An Approach to Representing Access Control Policies for Improving DFANS

Abstract

Trust negotiation is an approach that establishes mutual trust between strangers wishing to share resources or conduct business by gradually requesting and disclosing credentials in the Internet. In trust negotiation, negotiation strategies must be adopted to determine the search for a successful negotiation. Deterministic Finite Automaton Negotiation Strategy (DFANS) is a complete and highly efficient negotiation strategy proposed recently. DFANS takes advantage of ordered binary decision diagrams (OBDDs) to represent access control policies. However, the size of OBDDs is highly sensitive to the scanning order of resources in access control policies, which may result in exponentially large OBDDs in the worst case. To address this challenging issue, in this paper, a new data structure called access control policy diagrams (ACPDs) is proposed to take place OBDDs in DFANS. ACPDs are cyclic, directed graphs, whose sizes do not sensitive to the scan order of resources in access control policies, and the number of nodes in an ACPD is not more than the number of resources in the access control policy. Further, an efficient simplified algorithm is developed to reduce the number of nodes and shorten the path length when referring to redundant vertices in ACPDs.