Towards Composing Access Control Policies

Existing access control languages assume a single monolithic specification of the entire access control policy. This assumption does not fit many real-world situations, where access control might need to combine independently stated restrictions in separate policies that should be enforced as one. Furthermore, due to the rapidly increasing number, size, and complexity of the access control polices in the enterprise and IoT communication networks, efficient evaluation of access requests against large number of policies is challenging. Thus, there is an imminent need to develop a framework that composes distributed access control policies into a single policy. In this paper, we propose ACE, an access control policy composition engine, which uses a novel algebraic framework to combine any pair of access control policies into a single resultant policy. Through repetitive application, ACE can generate a resultant policy from any arbitrary number of individual policies. ACE can perform three binary composition operations on access control policies, namely addition, conjunction, and subtraction. The decision to any arbitrary access control request by the composed policy is the same as the decision for that request obtained by combining the independently obtain decisions from all policies. We implemented ACE, integrated it with SUN's implementation of XACML (a well-known access control language), and extensively evaluated it on a large number of policies. Our results show that the decisions obtained using the policy composed with ACE match the decision obtained from SUN's implementation for 100% of the access requests. Our results also show that with ACE, the evaluation time of access requests reduces by at least an order of magnitude compared to when ACE is not used.