Information Technology Reference
In-Depth Information
-
WFM
(
SBAC
(
ψ
))
|
=
subsumes
L
(
l
i
,l
j
)
iff
l
i
,l
j
∈
SUBSUMES
L
.
In
SBAC
(
ψ
), the
SUBSUMES
L
relation is the reflexive-transitive closure of
an irreflexive-intransitive
DS
L
relation (
DS
⊆ L×L
);
DS
L
is short for “directly
subsumes level
L
”.
The
DS
L
relation comprises all pairs of status levels
l
i
,l
j
(
l
i
=
l
j
) such
that
l
i
,l
j
∈
SUBSUMES
L
, and there is no status level
l
k
(
l
i
=
l
k
,l
j
=
l
k
)
such that
SUBSUMES
L
.
The
DS
L
relation is represented in
SBAC
(
ψ
) by using a 2-place predicate
ds
L
with the intended meaning:
-
WFM
(
SBAC
(
ψ
))
|
=
ds
L
(
l
i
,l
j
)
iff
l
i
,l
j
∈DS
L
.
The relationship between
subsumes
L
and
ds
L
may be expressed thus:
l
i
,l
k
∈
SUBSUMES
L
and
l
k
,l
j
∈
∀
l
i
,
l
j
∈L
[
ds
L
(
l
i
,l
j
)
↔
subsumes
L
(
l
i
,l
j
)
∧
l
i
=
l
j
∧¬∃
l
k
∈L
[
subsumes
L
(
l
i
,l
k
)
∧
subsumes
L
(
l
k
,l
j
)
∧
l
i
=
l
k
∧
l
j
=
l
k
]].
The
subsumes
L
relation is defined thus (where ' ' is an anony-
Definition 4.
mous variable):
subsumes
L
(
L
1
,L
1)
←
ds
L
(
L
1
,
)
.
subsumes
L
(
L
1
,L
1)
←
ds
L
(
,L
1)
.
subsumes
L
(
L
1
,L
2)
←
ds
L
(
L
1
,L
2)
.
subsumes
L
(
L
1
,L
2)
←
ds
L
(
L
1
,L
3)
, subsumes
L
(
L
3
,L
2)
.
In
SBAC
(
ψ
), a 2-place
sla
predicate, a 3-place
pla
predicate, and a 3-
place
dla
predicate are respectively used to express status-level assignments,
permission-level associations, and denial-level associations. These predicates
have the intended meanings:
-
WFM
(
SBAC
(
ψ
))
|
=
sla
(
u
i
,l
j
)
iff
the requester agent
u
i
is assigned the
status level
l
j
∈L
.
-
WFM
(
SBAC
(
ψ
))
|
=
pla
(
p
n
,o
k
,l
j
)
iff
the permission (
p
n
,o
k
) (where
p
n
∈
P
and
o
k
∈O
) is associated with the status level
l
j
.
-
WFM
(
SBAC
(
ψ
))
|
=
dla
(
p
n
,o
k
,l
j
)
iff
the denial (
p
n
,o
k
) is associated with
the status level
l
j
.
The extension of
sla
at an instance of time will depend upon the actions per-
formed by requester agents. These actions are expressed via a set of application-
specific
security event descriptions
.
Definition 5.
A security event description is a finite set of ground 2-place as-
sertions that describe an event and which includes three
necessary
facts and
n
optional facts (
n
≥
0
).
Definition 6.
A necessary fact in a security event description
is a fact that
must appear in
in order for
to be well-formed. It follows from Definition 5 that
every well-formed security event description includes the three necessary facts.
