Ontology-based Policy Anomaly Management for Autonomic Computing

Abstract

Abstract-The advent of emerging computing technologies such as service-oriented architecture and cloud computing has enabled us to perform business services more efficiently and effectively. However, we still suffer from unintended security leakages by unauthorized actions in business services.Moreover, designing and managing different types of policies collaboratively in such a computing environment are critical but often error prone due to the complex nature of policies as well as the lack of effective analysis mechanisms and corresponding tools. In particular, existing mechanisms and tools for policy management adopt different approaches for different types of policies. In this work, we propose a unified framework to facilitate collaborative policy analysis and management for different types of policies, focusing on policy anomaly detection and resolution. Our generic approach captures the common semantics and structure of different types of access control policies with the notion of policy ontology. We also discuss a proof-of-concept implementation of our proposed framework and demonstrate how efficiently our approach can discover and resolve anomalies for different types of policies.Index Terms-Ontology, policy anomaly analysis, auto nomic computing. I. INT RODUCTIONWe have witnessed explosive growth of the applications adopting service oriented architecture (SOA) and cloud computing on the Internet. SOA technology and Cloud computing brought the concept of multi-tenancy for serving various subscribers through a common pool of resources. In such an environment, it is necessary to have a more flexible and collaborative access control mechanism to prevent unintended access of shared resources and private user data. Therefore, the use of a policy-based approach has received considerable attention to accommodate the security requirements covering such large, open, distributed and heterogeneous computing environments.A policy, the basic building block of policy-based sys tem, is a set of rules that control the behaviors of a system. Policy-based computing handles complex system properties by separating policies from system implementa tion and enables dynamic adaptability of system behaviors by changing policy configurations without reprogramming the systems. Policies in modern systems are exponentially growing in size and complexity. In a typical policy, multiple rules may overlap, which means one access request may match several rules. Furthermore, mUltiple rules within one policy may conflict, implying that those rules not only overlap each other but also yield different decisions. Conflicts in a policy may lead to both safety problem (e.g. allowing unauthorized access) and availability problem (e.g. denying legitimate access). On the other hand, there might be some rules that are redundant, meaning that an access request matching one rule also matches other rules with the same effect. In such a case, the performance of an access control system might be degraded since it directly depends on the number of rules...

Analysis of Application-Layer Filtering Policies With Application to HTTP

“…Hu [43] proposed to divide the five-tuple decision spaces into disjoint hyper-rectangles where conflicts are resolved using a combination of automatic strategies and manual administrator effort driven by risk analysis considerations. A completely different approach is presented by Bandara, that uses argumentation logic and achieves excellent performance [44], and Hu that introduced an ontology-based anomaly management framework that delegates set operation to BDDs [45].…”

L2TAP+SCIP: An Audit-based Privacy Framework Leveraging Linked Data

“…The query in Fig. 6 uses FILTER with multiple conditions (line [11][12][13][14]. The first conjunctive condition states that for an obligation to be pending, there should not exist a triple stating its performer agent (!bound(?performerAgent)) meaning that the obligation has not been performed.…”

“…the most restricted case for the combination of multiple sets of obligations). However, more complicated cases of combining multiple sets of obligations, such as when there are conflicts among obligations (as described in [14]), or a subset of obligations defined in the φ formula are linked to an access request, are out of the scope of this paper.…”

PaaSword: A Holistic Data Privacy and Security by Design Framework for Cloud Services

“…This has a number of limitations: (i) it leads to ad-hoc reasoning about policy compliance, one which is tied to the specific vocabularies that express the rules according to which the reasoning takes place; (ii) it limits the reusability and portability of policies; (iii) it precludes the identification of inter-policy relations; (iv) it limits the ability to perform policy governance. In order to overcome such limitations, semanticallyrich approaches to the specification of policies have been brought to the attention of the research community [17,32,40]. These generally embrace Semantic Web representations for capturing what we term action-oriented policies, i.e.…”