On Completeness in Languages for Attribute-Based Access Control

Jason Crampton, Conrad Williams

Research output: Chapter in Book/Report/Conference proceedingConference contribution

137 Downloads (Pure)


Attribute-based access control (ABAC) has attracted considerable interest in recent years, resulting in an extensive literature on the subject, including the standardized XML-based language XACML. ABAC policies written in languages like XACML have a tree-like structure in which leaf nodes are associated with authorization decisions and non-leaf nodes are associated with decision-combining algorithms. In this paper, we consider the expressive power of the rule- and policy-combining algorithms defined by the XACML standard. In particular, we identify unexpected dependencies between the combining algorithms and demonstrate that there exist useful combining algorithms that cannot be expressed by any combination of XACML combining algorithms. We briefly discuss the decision operators defined in the PTaCL language, an abstract language for defining ABAC policies, and the advantages of replacing the XACML combining algorithms with the PTaCL operators. Following this, we review results in the literature on multi-valued logic and introduce the notion of canonically complete policy languages. We discuss important practical advantages of canonically complete policy languages, primarily in simplifying policy specification and providing efficiently enforceable policies. Finally, we propose a new policy authorization language PTaCL which is canonically complete and show it is capable of expressing any arbitrary policy in a normal form and discuss the advantages of using PTaCL over existing policy languages such as XACML and PTaCL.
Original languageEnglish
Title of host publicationProceedings of the 21st ACM on Symposium on Access Control Models and Technologies
Subtitle of host publicationSACMAT '16
Place of PublicationNew York
PublisherACM Press
Number of pages12
ISBN (Print)978-1-4503-3802-8
Publication statusPublished - 6 Jun 2016

Cite this