格语言中基于属性访问控制的规范完备性
Canonical Completeness in Lattice-Based Languages for Attribute-Based Access Control
摘要：
规范完备的基于属性的访问控制（ABAC）语言的研究相对较新。规范完备的语言是有用的，因为它在功能上是完备的，并为策略提供了“范式“。然而，以前的工作规范完全ABAC语言要求的授权决策集是完全有序的，这并不能准确地反映背后的直觉使用的允许，拒绝和不适用的决定在访问控制。许多最近的ABAC语言使用第四个值，并且授权决策集是部分排序的。在本文中，我们展示了如何在多值逻辑的典型完整性可以扩展到的情况下，真值集形成一个格。这使我们能够研究具有偏序真值集的逻辑的规范完备性，如贝尔纳普逻辑，并表明基于贝尔纳普逻辑的ABAC语言，如PBel，不是规范完备的。然后，我们构造一个规范的完整的四值逻辑使用之间的连接的对称群（定义在一组决策）和一元运算符的规范的合适的逻辑的生成器。最后，我们提出了一个新的授权语言$\text{PTaCL}_{\sf 4}^{\leqslant}$，PTaCL的扩展，它包含了一个格序决策集，是规范完全的。然后，我们将讨论如何在XACML框架内利用$\text{PTaCL}_{\sf 4}^{\leqslant}$的优势。
英文摘要：
The study of canonically complete attribute-based access control (ABAC) languages is relatively new. A canonically complete language is useful as it is functionally complete and provides a "normal form" for policies. However, previous work on canonically complete ABAC languages requires that the set of authorization decisions is totally ordered, which does not accurately reflect the intuition behind the use of the allow, deny and not-applicable decisions in access control. A number of recent ABAC languages use a fourth value and the set of authorization decisions is partially ordered. In this paper, we show how canonical completeness in multi-valued logics can be extended to the case where the set of truth values forms a lattice. This enables us to investigate the canonical completeness of logics having a partially ordered set of truth values, such as Belnap logic, and show that ABAC languages based on Belnap logic, such as PBel, are not canonically complete. We then construct a canonically complete four-valued logic using connections between the generators of the symmetric group (defined over the set of decisions) and unary operators in a canonically suitable logic. Finally, we propose a new authorization language $\text{PTaCL}_{\sf 4}^{\leqslant}$, an extension of PTaCL, which incorporates a lattice-ordered decision set and is canonically complete. We then discuss how the advantages of $\text{PTaCL}_{\sf 4}^{\leqslant}$ can be leveraged within the framework of XACML.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
