XACML Policy Analysis via Disjunctive Normal Form Conversion
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Complex XACML policies are difficult to analyze due to their hierarchical structure and large size, making it challenging to identify redundant or conflicting rules, determine attribute values that result in permit or deny decisions, and refactor policies for improved efficiency.
Innovation Solution
The method involves converting XACML policies into Disjunctive Normal Form (DNF) expressions to simplify and analyze the logic, allowing for the identification of redundant rules, inconsistent conditions, and refactoring policies to improve clarity and efficiency by combining DNF expressions and eliminating redundant terms.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If XACML policies are made more comprehensive to address specific access control concerns, then the coverage and functionality of the policy improve, but the complexity and difficulty of analyzing the policy increases
Solution Approach 1:
The patent segments the complex XACML policy analysis into distinct components: converting policy rules to DNF expressions, identifying redundant rules, detecting conflicts, and computing intersections. This segmentation allows each aspect to be handled independently, making the overall complex policy manageable and analyzable.
Solution Approach 2:
The patent introduces DNF (Disjunctive Normal Form) expressions as an intermediary representation layer between the original XACML policy rules and the analysis process. This intermediary form simplifies the complex hierarchical XACML structure into a standardized logical form that is easier to manipulate and analyze for redundancy, conflicts, and intersections.
2Measurement precision
If brute force methods are used to test every possible combination of attribute values to identify redundant and conflicting rules, then the accuracy of identification improves, but the time and computational resources required increase significantly
Solution Approach 1:
The patent changes the parameter representation from testing every possible attribute value combination to working with DNF expressions that capture the logical structure. By transforming the problem from value-based testing to expression-based manipulation, the analysis achieves accurate identification of redundant and conflicting rules without the exponential time cost of brute force methods.
3Adaptability or versatility
If the number of rules and policies in the XACML policy increases to address more access control scenarios, then the functionality and coverage improve, but the difficulty of managing and understanding the access control system increases
Solution Approach 1:
The patent provides automated feedback about the policy structure by identifying and reporting redundant rules, conflicts, and intersections. This feedback mechanism helps policymakers understand the actual state of their policies, detect issues that would be difficult to spot manually, and make informed decisions about policy refinement, thereby easing management of complex policies with many rules.
4Productivity
If automated mechanisms are developed to perform policy refactoring and analysis, then the efficiency and accuracy of policy management improve, but the complexity of the analysis system increases
Solution Approach 1:
The patent replaces manual mechanical analysis of XACML policies with an automated computational system that converts policies to DNF expressions and algorithmically identifies redundancies, conflicts, and intersections. This substitution of manual inspection with automated reasoning achieves high efficiency in policy analysis while the underlying complexity is encapsulated in the automated system rather than requiring complex manual procedures.
Data Source
AI summary
XACML (eXtensible Access Control Markup Language) documents, PolicySets and Policies can become long, complex and difficult to completely comprehend. A method is provided for facilitating analysis of such code to make it easier to answer questions such as: Given a particular set of Attribute values (and/or others unknown as of now), what is permitted or denied; are any of the rules redundant; are any of the rules inconsistent; for any pair of policies in the code, what set of Attributes will they both return Permit; how can a policy be refactored into an equivalent set of policies in which each branch of the policy tree pertains to specific values of specified Attributes? To facilitate such analysis and refactoring, every Rule in the collection of policies being analyzed is reduced to an equivalent expression in DNF (Disjunctive Normal Form). Some terms, predicates and other elements may be eliminated.