[论文解读] Valued Authorization Policy Existence Problem

Jason Crampton, Eduard Eiben+3 more|arXiv (Cornell University)|Jun 10, 2021

Access Control and Trust参考文献 22被引用 1

一句话总结

本文提出了加权授权策略存在性问题（Valued APEP），这是经典 APEP 的推广，当不存在完美解时，可返回最小权重的授权策略。通过为约束违反分配权重，Valued APEP 提供一种‘最不坏’的策略，作者证明在两个关键约束下该问题为固定参数可满足（fixed-parameter tractable），显著优于以往 APEP 的复杂度结果。

ABSTRACT

Problems of satisfiability and resiliency in workflows have been widely studied in the last decade. Recent work has shown that many such problems may be viewed as special cases of the authorization policy existence problem (APEP), which returns an authorization policy if one exists and 'No' otherwise. A solution may not exist because of the restrictions imposed by the base authorization relation and constraints that form part of the input to APEP. However, in many practical settings it would be more useful to obtain a 'least bad' policy than just a 'No', where 'least bad' is characterized by some numerical value associated with the policy indicating the extent to which the policy violates the base authorization relation and constraints. Accordingly, we introduce the Valued APEP, which returns an authorization policy of minimum weight, where the (non-negative) weight is determined by the constraints violated by the returned solution (and is 0 if all constraints are satisfied). We then establish a number of results concerning the parameterized complexity of Valued APEP. We prove that the problem is fixed-parameter tractable if the set of constraints satisfies two restrictions, but is intractable if only one of these restrictions holds. (Most constraints known to be of practical use satisfy these restrictions.) We introduce the notion of a user profile for a weighted constraint, which enables us to prove a powerful result, a corollary of which improves on known complexity results for APEP. Finally, we consider Valued APEP when restricted to particular sub-classes of constraints and show that instances of such problems can be reduced to the Valued WSP, enabling us to exploit known algorithms to solve these particular instances.

研究动机与目标

• 为解决经典 APEP 的局限性，即当不存在有效授权策略时返回 'No'，提出一种加权变体，返回一种‘最不坏’的策略。
• 通过为违反分配数值权重并最小化总权重，建模现实中不可避免约束违反的授权系统。
• 在实际约束下建立 Valued APEP 的参数复杂度，证明当满足两个约束结构限制时问题具有可解性。
• 引入用户配置文件以处理加权约束，实现一个强大的理论结果，改进了已知的 APEP 复杂度界。
• 证明特定子类的 Valued APEP 可约化为加权工作流可满足性问题（Valued WSP），从而可复用现有算法。

提出的方法

• 作者将 Valued APEP 形式化为一个最小化问题，目标是寻找违反约束总权重最小的授权策略。
• 为每个加权约束定义用户配置文件，以捕捉用户角色和权限的分布，从而支持对约束交互作用的结构分析。
• 论文证明，当约束满足两个结构限制时，Valued APEP 具有固定参数可满足性：有界树宽和每约束中角色数有界。
• 他们证明，若仅满足两个限制中的一个，问题将变得不可解，从而确立了复杂度边界的紧致性。
• 他们将 Valued APEP 的特定子类约化为 Valued WSP，使得可对某些约束类型应用已知的多项式时间算法。
• 理论结果通过参数复杂度技术推导得出，包括内核化（kernelization）和基于树分解的动态规划。

实验结果

研究问题

• RQ1 在何种条件下 Valued APEP 是固定参数可满足的？这些条件与实际授权工作负载有何关联？
• RQ2 能否利用加权约束的用户配置文件推导出强于以往已知结果的复杂度结论？
• RQ3 放松两个结构约束中的一个，对 Valued APEP 的参数复杂度有何影响？
• RQ4 如何将 Valued APEP 的特定子类约化为 Valued WSP？这对算法解决方案有何启示？
• RQ5 引入约束违反的权重在多大程度上提升了授权策略合成的实用性？

主要发现

• 当约束满足两个结构限制（有界树宽和每约束中角色数有界）时，Valued APEP 具有固定参数可满足性。
• 若仅满足两个限制中的一个，问题将变得不可解，表明复杂度存在一个尖锐的临界点。
• 引入加权约束的用户配置文件，可导出一个推论，从而改进原始 APEP 的已知复杂度结果。
• 当问题被限制在可约化为 Valued WSP 的子类时，其仍保持可解性，从而可复用现有高效算法。
• 该框架为经典 APEP 提供了实用替代方案：当不存在完美解时，不再返回 'No'，而是返回一种‘最不坏’的策略。