Reasoning about XACML Policy Descriptions in Answer Set Programming (Preliminary Report)

The advent of emerging technologies such as Web services, service-oriented architecture, and cloud computing has en-abled us to perform business services more efficiently and effectively. However, we still suffer from unintended secu-rity leakages by unauthorized services while providing more convenient services to Internet users through such a cutting-edge technological growth. Furthermore, designing and man-aging Web access control policies are often error-prone due to the lack of logical and formal foundation. In this paper, we attempt to introduce a logic-based policy management ap-proach for Web access control policies especially focusing on XACML (eXtensible Access Control Markup Language) policies, which have become the de facto standard for speci-fying and enforcing access control policies for various appli-cations and services in current Web-based computing tech-nologies. Our approach adopts Answer Set Programming (ASP) to formulate XACML that allows us to leverage the features of ASP solvers in performing various logical reason-ing and analysis tasks, such as verifying policy properties and detecting violation of separation of duty (SoD) constraints in role-based access control (RBAC)