4.3 A Logic for Access Control and Conformance
4.3.6 A Polytime Fragment
Logic programming approaches to access control and conformance enjoy some compu- tational benefits in comparison to our approach (at the cost of expressive power). The main benefit comes from the restriction of heads/postconditions of rules to atomic predicates. In this section, we identify a fragment of the logic that is decidable in
polynomial time. We begin by defining the syntax of chain formulas:
Definition 4.14 (Chain formulas). Given a countable set Φ (of proposition names), countable sets of principal names OP, a finite set of identifiers ID, and a function
l :O→2Id, the language L(Φ, O, O
P, l, ID), abbreviated as L, is defined as follows:
ϕA ::= ⊥ | p | saysl(A)ψB (∀B ∈OP)
ϕ ::=ϕA (∀A∈OP)
ψA ::= ⊥ | p | OAϕA | PAϕA
ψ ::= ψA (∀A∈OP)
where p∈Φ. The set of formulas generated by each BNF rule are referred to as LϕA, Lϕ, LψA and Lψ respectively, and L=Lϕ∪Lψ.
in polynomial time. Let us consider an example, where ∆ contains the following formulas:
• saysl(A4)PA3saysl(A3)PA2saysl(A2)p
• saysl(A3)PA1 saysl(A1)⊥
• saysl(A1)p
It follows that ∆⊢saysl(A3)p, sinceA3 permitsA1 to speak for her. However, we will
show that ∆ 6⊢ saysl(A4)p, since A3 has not established the appropriate delegation
chain viaA2. We briefly discuss the restrictions imposed by chain formulas, and then
turn to the decision procedure.
Discussion of Restrictions: Chain formulas are a generalization of the construc-
tions used in the language Secpal[16]. In particular, we accomodateobligation and
speaking for. Many of the examples in the access control literature can be expressed in this fragment. From the conformance perspective, however, we lose the capability
to express probhibitions. Consider the following statement:
(26) A bloodbank must not ship a donation, if it tests positive for HIV.
This can be expressed as law, using the formalism in Section 4.3.3. However, the utterances that arise will be of the form: says{26}OB¬ship(B, d), i.e., the regulator
says (via law (26)) that the bloodbankB must not ship the donationd. The presence
of negation over the atomic proposition ship keeps it outside the chain fragment. We conjecture that negation can be accommodated with polytime decidability, but leave
an investigation to future work. We note that even the presence of falsity (⊥) poses
challenges. When ∆ 6⊢ ψ, we do not know if there is a model of polynomial size to
demonstrate that it is not provable. However, the existence of a model (of worst-case exponential size) can be shown, and we can avoid explicitly constructing it.
We now discuss the other restrictions imposed by chain formulas (Definition 4.14). says is restricted to formulas of the form saysl(A)ψ and formulas saysIdAψ forIdA⊂
l(A) are not allowed. This is done only to simplify the notation in proofs and all the techniques that we discuss are adapted easily to accomodate such formulas.
Conjunctions are not allowed within a chain. However, using the following equiv- alences, we can allow conjunctions under saying:
⊢saysl(A)(ϕ∧ψ)⇔(saysl(A)ϕ∧saysl(A)ψ)
This equivalence lets us turn formulas with conjunctions into chains, and hence, all the techniques that we discuss are easily adapted to accomodate this case. Conjunc- tions can also be used within obligations, due to a similar property. However, for permissions, we have:
⊢ PA(ϕ∧ψ)⇒(PAϕ∧ PAψ)
But, the converse is not necessarily true. We do not know if conjunctions under permissions can be accomodated with polytime decidability.
The next restriction is the exclusion of negation, and in particular, negation does
not appear over atomic propositions. In a modal logic without the axioms A5 and
A6, negations can be easily accomodated in chains (with polytime decidability) due
to the tree-model property [146]. However, with A5 and A6, the models are trees
with edges between siblings. The presence of these sibling edges make it difficult
to accomodate negation. In fact, the presence of ⊥ poses challenges as well. When
∆ 6⊢ ψ, we do not know if there is a model of polynomial size to demonstrate that
it is not provable. However, the existence of a model (of worst-case exponential size) can be shown, and we can avoid explicitly constructing it.
The final restriction is the strict alternation between saying and permission. For- mulas of the form saysl(A)saysl(B)ψ are excluded. The algorithm presented below can be extended (with some difficulty) to accomodate this case.
In applications where there are a mix of chain and non-chain formulas, we can use the non-interference (Theorem 4.4) to decide if the polytime procedure can be used for a particular decision, i.e., when the non-chain formulas do not interfere.
Polytime Decision Procedure: We now turn to the design of the algorithm to
decide whether ∆⊢ψ, starting the a notion of structural implication:
Definition 4.15 (Structural Implication). The relation ⊲⊆ L×L (written infix as
ϕ ⊲ψ and read ϕ structurally implies ψ) as the smallest set such that:
1. ⊥⊲ϕ
2. ϕ⊲ϕ
3. OAϕ ⊲XAψ if ϕ ⊲ψ, where X =O or X =P
4. PAϕ⊲PAψ if ϕ ⊲ψ
5. XA⊥⊲ϕ, where X =O or X =P
6. saysl(A)ϕ ⊲saysl(A)ψ if ϕ⊲ψ, for all A∈O
7. saysl(A)XAsaysl(A)ϕ ⊲ ψ if saysl(A)ϕ ⊲ ψ, for all A ∈ O, where X = O or
X =P
Given a set of formulas ∆ and a formula ψ, ∆⊲ ψ iff there exists ϕ ∈ ∆ such that
ϕ ⊲ψ.
We mention some properties of structural implication:
Proposition 4.3. The following hold:
• If ϕ ⊲ψ, then ⊢ϕ ⇒ψ • If ∆⊲ψ, then ∆⊢ψ
• If ϕ ⊲ψ, ψ ⊲φ, then ϕ⊲φ
The proof follows easily by induction on the clauses of Definition 4.15. We now
Definition 4.16 (Closed sets). A set of formulas ∆ is said to be closed iff for all
{saysl(A)ϕ,saysl(B)ψ} ⊆∆ and A6=B, we have:
• If OBsaysl(B)ψ ⊲ϕ, saysl(A)ϕ ∈∆.
• If ϕ ⊲PBsays
l(B)ψ, saysl(A)ψ ∈∆.
Given a set of formulas ∆, the closure of ∆, denoted by ∆∗, is the smallest set such
that ∆⊆∆∗ and ∆∗ is closed.
We will prove the following:
Theorem 4.6. Given a finite set of formulas ∆and a formula ψ: 1. ∆∗ ⊲ψ iff ∆⊢ψ.
2. ∆∗ can be computed in polynomial time.
3. ∆∗ ⊲ψ can be decided in polynomial time.
Proof. Item 1: The soundness, i.e., if ∆∗ ⊲ ψ, then ∆ ⊢ψ, follows easily from the
proof of item 2 below. The completeness, i.e., if ∆ ⊢ ψ, then ∆∗ ⊲ ψ, is, as usual,
more difficult, and the proof is given in Appendix B.7.
Item 2: We first consider the complexity of computing ϕ ⊲ ψ. If we turn Defini-
tion 4.15 directly into a (recursive) procedure, we get a worst-case exponential bound
(due to clause (7)). This needs to be handled by comparing prefixes of ϕ and ψ.
Given a formula saysl(A)φ and A ∈ O, the A prefix of φ, denoted wφA, is defined as
follows:
• wA
φ =ǫ if φ is ⊥, atomic, of the form XBφ′, where B 6=A, or XAψ, where ψ is
atomic or ⊥. The A suffix ofφ is φ−wA
φ =φ.
• Otherwise,wA
φ = (XA1, ....,XAn), whereφ =XA1saysl(A)...XAnsaysl(A)φ′ andwφA′ = ǫ. In this case, the A suffix of φ isφ−wA
|wAφ| denotes the lenght of the A prefix, where |ǫ| = 0. wφA(i) denotes the ith
element of the prefix for 1 ≤ i ≤ |wA
φ|. Given saysl(A)ϕ and saysl(A)ψ, wϕA and wψA
are the A prefixes. We say that wA
ϕ(j) matches wAψ(i), denoted wϕA(j) ⊲ wAψ(i), if
wA
ϕ(j) = O, or wAϕ(j) = wψA(i). The matching relation is extended to suffixes of
strings. (wA ϕ, j)⊲(wψA, i) ifj ≤ |wϕA| and: • i >|wA ψ|, or • i≤ |wA ψ|, wϕA(j)⊲wψA(i) and (wϕA, j+ 1)⊲(wAψ, i+ 1), or • i≤ |wA ψ|, wϕA(j)6⊲wψA(i) and (wϕA, j+ 1)⊲(wAψ, i)
And, finally, the matching relation is extended to strings: wA
ϕ ⊲ wAψ iff (wϕA,1) ⊲
(wA
ψ,1). We can now turn Definition 4.15 into a recursive procedure. Clauses (1)-(5)
remain, and clauses (6) and (7) are replaced with the following:
• saysl(A)ϕ ⊲says l(A)ψ if: – |wA ϕ|= 0 andϕ ⊲ψ, or – wA ϕ ⊲wψA and ϕ−wϕA⊲ψ−wψA
The equivalence to Definition 4.15 is established easily by induction. Note that each
application of the third clause of (wA
ϕ, j) ⊲ (wψA, i) corresponds to an application of
clause (7) in Definition 4.15. The complexity of this procedure is O(n+m) where n
is the depth of ϕ and m is the depth of ψ.
To compute the closure of ∆, we initalize ∆∗ to ∆ and repeatedly apply the two
clauses of Definition 4.16 until covergence. Let A be the set such that A ∈ A iff
saysl(A)ψ is a subformula of ∆. In the worst case, at each iteration, we add just one
formula, and achieve convergence at|A| ×s, wheres is the number of subformulas in
∆. The complexity of each iteration is O(s2×n), where n is the depth of ∆. And,
as a result, the complexity of computing ∆∗ isO(|A| ×s3×n).
Item 3: The size of ∆∗ is O(|A| ×s) and the depth is n. Thus ∆∗ ⊲ ψ can be