XACML Policy Inconsistency Analysis and Resolution

Modality inconsistency is one of the security policy evaluation challenges, which arises because of the existence of both positive and negative authorizations for a given subject-object pair. An inconsistency analysis model is needed to discover inconsistency based on the inheritance relationship between concepts and resolved it by using predefined resolution rules. Previous studies handle modality inconsistency by providing the hierarchy of subjects and objects and simple conditions evaluation, like string equality matching. They do not identify modality inconsistency when a concept inherits conflicting decisions from its superclasses on the basis of the partially ordered structures obtained based on subject hierarchy, object hierarchy, and spatial hierarchy. An inconsistency analysis model is proposed in this paper to detect and resolve inconsistent policies during security policy evaluation. Our inconsistency analysis model analyzes all possible violations that might exist among security policies based on role hierarchy, object hierarchy, and spatial hierarchy. In addition, comparison with previous works shows that our inconsistency model is more effective in detecting inconsistency than the previous works.