[Paper Review] Detecting Incompleteness, Conflicting and Unreachability XACML Policies using Answer Set Programming

Carroline Dewi Puspa Kencana Ramli|arXiv (Cornell University)|Mar 9, 2015

Logic, Reasoning, and Knowledge7 references9 citations

TL;DR

This paper proposes an Answer Set Programming (ASP)-based framework to automatically detect incompleteness, conflicts, and unreachable policies in XACML 3.0 access control policies. By encoding XACML components and combining algorithms into logic programs, the approach enables efficient static analysis of policy sets to identify problematic patterns, with key contributions including formal detection of unreachable policies and conflict resolution support via ASP solvers.

ABSTRACT

Recently, XACML is a popular access control policy language that is used widely in many applications. Policies in XACML are built based on many components over distributed resources. Due to the expressiveness of XACML, it is not trivial for policy administrators to understand the overall effect and consequences of XACML policies they have written. In this paper we show a mechanism and a tool how to analyses big access control policies sets such as (i) incompleteness policies, (ii) conflicting policies, and (iii) unreachable policies. To detect these problems we present a method using Answer Set Programming (ASP) in the context of XACML 3.0.

Motivation & Objective

• To address the challenge of managing large, complex XACML 3.0 policy sets where manual analysis is error-prone and infeasible.
• To detect incomplete policies that may lead to unintended access due to missing conditions, especially under permit-biased PEPs.
• To identify conflicting policies that may lead to inconsistent decisions across different organizational units despite XACML's single-decision output.
• To detect unreachable policies that never influence the final decision, enabling policy set optimization through removal.
• To provide a formal, automated, and scalable method for policy analysis using logic programming and ASP

Proposed method

• Mapping XACML 3.0 components (policies, rules, targets, attributes) into logic programs using ASP semantics.
• Encoding attribute generation for all possible combinations using database-backed predicates (e.g., `subject(X) ← subject_db(X)`).
• Defining policy reachability via ASP rules that check applicability and decision outcomes under different combining algorithms (e.g., deny-overrides, first-applicable).
• Modeling unreachable policies using constraints: a rule is unreachable if its decision is never observed in the final policy outcome.
• Encoding combining algorithm semantics (e.g., `first-applicable`, `only-one-applicable`) to correctly propagate decisions and detect override behaviors.
• Using ASP solvers to compute answer sets that reveal unreachable policies, conflicts, and incompleteness by analyzing logical dependencies and decision propagation.

Experimental results

Research questions

• RQ1 How can incompleteness in XACML 3.0 policies be formally detected to prevent unintended access under permit-biased PEPs?
• RQ2 In what ways can conflicting policies be identified even when XACML’s combining algorithm produces a single decision?
• RQ3 What conditions make a policy unreachable in a policy set, and how can these be formally captured using logic programming?
• RQ4 How can Answer Set Programming be effectively used to model and analyze the semantics of XACML combining algorithms?
• RQ5 Can ASP-based analysis detect redundancy and support optimization of large policy sets by identifying and removing unreachable policies?

Key findings

• The proposed ASP-based framework successfully detects unreachable policies by analyzing decision propagation across policy sets under various combining algorithms.
• The method identifies incomplete policies that could lead to unintended access when using permit-biased PEPs, especially when no policy applies.
• Conflicts between policies are detected by analyzing divergent decisions across policy components, even if the final decision is consistent due to combining logic.
• The framework supports detection of unreachable policies under all XACML 3.0 combining algorithms, including first-applicable and deny-overrides.
• The use of ASP enables efficient and scalable analysis of large policy sets by leveraging mature answer set solvers such as clasp and Smodels.
• The approach provides a formal foundation for policy maintenance, allowing administrators to safely remove unreachable policies without affecting access control behavior.