A Binary-String-Set-Based Algebraic Framework for Policy Composition

Abstract

Abstract: A new algebraic framework was proposed for merging the algebraic model with the implementation mechanism. In this framework, the policy is converted into logic pattern by defining new binary string/binary string set and constructing a new set of operation rules. Depending on that, an algorithm named rotate-combination is issued to solve the problem of order-sensitivity and rule-redundancy in MTBDD mechanism. By deriving the semantic operators and formulating the policies composition as expressions of the algebra, a new model was set. Furthermore, an analysis of the time complexity and simulation results were given to demonstrate the effectiveness of the framework, and its performance is better than that of the MTBDD-based mechanism.

Key words: access control, attribute, policy composition

CLC Number:

TP 393

LIU Chen-Yan-1, 2 , PAN Li-1, 2 , ZI Xiao-Chao-2. A Binary-String-Set-Based Algebraic Framework for Policy Composition[J]. Journal of Shanghai Jiaotong University, 2013, 47(04): 579-583.

References

［1］Ruj S, Nayak A, Stojmenovice I. DACC:Distributed access control in clouds［C］∥ IEEE 10th International Conference on Trust, Security and Privacy in Computing and Communications. Changsha:IEEE TrustCom, 2011:9198.
［2］NIST. Role Based Access Control［EB/OL］. (201206). http://csrc.nist.gov/groups/SNS/rbac/.
［3］邹林, 潘理. 基于角色访问控制系统中角色结构安全性分析问题的模型检测验证［J］. 上海交通大学学报, 2010,44(9):11921196.
ZOU Lin, PAN Li. RRASAP security verification based on model checking for RBAC access control systems［J］. Journal of Shanghai Jiaotong University, 2010, 44(9): 11921196.
［4］王小明, 付红, 张立臣. 基于属性的访问控制研究进展［J］. 电子学报, 2010,38（7）：16601667.
WANG Xiaoming, FU Hong, ZHANG Lichen. Research progress on attributebased access control［J］. Acta Electronica Sinica, 2010, 38(7): 16601667.
［5］Bonatti P, Vimercati S, Samarati P, et al. An algebra for composing access control policies［J］. ACM Transactions on Information and System Security, 2002, 5(1): 135.
［6］林莉, 怀进鹏, 李先贤. 基于属性的访问策略合成代数［J］. 软件学报, 2009,2(2): 403414.
LIN Li, HUAI Jinpeng, LI Xianxian. Attributebased access control policies composition algebra［J］. Journal of Software, 2009, 2(2): 403414.
［7］Rissanen E. eXtensible Access Control Markup Language(XACML)［EB/OL］.(2012). http://docs.oasisopen.org/xacml/3.0/xacml3.0corespecen.html.
［8］Rao P, Lin Dan, Bertino E, et al. An algebra for finegrained integration of XACML policies［C］ ∥Proceedings of the 14th ACM Symposium on Access Control Models and Technologies. New York:ACM, 2009: 6372.
［9］SourceForge. JavaBDD Reference［EB/OL］. (200710).http://javabdd.sourceforge.net/.
［10］Li Ninghui, Lin Dan, Rao P, et al. Access control policy combining: Theory meets practice［C］∥ Proceedings of the 14th ACM Symposium on Access Control Models and Technologies. New York:ACM, 2009:135144.
［11］Lin Dan, Bertino E, Li Ninghui, et al. EXAMa comprehensive environment for the analysis of access control policies［J］. International Journal of Information Security, 2010, 9(4): 253273.
［12］石纯一, 王家廞. 数理逻辑与集合论［M］. 2版. 北京:清华大学出版社, 2000:129160.
［13］Sun Microsystem. XACML implementation［EB/OL］. (200606).

http://sunxacml.sourceforge.net/.

[1]	DENG Junyong, JIANG Lin . BFM: A Bus-Like Data Feedback Mechanism Between Graphics Processor and Host CPU [J]. Journal of Shanghai Jiao Tong University(Science), 2020, 25(5): 615-622.
[2]	LI Zhan-dong, GU Ya-ping, LIU Yi-kun, WANG Ke-liang, ZHOU Zhi-jun, WU Jing-chun, LI Wei. Prediction of Natural Gas Hydrate Dessert Reservoir Based on Attribute Fusion Technology — Take Area A of Southwest Tai Basin in the South China Sea as an Example [J]. Ocean Engineering Equipment and Technology, 2018, 5(增刊): 1-5.
[3]	LU Cheng,XU Tingxue,WANG Hong. Fault Diagnosis of Terminal Guidance Radar Based on Attribute Granulation Clustering and Echo State Network [J]. Journal of Shanghai Jiaotong University, 2018, 52(9): 1112-1119.
[4]	SU Mang (苏铓), WANG Liangchen (汪良辰), FU Anmin (付安民), YU Yan (俞研). Proxy Re-Encryption Based Multi-Factor Access Control for Ciphertext in Cloud [J]. Journal of Shanghai Jiao Tong University (Science), 2018, 23(5): 666-670.
[5]	ZHENG Bo (郑波), LI Yanfeng (李彦锋), FU Guozhong (付国忠). Discretization Algorithm Based on Particle Swarm Optimization and Its Application in Attributes Reduction for Fault Data [J]. Journal of Shanghai Jiao Tong University (Science), 2018, 23(5): 691-695.
[6]	LI Yupeng1,LIAN Xiaozhen1,LU Cheng1,CHU Xuening2. Evaluation Approach to Rank Module Partition Schemes of Complex Products Based on Hybrid Fuzzy Multi-Attribute Decision Making [J]. Journal of Shanghai Jiaotong University, 2017, 51(11): 1374-1382.
[7]	HUANG Jiaxuan (黄嘉烜), JIN Xiaogang* (金小刚). Continuous Multiplicative Attribute Graph Model [J]. Journal of shanghai Jiaotong University (Science), 2017, 22(1): 87-091.
[8]	TAN Mingchaoa,DIAO Xingchuna,CAO Jianjuna,FENG Jingb. An Attribute Similarity Adjusting Algorithm Based on Functional Dependency [J]. Journal of Shanghai Jiaotong University, 2015, 49(08): 1075-1083.
[9]	MAO Xian-ping1 (毛贤平), CHEN Ke-fei2*(陈克非), LONG Yu1 (龙宇), WANG Liang-liang1 (王亮亮). Attribute-Based Signature on Lattices [J]. Journal of shanghai Jiaotong University (Science), 2014, 19(4): 406-411.
[10]	CHEN Shuang1,2,3,SONG Jinyu1,DIAO Xingchun1,2,CAO Jianjun2. Estimation of Enumerative Missing Values Based on Relational Markov Model [J]. Journal of Shanghai Jiaotong University, 2013, 47(08): 1246-1250.
[11]	WANG Li1,2,ZHOU Xianzhong1,LI Huaxiong1. Fuzzy Decision-theoretic Rough Set Model and Its Attribute Reduction [J]. Journal of Shanghai Jiaotong University, 2013, 47(07): 1032-1035.
[12]	WANG Wenquan，HUANG Sheng，WANG Chao，HU Yulong，HOU Yuanhang. Intuitionistic Fuzzy Multiple Attribute Group Decision-making for Ship Passage Arrangement [J]. Journal of Shanghai Jiaotong University, 2013, 47(06): 894-899.
[13]	WANG Wenquan,WANG Chao,HUANG Sheng，HOU Yuanhang,HU Yulong. Scheme Generation and Optimal Selection of Principal Dimensions for Large Naval Ships [J]. Journal of Shanghai Jiaotong University, 2013, 47(06): 916-922.
[14]	ZHOU Gui-Yin, HE Chen, JIANG Ling-Ge. Single Transceiver and Network Characteristics Based MAC Protocol for Cognitive Radio Wireless Sensor Networks [J]. Journal of Shanghai Jiaotong University, 2012, 46(11): 1729-1735.
[15]	LIU Hai-Tao-a, WEI Ru-Xiang-b, JIANG Guo-Ping-a. Similarity Measurement of Software Cost Data [J]. Journal of Shanghai Jiaotong University, 2012, 46(11): 1736-1740.