Access Control via Belnap Logic
0 likes373 views
The document discusses access control policies using Belnap logic. It introduces the PBel policy language, which is based on Belnap's four-valued logic and allows writing both basic and composite access control policies. The core PBel language supports basic policies, negation, conjunction, and implication. Several extensions to the core language are also described, such as request predicates with logical connectives, attributes on requests, and various policy composition idioms. The document proves certain subsets of PBel, such as PBelCf, ensure policies are conflict-free. Overall, PBel provides an expressive yet analyzable framework for access control policies based on Belnap's four-valued logic.
![Access Control via Belnap Logic
Core BPel policy language
Core BPel policy language
Formal semantics
A policy is interpreted as a mapping [[p]]M from requests to
elements of the Belnap space.
[[b if rp]]M (r ) is b is r ∈ rp M or ⊥ otherwise
[[ ]]M (r ) =
[[¬p]]M (r ) = ¬[[p]]M (r )
[[p ⊃ q]]M (r ) = [[p]]M (r ) ⊃ [[q]]M (r )
[[p ∧ q]]M (r ) = [[p]]M (r ) ∧ [[q]]M (r )
10/32](https://image.slidesharecdn.com/accesscontrilviabelnaplogic-120715051249-phpapp01/85/Access-Control-via-Belnap-Logic-10-320.jpg)
![Access Control via Belnap Logic
Core BPel language extensions
Request Predicates with Logical Connectives
In core PBel, request predicates are either truth constants or
atomic request predicates. PBelcan be extended by allowing
request predicates to be written using logical operators. The
following formulas define PLr , a propositional logic over request
predicates. Each model M is naturally also a model for these
richer request predicates. We write r jM cp if request r is in the
set [[cp]]M of requests denoted by cp.
Figure 2: abstract syntax of composite request predicates - PLr
12/32](https://image.slidesharecdn.com/accesscontrilviabelnaplogic-120715051249-phpapp01/85/Access-Control-via-Belnap-Logic-12-320.jpg)
![Access Control via Belnap Logic
Expressiveness of PBel
Expressing policy functions
Definition
1. A policy function f for model M is a function f : RM → 4 from
the set of requests of M into the Belnap space.
2. A policy function f for model M is expressible in PBel iff there
is some p ∈ PBel such that [[p]]M = f .
Definition
Let R be a subset of AP. 1. On each model M we defne
equivalence relation ≡R to be
M
{(r , r ) ∈ RM × RM |∀a ∈ R : r ∈ aM iffr ∈ aM }. 2. A policy
function f : RM → 4 is data-independent for R in M iff r ≡R r M
implies f (r ) = f (r ). 3. We write PBel R for the set of PBel
policies that contain only atoms from R. In particular, PBel AP
equals PBel.
17/32](https://image.slidesharecdn.com/accesscontrilviabelnaplogic-120715051249-phpapp01/85/Access-Control-via-Belnap-Logic-17-320.jpg)
![Access Control via Belnap Logic
Expressiveness of PBel
Expressing policy functions
Theorem 2
Let R be a subset of AP and let M be a model. Then we have: 1.
For each p in PBel R , policy function [[p]]M is data-independent
for R in M. 2. Conversely, let f be a policy function that is
data-independent for R in M for finite set RM . Then there is
some p in PBel R with f = [[p]]M .
18/32](https://image.slidesharecdn.com/accesscontrilviabelnaplogic-120715051249-phpapp01/85/Access-Control-via-Belnap-Logic-18-320.jpg)
![Access Control via Belnap Logic
Expressiveness of PBel
Expressing policy functions
Corollary 1
Let R be a subset of AP and let M be a model with finite set RM .
1. Let f be data-independent for R in M such that is not in the
R
image of f . Then there is some p ∈ PBelCf with f = [[p]]M .
2. Let f be data-independent for R in M such that ⊥ is not in the
R
image of f . Then there is some p ∈ PBelGf with f = [[p]]M .
3. Let f be data-independent for R in M such that neither nor
R
⊥ is not in the image of f . Then there is some p ∈ PBel2 with
f = [[p]]M .
19/32](https://image.slidesharecdn.com/accesscontrilviabelnaplogic-120715051249-phpapp01/85/Access-Control-via-Belnap-Logic-19-320.jpg)
![Access Control via Belnap Logic
Expressiveness of PBel
Expressing policy compositions
Theorem 3
Let n ≥ 0 and g ∈ 4n → 4. Then there is a term tg ∈ A such
that: [[tg (p1 , ..., pn )]]M (r ) = g ([[p1 ]]M (r ), ..., [[pn ]]M (r ))
∀pi ∈ PBel, M, r ∈ RM .
Theorem 4
Suppose L ∈ {PBelCf , PBelGf , PBel2 }, n ≥ 0 and g : 4n → 4L . L
Then there is a term tg in AL such that tg (p1 , ...pn ) ∈ L if pi ∈ L
and [[tg (p1 , ..., pn )]]M (r ) = g ([[p1 ]]M (r ), ..., [[pn ]]M (r ))
∀pi ∈ L, M, r ∈ RM
20/32](https://image.slidesharecdn.com/accesscontrilviabelnaplogic-120715051249-phpapp01/85/Access-Control-via-Belnap-Logic-20-320.jpg)
![Access Control via Belnap Logic
Policy analysis
A policy query language
Theorem 5
For all p ∈ PBel we have:
1. Policy p is gap-free iff query p ≤t p[⊥→ f ] is valid.
2. Policy p is conflict-free iff query p ≤t p[ → k] is valid.
23/32](https://image.slidesharecdn.com/accesscontrilviabelnaplogic-120715051249-phpapp01/85/Access-Control-via-Belnap-Logic-23-320.jpg)
![Access Control via Belnap Logic
Policy analysis
Formula validity
1 add a clause α ⇒ φ to the grammar of R to express that
query φ holds conditional assumption α. The resulting
language is called R⇒ .
2 extend the satisfaction relation for that clause by setting
M |= α ⇒ φ iff [[α]]M = RM or M |= φ.
3 extend the definition of C (.) to clause α ⇒ φ by setting
C (α ⇒ φ) = α → C (φ).
Theorem 7
A query φ in R⇒ is valid iff formula C (φ) in PLr is valid.
27/32](https://image.slidesharecdn.com/accesscontrilviabelnaplogic-120715051249-phpapp01/85/Access-Control-via-Belnap-Logic-27-320.jpg)
Access Control via Belnap Logic
- 1. Access Control via Belnap Logic Access Control via Belnap Logic Andrada A¸tef˘noaie s a Computer Science Faculty of Iasi March 14th, 2012 1/32
- 2. Access Control via Belnap Logic Outline Outline 1 Outline 2 Introduction 3 Belnap Logic 4 Core BPel policy language 5 Core BPel language extensions 6 Safe sublanguages of BPel 7 Idioms of policy composition 8 Expressiveness of PBel 9 Policy analysis 10 Language extensions and alternatives 11 Applications 12 Summary 13 Bibliography 2/32
- 3. Access Control via Belnap Logic Introduction General notions Access control refers to methods or mechanisms that decide whether requests to access come resources should be granted or not. Control policies evolved from “programming in the small” to “programming in the large”. One of the most important requirement is to detect from start through statistic analysis gaps and conflicts. 3/32
- 4. Access Control via Belnap Logic Introduction PBel - overview derived from Belnap logic (⊥, , t, f ) basic policies: “request predicate” and “result value”. A basic policy maps an access request satisfying the requested predicate to the resulted value and otherwise it is mapped to ⊥. used for writing both policies in the small as well as policies in the large has support for analysable policy composition, its semantics being fully compositional the core language is expressive, but there are also non-core features: logical operators over requested predicates, an attribute language for requests, derived policy operators, and a feature known as “closure” in the literature. 4/32
- 5. Access Control via Belnap Logic Belnap Logic Belnap bilattice Bilattice definition A bilattice is a structure (A, ≤t , ≤k , ¬) where A is a non-empty set and ≤t and ≤k are partial orders on A such that (A, ≤t ) and (A, ≤k ) are complete lattices, ¬ maps from A to A and these conditions must hold: x ≤t y ⇒ ¬y ≤t ¬x x ≤k y ⇒ ¬x ≤k ¬y and ¬¬x = x. First two conditions say that negation inverts the truth, but does not affect knowledge. 5/32
- 6. Access Control via Belnap Logic Belnap Logic Belnap bilattice The Belnap bilattice is (4, ≤t , ≤k , ¬), where 4 = {t, f , ⊥, }. ∨ and ∧ are used for the join and meet operation of the lattice formed by the truth ordering, and ⊕ and ⊗ are used for the join and meet operations over the information ordering. The truth negation swaps t and f and leaves ⊥ and fixed, The negation operator is noted with − and called “conflation”. This operation inverts knowledge, but does not affect the truth. Value ⊥ means “no information” and value means “conflict” or “too much information”. 6/32
- 7. Access Control via Belnap Logic Core BPel policy language Core BPel policy language Abstract syntax of core BPel - 1 rp ::= Request Predicate a = Atomic true = Truth false = Falsity p, p = Policy b if rp Basic Policy - responds with b when rp maps the request to t and responds with ⊥ when rp maps the request to f . 7/32
- 8. Access Control via Belnap Logic Core BPel policy language Core BPel policy language Abstract syntax of core BPel - 2 Conflict ¬p Logical negation - ¬p responds with ¬x, where x is the response to the policy p p ∧ p Logical meet- takes the responses x and y of p and q and responds with element x ∧ y . p ⊃ p Implication - grants if p does not grant or q does grant and it denies if p grants and q denies. 8/32
- 9. Access Control via Belnap Logic Core BPel policy language Core BPel policy language Access control model An “access control model” M is a non-empty set RM of requests with a predicate rp M ⊆ RM for every request predicate, such that true M = RM and false = {}. Propositional model Let M be a model, r , a request in RM , a an atomic predicate and aM its interpretation in model M. Then the propositional model pr is defined by pr = t if r ∈ aM and pr = f if r ∈ aM M M M / 9/32
- 10. Access Control via Belnap Logic Core BPel policy language Core BPel policy language Formal semantics A policy is interpreted as a mapping [[p]]M from requests to elements of the Belnap space. [[b if rp]]M (r ) is b is r ∈ rp M or ⊥ otherwise [[ ]]M (r ) = [[¬p]]M (r ) = ¬[[p]]M (r ) [[p ⊃ q]]M (r ) = [[p]]M (r ) ⊃ [[q]]M (r ) [[p ∧ q]]M (r ) = [[p]]M (r ) ∧ [[q]]M (r ) 10/32
- 11. Access Control via Belnap Logic Core BPel language extensions Derived policy operators Figure 1: policy operators derived in terms of operators of core PBel 11/32
- 12. Access Control via Belnap Logic Core BPel language extensions Request Predicates with Logical Connectives In core PBel, request predicates are either truth constants or atomic request predicates. PBelcan be extended by allowing request predicates to be written using logical operators. The following formulas define PLr , a propositional logic over request predicates. Each model M is naturally also a model for these richer request predicates. We write r jM cp if request r is in the set [[cp]]M of requests denoted by cp. Figure 2: abstract syntax of composite request predicates - PLr 12/32
- 13. Access Control via Belnap Logic Core BPel language extensions Request Predicates on Request Attributes PBel can be further enriched by allowing attributes of requests. Let Attr be a collection of attributes and Doma the value domain of attribute a in Attr . An attribute model M over attribute term Attr is a non-empty set RM of requests, an element k M for each constant k in Attr , and a function attr M that maps a request r and an attribute a in Attr to the value attr M (r )(a) in Doma for that attribute. 13/32
- 14. Access Control via Belnap Logic Core BPel language extensions Request Predicates on Request Attributes Figure 3: predicates on the attributes of requests are expressed in a propositional logic over attribute-term equations. 14/32
- 15. Access Control via Belnap Logic Safe sublanguages of BPel Safe sublanguages of BPel Figure 4: Policy languages PBelCf (left), PBelGf (middle), and PBel2 (right). Expression r stands for any PBel expression. Value v ranges over {t, f , ⊥} for PBelCf , over {t, f , } for PBelGf , and over {t, f } for PBel2 . Theorem 1 All policies p ∈ PBelCf are conflict-free. All policies p ∈ PBelGf are gap-free. And all policies p ∈ PBel2 are conflict-free and gap-free. 15/32
- 16. Access Control via Belnap Logic Idioms of policy composition Idioms of policy composition Absolute rights and absolute prohibitions Bonatti et al. state that policy languages need to support explicit prohibitions. In PBel, access prohibitions can be specified for a set of requests rp2 by (f if rp2 ). The right to a set of requests rp1 is expressed by the policy (t if rp1 ). Now, given any policy p these rights and prohibitions can be enforced as absolute ones for p by using the idiom (t if rp1 ) ⊕ (f if rp2 ) > p. 16/32
- 17. Access Control via Belnap Logic Expressiveness of PBel Expressing policy functions Definition 1. A policy function f for model M is a function f : RM → 4 from the set of requests of M into the Belnap space. 2. A policy function f for model M is expressible in PBel iff there is some p ∈ PBel such that [[p]]M = f . Definition Let R be a subset of AP. 1. On each model M we defne equivalence relation ≡R to be M {(r , r ) ∈ RM × RM |∀a ∈ R : r ∈ aM iffr ∈ aM }. 2. A policy function f : RM → 4 is data-independent for R in M iff r ≡R r M implies f (r ) = f (r ). 3. We write PBel R for the set of PBel policies that contain only atoms from R. In particular, PBel AP equals PBel. 17/32
- 18. Access Control via Belnap Logic Expressiveness of PBel Expressing policy functions Theorem 2 Let R be a subset of AP and let M be a model. Then we have: 1. For each p in PBel R , policy function [[p]]M is data-independent for R in M. 2. Conversely, let f be a policy function that is data-independent for R in M for finite set RM . Then there is some p in PBel R with f = [[p]]M . 18/32
- 19. Access Control via Belnap Logic Expressiveness of PBel Expressing policy functions Corollary 1 Let R be a subset of AP and let M be a model with finite set RM . 1. Let f be data-independent for R in M such that is not in the R image of f . Then there is some p ∈ PBelCf with f = [[p]]M . 2. Let f be data-independent for R in M such that ⊥ is not in the R image of f . Then there is some p ∈ PBelGf with f = [[p]]M . 3. Let f be data-independent for R in M such that neither nor R ⊥ is not in the image of f . Then there is some p ∈ PBel2 with f = [[p]]M . 19/32
- 20. Access Control via Belnap Logic Expressiveness of PBel Expressing policy compositions Theorem 3 Let n ≥ 0 and g ∈ 4n → 4. Then there is a term tg ∈ A such that: [[tg (p1 , ..., pn )]]M (r ) = g ([[p1 ]]M (r ), ..., [[pn ]]M (r )) ∀pi ∈ PBel, M, r ∈ RM . Theorem 4 Suppose L ∈ {PBelCf , PBelGf , PBel2 }, n ≥ 0 and g : 4n → 4L . L Then there is a term tg in AL such that tg (p1 , ...pn ) ∈ L if pi ∈ L and [[tg (p1 , ..., pn )]]M (r ) = g ([[p1 ]]M (r ), ..., [[pn ]]M (r )) ∀pi ∈ L, M, r ∈ RM 20/32
- 21. Access Control via Belnap Logic Policy analysis A policy query language The query language R (for “policy Refinement”) is very simple. Queries are conjunctions of atomic queries. Atomic queries come in two types: atomic query p ≤t q asks whether policy p is everywhere less than or equal to policy q in the truth ordering, whereas atomic query p ≤k kq asks the same question for the information ordering. We can evaluate these queries φ over models M through a satisfaction predicate M |= φ, specified in the following figure. This predicate interprets policy refinement as a constraint that applies to all requests of a model. 21/32
- 22. Access Control via Belnap Logic Policy analysis A policy query language Figure 5: satisfaction relation |= between models M and queries φ ∈ R A query is valid iff it is satisfied in all models. 22/32
- 23. Access Control via Belnap Logic Policy analysis A policy query language Theorem 5 For all p ∈ PBel we have: 1. Policy p is gap-free iff query p ≤t p[⊥→ f ] is valid. 2. Policy p is conflict-free iff query p ≤t p[ → k] is valid. 23/32
- 24. Access Control via Belnap Logic Policy analysis Reducing queries to propositional logic The query validity checks can be turned to validity checks for the propositional logic PLr . Step 1: generate, for each PBel policy p and b in {t, f }, a formula p ⇑ b of PLr that captures the exact condition for p to respond with some value v satisfying v ≥k b. In the following figure these conditions are defned as “constraints” cp in PLr over the atoms a occurring in p. Figure 6: “constraint” p ⇑ b in PLr for PBel expressions p and b in {t, f } . 24/32
- 25. Access Control via Belnap Logic Policy analysis Reducing queries to propositional logic Step 2: use the constraints p ⇑ b to encode the meaning of atomic queries p ≤k q and p ≤t q. The conjunction of queries is treated compositionally. Thus each query φ in R has a corresponding formula C (φ) in PLr as defined in the following figure. Figure 7: “constraint” C (φ) ∈ PLr for query φ . 25/32
- 26. Access Control via Belnap Logic Policy analysis Reducing queries to propositional logic Theorem 6 Suppose φ ∈ R. Then query φ is valid iff C (φ) is valid as a formula of propositional logic PLr . 26/32
- 27. Access Control via Belnap Logic Policy analysis Formula validity 1 add a clause α ⇒ φ to the grammar of R to express that query φ holds conditional assumption α. The resulting language is called R⇒ . 2 extend the satisfaction relation for that clause by setting M |= α ⇒ φ iff [[α]]M = RM or M |= φ. 3 extend the definition of C (.) to clause α ⇒ φ by setting C (α ⇒ φ) = α → C (φ). Theorem 7 A query φ in R⇒ is valid iff formula C (φ) in PLr is valid. 27/32
- 28. Access Control via Belnap Logic Language extensions and alternatives Language extensions and alternatives Alternative atomic policies Methods and interface specifications Request mappings - support for “closure” which means that the result of a policy on a request can depend on the result of a sub-policy on another request. 28/32
- 29. Access Control via Belnap Logic Applications Applications Firewalls Role-based access control 29/32
- 30. Access Control via Belnap Logic Summary Summary defined BPel and shown that it neatly handles common problems in policy composition by basing PBel on Belnap’s four-valued logic, the properties of conflict-freedom and gap-freedom can be expressed as simple, purely semantic properties of policies possibility of using request predicates in PBel, which abstract away from the specifics of requests and environmental data in an application domain. importance of core BPel language - language analysis reduces to that core 30/32
- 31. Access Control via Belnap Logic Bibliography Bibliography “Access Control via Belnap logic: Intuitive, Expressive and Analysable Policy Composition” by Glenn Bruns and Michael Huth, June 2011 31/32
- 32. Access Control via Belnap Logic Bibliography Thank you! 32/32