Formal model and policy specification of usage control

Reviewer: Andre C. M. Marien

This is the latest in a series of papers about user control models (UCON), which provide a basis for next-generation access control systems. Access control in current-generation systems is static. Authorization and control are based on immutable attributes. This series of papers consider dynamic access control, and contains examples of problems requiring such an approach. The first step semi-formally describes authorizations, obligations, and conditions that are the basis for access control decisions. Temporal logic supports formal reasoning about time concepts, such as "always true," "eventually true," "has always been true," and "is true since." This type of reasoning is required in a world with mutable attributes. Lamport's temporal logic of action (TLA) provides the framework for formalizing the model and policy specifications. A fixed set of schema rules is defined to specify general UCON-policies that are subsequently proven sound and complete. The paper has 12 sections, presented in a typical academic style: an introduction; a motivating example; an introduction to UCON; an introduction to TLA; the logical model; the core authorization models of core UCON; models for obligations and conditions; a rule set that is sound and complete; the flexibility an expressive power of the model; related work; and conclusions and future work. The main contribution of this paper, according to the authors, is to formalize the UCON model with a temporal logic, while previously the model was informal and conceptual. This helps to define policies precisely, and give a precise meaning to the UCON features. Sections 6 and 10 prove that this approach is promising. A first step in understanding a user control system is understanding the scope of the proposed model. In this paper, a user control system is conceived as a system with six components: subjects and their attributes, objects and their attributes, rights, authorizations, obligations, and conditions. An authorization permits or denies access. Obligations are activities that must be performed by subjects. Conditions are environmental restrictions, unrelated to subject or object attributes. The authors point at two distinctive features of UCON: the continuity of access decisions and mutability of attributes. Decisions can be pre-decisions or ongoing decisions. Attribute updates can be pre-updates, ongoing updates, and post-updates, relative to their usage. Attribute updates can be administrator controlled or system controlled. The latter are mutable, the former are immutable as far as the system is concerned. There are three different kinds of attributes: subject, object, and system attributes. System state is a specific attribute with values initial, requested, denied, accessing, revoked, and end. There are two types of actions in UCON: user control actions and obligation actions. An update action changes the system state to a new one via an attribute update. System attributes cannot be updated. Actions are considered timeless. The transition from one system state to another is a usage control action. Actions are performed by either a subject or the system. An obligation is an action that must be performed by a subject before or during an access. The usage control decision is determined by authorizations before/during the usage, and there are no/one or more updates before and no/one or more updates during this usage. There are therefore eight core authorization models. Examples are given for each model. This uniform approach for heterogeneous existing models is refreshing, and it is well worth reading the paper just to gain an understanding and appreciation of this part. The next section provides a formal specification of general UCON models, and provides a proof of completeness and soundness. In the last core section, the authors discuss the expressivity and flexibility of the model. They include examples of role-based access control (RBAC); the Chinese Wall policy; dynamic separation of duty; the mandatory access control (MAC) policy with HIGH watermark property; and hospital information systems (HIS). Again, the approach supports a generic, concise, and clear description. Online Computing Reviews Service