Access-Control Policy Verification Using Arithmetic Quantifier-Free Form Constraints
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing access-control policy verification methods face challenges in scalability and expressiveness, particularly when dealing with complex constraints and multi-step operations, as they often rely on low-level Boolean expressions or verbose high-level languages like XACML, which are inefficient and do not support multi-step verification.
Innovation Solution
The method expresses access-control policies and constraints in arithmetic quantifier-free form (QFF), allowing for the identification of operation vectors and determination of constraints across multiple steps, using a constraint generating unit to parse and solve QFF constraints to verify policy adherence and subsumption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If low-level Boolean expressions are used for access-control policy verification, then the verification can be performed, but the scalability and expressiveness are limited when dealing with complex constraints and multi-step operations
Solution Approach 1:
The patent transforms access-control policies from traditional Boolean expression format into arithmetic quantifier-free form constraints. This parameter change in representation format enables the system to handle complex constraints and multi-step operations more effectively, improving expressiveness while maintaining verification capability through arithmetic relationships rather than purely logical operations.
2Adaptability or versatility
If verbose high-level languages like XACML are used for access-control policies, then expressiveness is improved, but efficiency deteriorates due to verbosity and lack of multi-step verification support
Solution Approach 1:
The patent changes the parameter of policy representation from verbose high-level language syntax to concise arithmetic quantifier-free form. This transformation removes unnecessary verbosity while preserving expressiveness, and explicitly adds support for multi-step verification operations, thereby improving verification efficiency without sacrificing policy description capability.
Solution Approach 2:
The patent segments the verification process into distinct arithmetic constraint components that can be independently evaluated and combined. By breaking down complex policies into quantifier-free arithmetic constraints, the system enables more efficient processing and multi-step verification compared to treating the entire policy as a single verbose rule set.
3Reliability
If traditional verification methods are used, then simple constraints can be verified, but scalability deteriorates when dealing with complex constraints and multi-step operations
Solution Approach 1:
The patent changes the verification parameter from traditional constraint satisfaction approaches to arithmetic quantifier-free form solving. This parameter change maintains verification accuracy for simple constraints while dramatically improving scalability for complex constraints and multi-step operations, as the arithmetic form enables more efficient algorithmic processing and combination of multiple verification steps.
Data Source
AI summary
A system and method is provided for verifying an access-control policy against a particular constraint for a multi-step operation. In disclosed embodiments, the method includes expressing the access-control policy as a first quantifier-free form (QFF) constraint and identifying the particular constraint as a second QFF constraint. The method also includes identifying an operation vector and providing copies of the operation vector associated with steps in the multi-step operation. The method also includes determining a third QFF constraint using the first QFF constraint, the second QFF constraint, and the copies of the operation vector. The method also includes solving the third QFF constraint to determine a solution and outputting a result of the solving.