf node is a minimum binary tree.

[0018] Furthermore, the method for determining whether the expression trees intersect is as follows: the target expression trees are compared only within their respective subdomains. If there is intersection in each subdomain, it means that the target domain has intersection; conversely, if there is no intersection in a subdomain, then the target domain has no intersection.

[0019] Furthermore, the specific methods for comparing target expression trees include:

[0020] Step 3.1, compare expressions with each other;

[0021] Step 3.2, compare the expression with the minimum expression tree;

[0022] Step 3.3, compare the minimum expression tree with the minimum expression tree;

[0023] Step 3.4: Compare the two expression trees.

[0024] Furthermore, the expression in the step is compared with the expression in the following manner:

[0025] Step 3.1.1: Compare the attribute fields of the two expressions to see if they are the same. If so, mark them as "same" and proceed to step 3.1.2. Otherwise, select one of the two attribute fields to determine the hierarchical structure and determine whether the other attribute field is in the same hierarchical structure. If so, mark them as "hierarchical relationship" and proceed to step 3.1.2. Otherwise, mark the expression pair as "attribute unrelated, with intersection space" and proceed to step 3.1.4.

[0026] Step 3.1.2: Determine whether the expression is marked as "same" or "hierarchical relationship". If marked as "same", the attribute field value results are intervalized and the intervals are intersected. If there is no intersection, proceed to step 3.1.3. Otherwise, mark the expression pair as "same attribute values ​​overlap, and there is an intersection space". If marked as "hierarchical relationship", mark the expression with the higher-level attribute field in the two expressions as H, and the lower-level expression as L. Use the parent node search method in the hierarchical index structure to find the value of the corresponding level for the expression marked as L, and mark the expression composed of this value and the attribute field as L'. Compare the expressions marked as H and L' using the comparison method marked as "same". If there is no intersection, proceed to step 3.1.3. Otherwise, mark the original expression pair as "hierarchical attribute values ​​intersect, and there is an intersection space" and proceed to step 3.1.4.

[0027] Step 3.1.3: Determine whether there is an "only one value" function in the apply function declaration of the expression. If so, mark the expression as "no intersection space exists" and proceed to step 3.1.4. Otherwise, mark the expression as "no intersection but not unique value, intersection space exists" and proceed to step 3.1.4.

[0028] Step 3.1.4, end.

[0029] Furthermore, the specific process of step 3.2 is: the minimum expression tree is divided into an OR tree and an AND tree according to the type of non-leaf nodes. When the expression is compared with the OR tree, if the expression has no intersection with both leaf nodes of the OR tree, it means that the expression has no intersection with the OR tree, otherwise it means that there is an intersection; when the expression is compared with the AND tree, if the expression has no intersection with one of the two leaf nodes of the AND tree, it means that the expression has no intersection with the AND tree, otherwise it means that there is an intersection.

[0030] Furthermore, the specific process of step 3.3 is: determining whether the two minimum expression trees are OR trees or AND trees;

[0031] Comparing OR trees with OR trees: Compare two nodes in one OR tree with another OR tree in turn. If both nodes have no intersection with the other OR tree, it means there is no intersection; otherwise, it means there is intersection.

[0032] Comparing the AND tree with the AND tree: Compare the two nodes in one AND tree with the other OR tree in turn. If any node has no intersection with the other OR tree, it means there is no intersection, otherwise it means there is intersection;

[0033] Compare the OR tree with the AND tree: compare a node in the OR tree with the AND tree. If there is no intersection, compare another node in the OR tree with the AND tree. If there is still no intersection, it means there is no intersection, otherwise it means there is an intersection.

[0034] Furthermore, the specific process of step 3.4 is: the expression tree is divided into an OR tree and an AND tree according to the root node, the left and right subtrees are still expression trees or expressions, and the judgment is performed according to the method of step 3.3, and the two expression trees are output to have no intersection or intersection relationship.

[0035] Compared with existing technologies, the above technical solution has the following advantages: The proposed solution utilizes a new policy index structure based on expression tree comparison, enabling conflict detection for complex policies and identifying the causes of conflicts. Users can flexibly configure and resolve policy conflicts based on conflict markers, achieving efficient and accurate policy management. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 This is a flow chart of the conflict detection proposed by the present invention.

[0037] Figure 2 Schematic diagram of a strategy tree structure in one embodiment of the present invention.

[0038] Figure 3 This is the index structure of the strategy tree proposed in the present invention. DETAILED DESCRIPTION

[0039] The present invention will be further described below with reference to the accompanying drawings.

[0040] To address the challenges of existing technologies, this paper provides a method for detecting XACML policy rules. This method utilizes a novel policy index structure based on expression tree comparison, enabling conflict detection for complex policies and identifying the causes of conflicts. Users can flexibly configure and resolve policy conflicts based on conflict markers, achieving efficient and accurate policy management.

[0041] The technical problems to be solved by the present invention are as follows:

[0042] (1) Formal analysis of expression tree construction and comparison rules;

[0043] (2) Conflict detection algorithm design.

[0044] like Figure 1 As shown, the present invention proposes an access control policy conflict detection method based on XACML, which includes the following processes:

[0045] Step 1: Create a policy tree based on rules, policies, and policy sets.

[0046] Step 2: Create an index structure based on the established policy tree and the effects of the rules;

[0047] Step 3: Obtain the rules in the policy to be tested and compare each rule with the opposite rule in a different policy tree.

[0048] Step 4: If the comparison result is an intersection, it indicates that the rule pair conflicts. The rule pair is stored in the queue to be output. Steps 3 to 4 are repeated until all rules in the policy to be detected are compared and all rule pairs in the queue to be output are output.

[0049] The comparison method in step 3 is: establishing target expression trees for the rule pairs to be compared and comparing them to determine whether the two target expression trees have an intersection.

[0050] The solution presented in this paper is based on policy rule analysis and includes a series of basic prerequisites: the establishment of a policy tree, an expression tree, and an index structure. Based on these prerequisites, a specific XACML policy rule conflict detection method is implemented. This method first constructs a formal analysis model and then provides a specific rule conflict detection algorithm.

[0051] Specifically,

[0052] 1. Strategy Tree and Target Expression Tree

[0053] 1.1 Establishment of Strategy Tree

[0054] The main components of the policy language model are rules, policies, and policy sets, which have a natural hierarchical structure. The policy set contains a policy combination algorithm, which is used to combine multiple policies at the lower level; the policy contains a rule combination algorithm, which is used to combine multiple rules at the lower level; and there are no other components at the lower level of the rule. Based on this feature, a tree structure is used to describe the relationship between the components in the policy language model. The top-level policy set component (when the policy set component is the default, the policy component can be used) is used as the root node of the tree, and its child nodes are composed of the policies directly connected to it. A recursive method is used until the rule component is used as the bottom-level node, that is, the leaf node. The tree-structured policy language model is called a policy tree, such as Figure 2 shown.

[0055] The strategy tree in this embodiment has the following characteristics:

[0056] (1) Leaf nodes are all regular nodes;

[0057] (2) Non-leaf nodes must have a combination algorithm.

[0058] From the above characteristics, we can deduce a conclusion: there must be at least one combination algorithm between leaf nodes with a common parent node that can be used to resolve conflicts. Therefore, there is no possibility of causing actual access authorization conflicts between leaf nodes (rule nodes) with a common parent node.

[0059] A rule in a policy tree consists of three parts: a target, a condition, and an effect. The target defines the set of resources, subjects, actions, and environments to which the rule applies. The condition further strengthens the applicability of the target. The effect defines the positive or negative authorization of the access policy that satisfies the target and condition. In logical abstraction, conditions and targets can be used indiscriminately. Therefore, the comparison of rule nodes below only considers targets and effects. An authorization conflict occurs only when targets intersect and effects are opposite.

[0060] Rules, policies, and policy set components all contain a target component. In the policy language model, the applicable target matching at the lower level satisfies the matching results at the upper level, meaning that target matching is transitive. This is reflected in the policy tree as child nodes inheriting the target matching results of their parent nodes. Therefore, at a leaf node, a reverse deep search can be performed to obtain the complete target domain of the rule represented by that leaf node for comparison with the target domain in the next step.

[0061] 1.2 Target Expression Tree

[0062] (1) Objective composition and method

[0063] The four domains of a goal can be represented as: [subject, resource, action, environment]. Each domain is composed of multiple attribute fields and their attribute values. Target overlap depends on the presence of overlap in all domains. Different domains generally have no direct relationship, while the relationship between multiple attribute fields within the same domain is more complex. It cannot be described by a single simultaneous (allOf) or at least one (anyOf) requirement. Instead, it is typically composed using multiple AND or OR relationships. The combination of an attribute field and its value rule is called an expression. An attribute value can be a single value, multiple discrete values, a fixed range of values, or a value space related to other attribute fields. Intervalization can be used to convert the resulting value into a set that can be intersected, facilitating comparisons between different value ranges of the same attribute field.

[0064] (2) Creation of expression tree

[0065] For multi-level expressions in each domain of the target domain, an expression tree (stored in depth-first order) can be constructed based on OR and AND relationships. Non-leaf nodes are OR and AND relationships, and leaf nodes are expressions. This tree can be proven to be a binary tree, with non-leaf node degree 2 (i.e., all nodes have two or no children).

[0066] (3) Comparison of expression trees

[0067] The target expression trees are only compared within their respective subdomains. Therefore, to compare whether the target domains have intersections, it is only necessary to determine whether all subdomains have intersections. Conversely, if there is a subdomain that has no intersection, then the target domains have no intersection.

[0068] The comparison within the domain uses a recursive method, starting from the comparison between leaf nodes (expression nodes), to the comparison between leaf nodes and the minimum binary tree (a binary tree with only one non-leaf node), to the comparison between two minimum binary trees, and finally to the comparison between two expression trees. It is divided into four steps.

[0069] Comparison of A1 expression with expression

[0070] The relationship between the two expressions is "there is an intersection space" and "there is no intersection space", which will be abbreviated as "intersection" and "no intersection" from this step on. The comparison method is as follows:

[0071] The comparison between two expressions is performed in three steps. First, the results are classified as "related" or "unrelated" based on whether the two fields are related. Related attribute fields include those that are "identical" or "hierarchically related," while unrelated attribute fields refer to other types of relationships for which no known knowledge exists. For the attribute fields judged "related" in the previous step, the attribute value ranges are compared to determine if there is overlap, resulting in "overlapping" or "non-overlapping" results. For the expression judged "non-overlapping" in the previous step, the attribute fields are checked for unique values, resulting in "unique" or "non-unique" results. Only when the result of the last step is unique does the two expressions have no intersection space; all other results can be considered to have an intersection space.

[0072] It should be noted that the "intersection space" of expressions is different from the "overlap" of the value ranges of attribute fields. The intersection of expressions refers to the objects that satisfy both expressions in the object space at the same time. The two expressions can be expressions of two different attribute fields, while the overlap of attribute field value ranges only refers to the intersection of the value expressions of two expressions for the same attribute field.

[0073] Specifically:

[0074] ①Compare based on the relationship between attribute fields

[0075] Comparison of attribute fields directly performs string matching on the "attribute." Even if two attribute fields have different matching results, there may still be some logical correlation. The most common correlation is a hierarchical relationship, where one attribute field is a parent or child of another, such as the attribute field "household registration province" and the attribute field "household registration city." Comparing values ​​in a hierarchical relationship is much more complex than comparing values ​​in the same field. For example, the set of objects with the value "household registration province" being "Sichuan" and the set of objects with the value "household registration city" being "Shijiazhuang" will not intersect. This lack of intersection is often determined by the value structure of the hierarchical attributes. A given value in a lower-level attribute field will always have a unique value in the attribute field above it, but not vice versa. Therefore, it's important to establish a hierarchical attribute structure in advance to determine the correlation between attribute fields. For example, the hierarchical structure in the example above is "household registration province - household registration city" from top to bottom.

[0076] The specific method for comparing attribute fields is as follows:

[0077] B1. Compare the attribute fields of the two expressions to see if they are the same. If they are the same, mark them as "same" and proceed to the next step to determine if the values ​​intersect. If they are different, proceed to B2.

[0078] B2. Select one of the two attribute fields to determine the hierarchical structure. Determine whether the other attribute field is in the same structure. If so, mark it as "has a hierarchical relationship" and proceed to the next step to determine if the values ​​intersect. If not, proceed to B3.

[0079] B3. Mark the expression pair as "attribute-independent, with intersection space", and end.

[0080] Note: For two unrelated attribute fields, it is generally believed that there is always a state that satisfies all the combined values ​​of the two unrelated attribute fields at the same time. Therefore, there is an intersection in the target space described by the unrelated attribute fields.

[0081] ② Compare based on whether the value intervals intersect

[0082] Related attribute fields can be divided into "same" and "hierarchical relationship" for discussion separately.

[0083] 1) Comparison of the same attribute fields: Directly compare the attribute value ranges. First, the corresponding attribute value results are intervalized to facilitate operations.

[0084] The specific method for comparing value intervals for the same attribute field is as follows:

[0085] B4. Convert the result into intervals;

[0086] B5. Find the intersection of the intervals. If there is no intersection, go to the next step to determine the unique value. Otherwise, go to B6.

[0087] B6. Mark the expression pair as "same attribute, overlapping values, and intersection space". End.

[0088] 2) Comparing hierarchical attribute fields: Comparing two expressions related to attribute fields is more complex and requires relying on the attribute hierarchy structure known during strategy design. For example, in the previous example, the corresponding partial hierarchy structure is "Sichuan-Chengdu; Hebei-Shijiazhuang." When making the judgment, first use the index structure to find the corresponding upper-level value of the expression value in the lower level of the same hierarchy. For example, the upper-level value corresponding to "City of Household Registration-Shijiazhuang" is "Province of Household Registration-Hebei." The expressions for the same attribute fields are obtained and then compared using the same field expression comparison method.

[0089] The specific method for comparing the value intervals of hierarchical attribute fields is as follows:

[0090] B7. Mark the expression with the higher-level attribute field as H, and the lower-level expression as L.

[0091] B8. Use the parent node search method to find the value of the corresponding level in the hierarchical index structure for the expression marked as L, and mark the expression composed of the value and the attribute field as L';

[0092] B9. Compare the expression pair consisting of H and L' using the same attribute field comparison method. If there is no intersection, proceed to the next step to determine the uniqueness of the value. Otherwise, proceed to B10.

[0093] B10. Mark the original expression pair as "attributes have hierarchical relationships and intersecting values, and there is an intersection space." End.

[0094] ③ Compare based on whether the attribute field value is unique

[0095] A particular feature of XACML's apply function declaration is the "only one value" function, which restricts an object to a single value, preventing it from taking multiple values ​​simultaneously. For example, the "city of registered residence" attribute field in the previous example can only take a single value, and this restriction is implemented using the "only one value" function. Conflicts caused by non-unique values ​​cannot be eliminated simply by crossing rules. For example, if "third-grade teachers can view third-grade students' grades" and "second-grade teachers cannot view third-grade students' grades," it is possible for the subject space to contain objects that are both third-grade and second-grade teachers. This would result in conflicts when determining authorization for these special objects. Therefore, when determining whether the value of the same attribute field is unique, it is necessary to specify whether the attribute field is unique.

[0096] The specific method for obtaining the unique comparison value is as follows:

[0097] B11. Determine whether there is an "only one value" function in the apply function declaration of the expression. If so, mark the expression pair as "no intersection space exists". Otherwise, mark it as "no intersection but not unique value, intersection space exists".

[0098] Comparison between A2 Expression and Minimum Expression Tree

[0099] Minimum expression trees are divided into two types based on the type of non-leaf nodes: an OR tree and an AND tree. When an expression is compared with an OR tree, it must be disjoint with both of its leaf nodes. When an expression is compared with an AND tree, it is disjoint with the AND tree if it is disjoint with either of its leaf nodes.

[0100] A3 Comparison of two minimum expression trees

[0101] Comparing OR tree 1 with OR tree 2, first compare one node of OR tree 1 with OR tree 2. If there is no intersection, then compare another node with OR tree 2. If there is still no intersection, output no intersection, otherwise there is intersection;

[0102] Comparing tree 1 with tree 2, first compare a node of tree 1 with tree 2. If there is no intersection, output no intersection. If there is intersection, compare another node with tree 2. If there is no intersection, output no intersection. Otherwise, there is intersection.

[0103] Comparing OR tree 1 with AND tree 2, first compare one node of OR tree 1 with AND tree 2. If there is no intersection, then compare another node with AND tree 2. If there is still no intersection, output no intersection, otherwise output intersection;

[0104] Note: When comparing an OR tree with an AND tree, you can only compare the points of the OR tree with the AND tree in sequence, otherwise there will be a contradiction.

[0105] A4 Comparison of two expression trees

[0106] The expression tree is divided into an OR tree and an AND tree based on the root node. If the left and right subtrees are still expression trees or expressions, the judgment can be made in the same way as A3. Finally, the relationship between the two expression trees, whether they are non-intersecting or intersecting, and the corresponding labels are output.

[0107] 1.3 Establishment of index structure

[0108] 1.1 and 1.2 describe how to determine whether the target domains of two specific rules intersect. However, when performing policy conflict detection, which rules to select for comparison and in what order to compare are also key issues that affect detection accuracy and efficiency. In this embodiment, an index structure is established by combining the policy tree and the effects of the rules, such as Figure 3 shown.

[0109] Simply create an allow list and deny list for each policy tree. When searching for potentially conflicting rules, simply search for lists that are not in the same policy tree as the rule in question and have the opposite effect. This index structure offers significant advantages for access control service systems with complex policy rules and multiple layers of combinations.

[0110] 2. Rule Conflict Detection and Resolution Analysis

[0111] 2.1 Rule Conflict Detection

[0112] This embodiment proposes a conflict detection algorithm based on the expression tree comparison method:

[0113] Execute the following rules in the policy with the effect of allowing rule P:

[0114] Step 1. Select rules with a different label from the policy tree where ruleP is located (i.e., different policy trees) and a deny effect, forming the set {ToBeTested-ruleD}.

[0115] Step 2. Compare ruleP with the rules in {ToBeTested-ruleD} one by one;

[0116] Step 2.1. Create the target expression tree of the rule pair to be compared;

[0117] Step 2.2: Determine whether the two target expression trees intersect based on the expression tree comparison method. If so, store the rule pair in the queue to be output.

[0118] Execute the following rules in the policy with a deny effect:

[0119] Step 3. Select rules with different labels from ruleD and whose effect is "allow" to form the set {ToBeTested-ruleP}.

[0120] Step 4. Compare rule D with the rules in {ToBeTested-ruleP} one by one;

[0121] Step 4.1. Create the target expression tree of the rule pair to be compared;

[0122] Step 4.2, according to the expression tree comparison method, determine whether the two target expression trees intersect. If so, then

[0123] The rule pair is stored in the queue to be output;

[0124] Step 5. If the output queue is not empty, output the rule pairs in the output queue; otherwise, output Null.

[0125] The algorithm ends.

[0126] 2.2 Conflict Resolution Analysis

[0127] In the conflict detection algorithm described in 2.1, each rule pair is essentially derived from an expression comparison. In the expression comparison algorithm, when expressions intersect, four possible scenarios can be identified based on the labels of the intersections. Policy designers can design conflict resolution methods based on these possible scenarios, making the access control system more comprehensive and enabling more accurate control.

[0128] 1) "Attribute-independent" means that the two rules each define their own required attributes, but it is possible for an object to satisfy both attributes simultaneously, such as a person whose department is Internal Medicine and whose rank is Director. This conflict may arise because the priority order between the unrelated attributes is not fully considered. Simply establish a priority relationship between the two rules to resolve the conflict.

[0129] 2) "Intersecting values ​​for the same attribute" refers to two rules with overlapping value ranges for the same attribute field, such as "Department: Internal Medicine, Pediatrics" and "Department: Internal Medicine, Otolaryngology." This conflict may be caused by an incorrect policy design that leads to overlap. In this case, the two ranges can be adjusted to be disjoint. Alternatively, both rules may be necessary under different conditions. In this case, a precedence relationship should be established or a distinguishing constraint should be added to the policy design.

[0130] 3) "Hierarchical relationship and intersecting values" means that under a hierarchical attribute field, there are two rules with intersecting spaces, such as "Department is ENT" and "Triage Room is Otolaryngology". The reason for this conflict is the same as the previous case.

[0131] 4) "Disjoint but non-unique values" refers to two related attribute fields with non-overlapping value ranges, but the values ​​in the two attribute fields are not unique, such as "Title: Chief Physician" and "Title: Senior Expert." This conflict may be caused by unclear attribute value classification, which can be resolved by further splitting the attribute fields. It may also be caused by incomplete restrictions on the attribute fields, which can be resolved by restricting the attribute fields to "unique values."

[0132] The present invention is not limited to the foregoing specific embodiments. The present invention extends to any new features or any new combination disclosed in this specification, as well as any new method or process steps or any new combination disclosed. Any non-substantial changes or improvements made by those skilled in the art without departing from the spirit of the present invention shall fall within the scope of protection of the claims.

[0133] All features disclosed in this specification, or all steps in the disclosed methods or processes, except mutually exclusive features and / or steps, can be combined in any manner.

[0134] Any feature disclosed in this specification, unless otherwise stated, may be replaced by other equivalent or similar features. That is, unless otherwise stated, each feature is only an example of a series of equivalent or similar features.

Claims

1. The access control policy conflict detection method based on XACML is characterized by: The following processes are included: Step 1: Create a policy tree based on rules, policies, and policy sets. Step 2: Create an index structure based on the established policy tree and the effects of the rules; Step 3: Obtain the rules in the policy to be tested and compare each rule with the opposite rule in a different policy tree. Step 4: If the comparison result is an intersection, it indicates that the corresponding rule pairs conflict. The corresponding rule pairs are stored in the queue to be output. Steps 3-4 are repeated until all rules in the policy to be detected are compared and all rule pairs in the queue to be output are output. The comparison method in step 3 is as follows: establishing target expression trees for the rule pairs to be compared and comparing them to determine whether the two target expression trees intersect; A rule consists of three parts: target, condition, and effect. The target's four domains are composed of resources, subjects, actions, and environments. Each domain consists of multiple attribute fields and their attribute values. The effect defines whether to allow or deny authorization for access policies that meet the target and conditions. The combination of a target's attribute field and its value rules is an expression. The target expression tree establishment method is as follows: for the multi-level expressions in each domain of the target, an expression tree is established according to the OR and AND relationship, wherein the non-leaf nodes are OR and AND relationships, and the leaf nodes are expressions; in the expression tree, a binary tree with only one non-leaf node is a minimum expression tree; The method for determining whether expression trees intersect is as follows: the target expression trees are compared only within their respective subdomains. If there is intersection in each subdomain, it means that the target domain has intersection; conversely, if there is no intersection in a subdomain, then the target domain has no intersection.

2. The XACML-based access control policy conflict detection method according to claim 1, characterized in that: The strategy tree includes rules, strategies and strategy sets; rules are leaf nodes, strategy sets are root nodes of the tree, rules are combined to form strategies through a rule combination algorithm, and strategies are combined to form strategy sets through a strategy combination algorithm.

3. The XACML-based access control policy conflict detection method according to claim 1, characterized in that: Step 2 specifically includes establishing an allow list and a deny list of the policy tree according to the effects of the rules, wherein the allow list includes rules whose effects are to allow authorization, and the deny list includes rules whose effects are to deny authorization.

4. The XACML-based access control policy conflict detection method according to claim 1, characterized in that: The specific methods for comparing target expression trees include: Step 3.1, compare expressions with each other; Step 3.2, compare the expression with the minimum expression tree; Step 3.3, compare the minimum expression tree with the minimum expression tree; Step 3.4: Compare the two expression trees.

5. The XACML-based access control policy conflict detection method according to claim 4, characterized in that: The comparison method between the expression in step 3.1 is: Step 3.1.1: Compare the attribute fields of the two expressions to see if they are the same. If they are the same, mark them as "same" and go to step 3.1.

2. Otherwise, select one of the two attribute fields to determine the hierarchical structure and determine whether the other attribute field is in the same hierarchical structure. If so, mark it as "has a hierarchical relationship" and go to step 3.1.

2. Otherwise, mark the expression pair as "attribute unrelated, has an intersection space" and go to step 3.1.

4. Step 3.1.2: Determine whether the expression is marked as "same" or "hierarchical relationship." If marked as "same," then the attribute field value results are intervalized and the intervals are intersected. If there is no intersection, proceed to step 3.1.

3. Otherwise, the expression pair is marked as "same attribute values ​​overlap, and there is an intersection space." If marked as "hierarchical relationship," the expression with the higher-level attribute field in the two expressions is marked as H, and the expression with the lower-level attribute field is marked as L. The expression marked as L is searched for the parent node in the hierarchical index structure to find the value of the corresponding level, and the expression composed of this value and the attribute field is marked as L'. The expressions marked as H and L' are compared using the comparison method marked as "same." If there is no intersection, proceed to step 3.1.

3. Otherwise, the original expression pair is marked as "hierarchical attribute values ​​intersect, and there is an intersection space," and proceed to step 3.1.

4. Step 3.1.3: Determine whether there is an "only one value" function in the apply function declaration of the expression. If so, mark the expression as "no intersection space exists" and proceed to step 3.1.

4. Otherwise, mark the expression as "no intersection but not unique value, intersection space exists" and proceed to step 3.1.

4. Step 3.1.4, end.

6. The XACML-based access control policy conflict detection method according to claim 4, characterized in that: The specific process of step 3.2 is as follows: the minimum expression tree is divided into an OR tree and an AND tree according to the type of non-leaf nodes. When the expression is compared with the OR tree, if the expression has no intersection with both leaf nodes of the OR tree, it means that the expression has no intersection with the OR tree, otherwise it means that there is an intersection; when the expression is compared with the AND tree, if the expression has no intersection with one of the two leaf nodes of the AND tree, it means that the expression has no intersection with the AND tree, otherwise it means that there is an intersection.

7. The XACML-based access control policy conflict detection method according to claim 4, characterized in that: The specific process of step 3.3 is: determining whether the two minimum expression trees are OR trees or AND trees; Comparing OR trees with OR trees: Compare two nodes in one OR tree with another OR tree in turn. If both nodes have no intersection with the other OR tree, it means there is no intersection; otherwise, it means there is intersection. Comparing the AND tree with the AND tree: Compare the two nodes in one AND tree with the other AND tree in turn. If any node has no intersection with the other OR tree, it means there is no intersection, otherwise it means there is intersection; Compare the OR tree with the AND tree: compare a node in the OR tree with the AND tree. If there is no intersection, compare another node in the OR tree with the AND tree. If there is still no intersection, it means there is no intersection, otherwise it means there is an intersection.

8. The XACML-based access control policy conflict detection method according to claim 4, characterized in that: The specific process of step 3.4 is: the expression tree is divided into an OR tree and an AND tree according to the root node, and the left and right subtrees are still expression trees or expressions. The judgment is performed according to the method of step 3.3, and the two expression trees are output to have no intersection or intersection relationship.

Images