We propose in this paper a policies similarity approach which is performed in three steps. The first step is concerned with the formalization of a XACML policy as a term in a boolean algebra while taking into account the policy and rule combining algorithms. This formalization is based on Security Policy Language (SePL) which was proposed in a previous work. In the second step, the SePL term is transformed into a term in a boolean ring. In the third step, the two policy terms, which are derived from the previous step, are the input to a rewriting system to conclude which kind of relation exists between these security policies such as equivalence, restriction, inclusion, and divergence. We provide a case study of our approach based on real XACML policies and also an empirical evaluation of its performance.
This method of calculating similarity of policies is limited to policies having the same attribute. Similarly, it is not valid for a set of security policies (PolicySet) and handles only two combining algorithms: Permit-overrides" and Deny- overrides" of the entire set of rule combining algorithms described in XACML. In @cite_2 , propose an algorithm to verify the refinement of business confidentiality policies. The concept of policy refinement is close to the similarity of the policies in a certain sense, because this method checks if a policy is a subset of the other. However, their study is based on EPAL rather than XACML. It is an important difference, because the sole rule combining algorithm that is considered in their work is the First-one-applicable.
@cite_2
2036265926
It is shown that any recognition problem solved by a polynomial time-bounded nondeterministic Turing machine can be “reduced” to the problem of determining whether a given propositional formula is a tautology. Here “reduced” means, roughly speaking, that the first problem can be solved deterministically in polynomial time provided an oracle is available for solving the second. From this notion of reducible, polynomial degrees of difficulty are defined, and it is shown that the problem of determining tautologyhood has the same polynomial degree as the problem of determining whether the first of two given graphs is isomorphic to a subgraph of the second. Other examples are discussed. A method of measuring the complexity of proof procedures for the predicate calculus is introduced and discussed.