🤖 AI Summary
Existing policy specification languages struggle to express access control policies in multilayered defense architectures with fine-grained precision, particularly due to their limited support for contextual information such as dynamic application states. This work proposes a Datalog-based declarative policy language that, for the first time, incorporates rich contextual data—including runtime application states—into access control decisions. The language enables expressive, fine-grained authorization rules and complex conditional logic through a declarative formalism. By reformulating SELinux policies within this framework, the study demonstrates the language’s superior expressiveness and effectiveness in capturing and enforcing sophisticated security policies, thereby addressing critical limitations of current approaches in representing context-aware, multilayered access control.
📝 Abstract
Recently, with the impossibility of eradicating the vulnerabilities of information systems, we must prepare for the occurrence of the security incident by the multi-layer defense called the Defense-in-Depth strategy. In the multi-layer defense, it is important to authorize accesses in fine-grained granularity to compose each layer effectively, and many access control models are proposed to follow them. However, policy description languages proposed so far cannot express the models appropriately in proper granularity. In this paper, we propose a policy description language which can designate many kinds of conditions for access control, such as the dynamic status of an application process, as an element of decision data, and implement it in Datalog. Using the proposed language, we compose the policy of SELinux, which is a major implementation achieving the multi-layer defense, and we confirm the advantages of the proposed language by evaluating its validity and expressiveness.