Safety Decidability for Pre-Authorization Usage Control with Finite Attribute Domains

This paper considers the safety problem for the pre-authorization sub-model of the well-known
$UCON_{ABC}$
usage control model, that is,
$Pre\_UCON_A$
. It is shown that
$Pre\_UCON_A$
with finite attribute domains has decidable safety even if arbitrary object creation is allowed. This result eliminates the previously known restrictions for obtaining safety decidability in this context, which only allow a finite bounded number of objects to be created. Our result specifically permits unbounded object creation, so the set of objects is potentially infinite. In the proof, we show that the set of reachable protection tuples in infinite state
$Pre\_UCON_A$
models is finite and computable. We also provide a construction for decision procedure which answers the safety question by examining the reachable protection tuples.