[Paper Review] Towards A Generic Formal Framework for Access Control Systems

Jason Crampton, C. Morisset|arXiv (Cornell University)|Apr 11, 2012

Access Control and Trust20 references7 citations

TL;DR

This paper proposes a generic formal framework for access control systems that enables the analysis of key properties like monotonicity and completeness in attribute-based access control models. By abstracting core components such as requests, policies, and decision logic, the framework allows for the formal specification of models that are both monotonic and complete—offering a foundation to evaluate and improve existing standards like XACML, which the authors show is neither monotonic nor complete.

ABSTRACT

There have been many proposals for access control models and authorization policy languages, which are used to inform the design of access control systems. Most, if not all, of these proposals impose restrictions on the implementation of access control systems, thereby limiting the type of authorization requests that can be processed or the structure of the authorization policies that can be specified. In this paper, we develop a formal characterization of the features of an access control model that imposes few restrictions of this nature. Our characterization is intended to be a generic framework for access control, from which we may derive access control models and reason about the properties of those models. In this paper, we consider the properties of monotonicity and completeness, the first being particularly important for attribute-based access control systems. XACML, an XML-based language and architecture for attribute-based access control, is neither monotonic nor complete. Using our framework, we define attribute-based access control models, in the style of XACML, that are, respectively, monotonic and complete.

Motivation & Objective

• To develop a generic formal framework for access control systems that supports reasoning about key properties such as monotonicity and completeness.
• To address the limitations of existing access control languages like XACML, which are neither monotonic nor complete, by formally characterizing models that are.
• To provide a structured method for evaluating the expressivity and security properties of access control policy languages.
• To enable the formal comparison of different access control models based on their components, including policy connectives, decision sets, and atomic policies.
• To support the design of access control systems that are both expressive and secure, avoiding vulnerabilities arising from non-monotonic behavior.

Proposed method

• The framework abstracts access control systems into core components: requests (with attributes), atomic policies, policy decisions, and evaluation functions.
• It models authorization policies as trees where leaf nodes represent atomic policies and internal nodes represent logical operators, with decisions computed via a valuation function.
• Monotonicity is formalized as a property ensuring that adding more attributes cannot improve a requester’s outcome, defined relative to a decision ordering (e.g., 0 < ⊥ < 1).
• Completeness is defined as the ability of a model to express all possible ideal policies using its set of atomic policies, decision set, and policy connectives.
• The framework uses multi-valued and partial logic to construct models that are provably monotonic or complete, based on formal semantics of policy evaluation.
• The approach allows for the instantiation of various access control models by selecting specific components, enabling systematic analysis of their properties.

Experimental results

Research questions

• RQ1 Can a generic formal framework be developed that enables the analysis of monotonicity and completeness in access control models without being tied to a specific policy language?
• RQ2 Why is XACML not monotonic or complete, and under what conditions could it be made so?
• RQ3 How can a model be formally constructed to ensure that it is both monotonic and complete, given a fixed set of atomic policies and decision semantics?
• RQ4 What is the relationship between the choice of policy connectives, decision set, and the completeness of an access control model?
• RQ5 How can the framework support the evolution of access control policies over time while preserving security properties like liveness and safety?

Key findings

• XACML is formally shown to be neither monotonic nor complete under standard decision orderings, highlighting a fundamental limitation in its design.
• The framework enables the construction of attribute-based access control models that are provably monotonic, by ensuring that additional attributes do not improve a requester’s authorization outcome.
• The framework supports the construction of models that are complete, meaning they can express any ideal policy using their defined set of atomic policies, decision set, and connectives.
• The formalization reveals that monotonicity is sensitive to the ordering of decisions; stronger forms of monotonicity exist depending on the decision lattice used.
• The framework provides a foundation for analyzing policy equivalence, ordering, and optimality, enabling comparisons between realizable policies and ideal access control requirements.
• Future work suggests that administrative policies and policy evolution rules can be modeled within the framework, enabling formal verification of liveness and safety properties.