A logic for state transformations in authorization policies

Abstract

In a multi-user information-sharing system, an authorization policy provides the ability to limit and control access to system, applications and information. In the real world, an authorization policy has temporal properties. That is, it needs to be updated to capture the changing requirements of applications, systems and users. These updates are implemented via transformations of the authorization policies. In this paper, we propose a logic-based approach to specify and to reason about state transformations in authorization policies. An authorization policy is specified using a policy base which comprises a finite set of facts and access constraints. We define the structure of the policy transformation and employ a model-based semantics to perform the transformation under the principle of minimal change. Furthermore, we extend the model-based semantics by introducing preference ordering to resolve possible conflicts during the transformation of policies. We also discuss the implementation of the model-based transformation approach and outline the relevant algorithms.