Expression Tree-based Policy Conflict Detection Algorithm

Abstract

In attribute-based access control services, there are problems such as cumbersome policy control, prone to authorization conflicts, and conflicts caused by complex attribute structures are not easy to identify. Due to the difficulty of the conflict detection problem, most of the detection methods have strict requirements for policy structure. Normally, the priority strategy are chosen uniformly when using the directed acyclic graph approach to disambiguate conflict rule pairs. The present methods are not thorough, flexible and user-friendly for the policy design in practical applications. To address these problems, an access control policy conflict detection algorithm based on intersection of target expression trees under the XACML (eXtensible Access Control Markup Language) specification is proposed. The method efficiently locates the conflict rule pairs based on the index structure through policy tree and rule effects, determines the conflict by expression comparison n, and marks the possible causes of the conflict, provides analysis of the disambiguation scheme, and achieves access control with fine granularity.