The usage control (UCON) model was introduced as a unified approach to capture a number of extensions for traditional access control models. While the policy specification flexibility and expressive power of this model have been studied in previous work, as a related and fundamental problem, the safety analysis of UCON has not been explored. This paper presents two fundamental safety results for UCONA, a sub-model of UCON only considering authorizations. In UCONA, an access control decision is based on the subject and/or the object attributes, which can be changed as the side-effects of using the access right, resulting in possible changes to future access control decisions. Hence the safety question in UCONA is all the more pressing since every access can potentially enable additional permissions due to the mutability of attributes in UCON. In this paper, first we show that the safety problem is in general undecidable. Then, we show that a restricted form of UCONA with finite attribute value domains and acyclic attribute creation relation has a decidable safety property. The decidable model maintains good expressive power as shown by specifying an RBAC system with a specific user-role assignment scheme and a DRM application with consumable rights.

The recent usage control model (UCON) is a foundation for next-generation access control models with distinguishing properties of decision continuity and attribute mutability. A usage control decision is determined by combining authorizations, obligations, and conditions, presented as UCON ABC core models by Park and Sandhu. Based on these core aspects, we develop a formal model and logical specification of UCON with an extension of Lamport's temporal logic of actions (TLA). The building blocks of this model include: (1) a set of sequences of system states based on the attributes of subjects, objects, and the system, (2) authorization predicates based on subject and object attributes, (3) usage control actions to update attributes and accessing status of a usage process, (4) obligation actions, and (5) condition predicates based on system attributes. A usage control policy is defined as a set of temporal logic formulas that are satisfied as the system state changes. A fixed set of scheme rules is defined to specify general UCON policies with the properties of soundness and completeness. We show the flexibility and expressive capability of this formal model by specifying the core models of UCON and some applications.

The control of information flow has been used to address problems concerning the privacy and the secrecy of data. A model based on decentralized labels extends traditional multilevel security models by allowing users to declassify information in a distributed way. We extend this decentralized labels model developed by other authors by addressing specific issues that arise in accessing files and databases and in general in I/O operations. While retaining the support for static analysis, we also include run-time checks to allow declassification with “controlled information leakage”.

The use of the graph-based framework to specify the administration of RBAC systems has several advantages, from the intuition provided by the visual aspect to the precise semantics and the systematic verification of constraints. Here the benefits of this framework are illustrated using SARBAC (scoped administration of role based access control), providing the first steps towards its operational semantics and a more expressive constraint language.

Recently presented usage control (UCON) has been considered as the next generation access control model with distinguishing properties of decision continuity and attribute mutability. Ausage control decision is determined by combining authorizations, obligations, and conditions, presented as UCONABC core models by Park and Sandhu. Based on these core aspects, we develop afirst-order logic specification of UCON with Lamport's temporallogic of actions (TLA). The building blocks of this model include:(1) a sequence of states expressed by attributes of subjects, objects, and the system, (2) state predicates on subject andobject attributes, (3) pre-defined authorization actions performed by the security system and subjects, (4) obligation actions, and(5) condition predicates on system attributes. For a UCON model we define a set of temporal logic formulas that hold as usage control policies. We show the flexibility and expressive capability of this logic model by specifying the new features and core models of UCON.

The Flexible Authorization Framework (FAF) defined by Jajodia et al. [2001] provides a policy-neutral framework for specifying access control policies that is expressive enough to specify many known access control policies. Although the original formulation of FAF indicated how rules could be added to or deleted from a FAF specification, it did not address the removal of access permissions from users. We present two options for removing permissions in FAF and provide details on the option which is representation independent.

Role-Based Access Control (RBAC) is supported directly or in a closely related form, by a number of products. This article presents a formalization of RBAC using graph transformations that is a graphical specification technique based on a generalization of classical string grammars to nonlinear structures. The proposed formalization provides an intuitive description for the manipulation of graph structures as they occur in information systems access control and a precise specification of static and dynamic consistency conditions on graphs and graph transformations. The formalism captures the RBAC models published in the literature, and also allows a uniform treatment of user roles and administrative roles, and a detailed analysis of the decentralization of administrative roles.

In an ownership-based framework for access control, with the possibility of granting access and administrative rights, chains of granted accesses will form. This is a comprehensive study of the problem of revoking such rights, and on the impact different revocation schemes may have on the chains. Three main revocation characteristics are identified: the extent of the revocation to other grantees (propagation), the effect on other grants to the same grantee (dominance), and the permanence of the negation of rights (resilience). A classification is devised using these three dimensions. The different schemes thus obtained are described, and compared to other models from the literature.

A uniform and precise framework for the specification of access control policies is proposed. The uniform framework allows the detailed comparison of different policy models, the precise description of the evolution of a policy, and an accurate analysis of the interaction between policies and of the behavior of their integration. The evolution and integration of policies are illustrated using a Discretionary Access Control policy and a Lattice Based Access Control policy. The framework is based on the theory of graph transformations.

The notion of class (or object pattern) as defined in most object-oriented languages is formalized using known techniques from algebraic specifications. Inheritance can be viewed as a relation betweeen classes, which suggests how classes can be arranged in hierarchies. The hierarchies contain two kinds of information: on the one hand, they indicate how programs are structured and how code is shared among classes; on the other hand, they give information about compatible assignment rules, which are based on subtyping. In order to distinguish between code sharing, which is related to implementational aspects, and functional specialization, which is connected to the external behavior of objects, we introduce an algebraic specification-based formalism, by which one can specify the behavior of a class and state when a class inherits another one. It is shown that reusing inheritance can be reduced to specialization inheritance with respect to a virtual class. The class model and the two distinct aspects of inheritance allow the definition ofcleaninterconnection mechanisms between classes leading to new classes which inherit from old classes their correctness and their semantics.

Reusing provably correct (pieces of) software not only simplifies the task of designing correct software systems, but also decreases the costs of their development. The problem of designing a class (in the sense of object oriented programming methodology) which inherits from those of a given library and whose instances respond to given messages, is reduced to the problem of symbolically deriving a specification from another one using the interfaces of the given classes as productions. The standard algebraic specifications and productions are enriched with keywords which can place standard properties of operations, which can enhance the expressiveness of the specifications or which can guide the choice of productions and drive the search in the space of all derivable specifications.>

High-level replacement systems are formulated in an axiomatic algebraic framework based on categories pushouts. This approach generalizes the well-known algebraic approach to graph grammars and several other types of replacement systems, especially the replacement of algebraic specifications which was recently introduced for a rule-based approach to modular system design. in this paper basic notions like productions, derivations, parellel and sequential independence are introduced for high-level replacement syetms leading to Church-Rosser, Parallelism and concurrency Theorems previously shown in the literature for special cases only. In the general case of high-level replacement systems specific conditions, called HLR1- and HLR2-conditions, are formulated in order to obtain these results. Several examples of high-level replacement systems are discussed and classified w.r.t. HLR1- and HLR2-conditions showing which of the results are valid in each case.

In ([6]), Tiuryn proved the existence of extensions of algebras with the unique fixed point property (iterative algebras) to ordered algebras with the least fixed point property (regular algebras), extensions preserving the fixed point solutions.