Security Policy Reconciliation

Two organizations, two policies, no central authority to impose either. VIStology demonstrated reconciliation across independently administered servers — and, in the strongest result, across different (but similar) vocabularies, with the bridge axioms generated automatically.

Two Policies, One Exchange

One policy is easy. The real subject of this work is what happens when two independent organizations each have their own policy, wrote it without consulting the other, and must exchange information anyway. The definition we work to is stated plainly: “In this paper we define policy reconciliation as the determination of a policy that implicitly or explicitly satisfies both policies and governs the behavior of the interaction of the system(s).”

Implicit reconciliation — which is not an algorithm, and we will not call it one

In the simple case nothing is computed and no new policy object exists. Each server enforces its own policy on the stanza; if the stanza survives both, that survival is the reconciliation: “Here, policy reconciliation is implicit; a presence successfully sent from a user on Server 1 to a user on Server 2 means that both Server 1 and Server 2 allow the stanza.”

In the demonstration, one server gated presence on a fact about the person (drawn from her FOAF profile), the other on the first letter of her address, each with its own permitted days. Two users could talk on the day where the two policies happened to intersect — a fact discovered at run time rather than negotiated in advance. It is a correct and useful concept. It is also, honestly described, both firewalls said yes, and we describe it that way.

Explicit reconciliation — policies on the wire

When implicit enforcement is not enough — a client on one server wants to join a chatroom hosted on the other, and both servers have policies about who may join — the servers hand their policies to each other. The handshake runs: the client asks its own server; that server requests the chatroom’s policy from the far server; the far server retrieves it and replies with the policy itself; the near server computes a reconciled policy; if the policies can be reconciled, it ships that reconciled policy back; and then both servers enforce the same reconciled policy against the request before the presence is propagated.

That is a genuinely good result and it is the one we would put on the wall. It is also where a page like this normally starts lying, so here are the four things that are true and are not comfortable.

  • The paper gives no general reconciliation algorithm. It gives the protocol and one trivial case, and it hedges that case explicitly: “The reconciled policy in this case is logically equivalent to Server 1’s policy since Server 2’s policy subsumes Server 1’s. Therefore, reconciling the policies is equivalent to adopting the more restrictive policy.” In this case. One policy subsumed the other, so the answer was trivially the stricter one.
  • The conjunction semantics is not in the publication. The reconciliation operation — AND-ing the conditions of both policies — is stated in the conference talk, not in the peer-reviewed paper. We are not going to source it to the publication, and neither should anyone quoting us.
  • The papers never define when reconciliation is impossible. PolVISor is said to “provide policy reconciliation when possible” — and the failure condition behind that when possible is never stated anywhere in the paper. So we do not claim PolVISor detects irreconcilable policies, and we do not claim it resolves conflicts. It computes a policy that satisfies both, when one exists.
  • Explicit reconciliation requires each server to hand its full policy to the other. For a coalition reader that is the sharpest edge on this page, because a coalition policy is frequently itself classified. The authors put it out of scope in their own words: “Finally, we have not concerned ourselves with situations in which the policies to be reconciled cannot be completely disclosed between the interested parties.” And: “We have not focused on such situations of policy reconciliation where trust is an issue since trust management is beyond the scope of our current investigations.” Also out of scope, by the same admission: policy deference (“First, we assume that all partners in the policy negotiation process are equals.”), preferences among policies, and consequentialist policies.
Two policies, one exchange — reconciliation between two organizations with no central authority. Two independent organizations each run their own XMPP server, each with its own information-exchange policy, and each enforcing that policy locally with an Openfire plugin backed by PolVISor. Because XMPP is federated there is nowhere to install a central policy decision point: one system cannot impose limits on another, only on itself. So the policy itself has to travel. The figure is a sequence diagram of the explicit reconciliation protocol. Step one, Server 1 requests Server 2's policy. Step two, Server 2 returns it. Step three, Server 1 computes a reconciled policy that satisfies both. Step four, Server 1 sends that reconciled policy back to Server 2. Step five, both servers now enforce the same reconciled policy. Beneath the protocol, the paper's most distinctive result: the two servers do not have to share a vocabulary. Where Server 1 states its policy over FOAF terms and Server 2 states its over vCard terms, an ontology matcher runs at a confidence threshold of 0.9, and the resulting alignment is used to generate OWL bridge axioms automatically, so a policy written in one organization's vocabulary becomes enforceable against the other's. The authors' own claim is that effective ontology matching allows policy reconciliation across different but similar vocabularies. The figure also fences what this does not do. The conjunction semantics — that the reconciled policy is the AND of both policies' conditions — is stated only in the conference talk and never in the peer-reviewed paper. The papers never define the conditions under which reconciliation is impossible; PolVISor is said to provide reconciliation only when possible. Explicit reconciliation requires each server to disclose its full policy to the other, and the authors state plainly that policies which cannot be completely disclosed, and situations where trust is at issue, are outside the scope of the work; they assume all partners are equals. The matching demonstration itself produced eight correspondences between FOAF and vCard at the 0.9 threshold, which the authors themselves call a rather trivial example, and the paper reports no evaluation of any kind: no timing, no throughput, no scale. Two Policies, One Exchange XMPP is federated. There is nowhere to put a central guard — so the policy itself has to travel. central policy decision point does not exist — and cannot Organization A · XMPP Server 1 Openfire plugin + PolVISor · enforces locally Policy A — authored in its own terms Organization B · XMPP Server 2 Openfire plugin + PolVISor · enforces locally Policy B — authored in its own terms 1 Server 1 requests Server 2’s policy 2 Server 2 returns its policy — in full 3 Server 1 computes the reconciled policy BaseVISor reasons over both policies at once — each one loaded as its own closed-world context. one policy = one fact base 4 the reconciled policy is sent to Server 2 5 Both servers now enforce the same reconciled policy. Neither gave up sovereignty: each still enforces, locally, on every stanza it handles. And they do not have to share a vocabulary. This is the result that makes the protocol usable between organizations that never coordinated. Policy A stated over FOAF terms Policy B stated over vCard terms ontology matcher · confidence threshold 0.9 the alignment is used to generate OWL bridge axioms automatically, so a policy in one organization’s terms binds against the other’s. Where this stops — stated by the authors, not discovered by us ·  Explicit reconciliation requires each server to hand its full policy to the other. Policies that cannot be completely    disclosed, and situations where trust is at issue, are outside the scope of the work: “trust management is beyond the    scope of our current investigations.” The authors assume “all partners in the policy negotiation process are equals.” ·  The failure condition is never defined. PolVISor provides reconciliation “when possible” — and the paper never says    when it is not. We do not claim it detects irreconcilable policies, and we do not claim it resolves conflicts. The reconciliation operation — AND-ing the conditions of both policies — is stated in the conference talk, not in the peer-reviewed paper, so we do not source it to the publication. The one worked case in the paper is the easy one: Server 2’s policy subsumes Server 1’s, so the reconciled policy is just the more restrictive of the two. The FOAF/vCard matching produced 8 correspondences at the 0.9 threshold — “a rather trivial example,” in the authors’ own words. The paper reports no evaluation of any kind. Ulicny, Ng, Simakoff, Moskal & Kokar, “Semantic Policy Enforcement and Reconciliation for Information Exchange in XMPP,” STIDS 2011, CEUR-WS Vol-808, pp. 22–29. Performed under US Army contract W91260-09-C-0037, “Security Policy Reconciliation.”
Figure 1. Two policies, one exchange. XMPP is federated, so no central guard is possible — one system cannot impose limits on another, only on itself. Instead the policy travels: Server 1 asks Server 2 for its policy, computes a policy that satisfies both, sends it back, and both then enforce it. The distinctive result is underneath: the two organizations need not share a vocabulary. An ontology matcher aligns FOAF with vCard and generates OWL bridge axioms automatically, so a policy written in one side’s terms binds against the other’s. What the work does not do is fenced off in its own panel — explicit reconciliation requires each party to disclose its full policy, and non-disclosable policies and trust management are outside its scope.

The strongest result: reconciling without a shared vocabulary

Everything above assumes the two servers use the same words. Two organizations that never coordinated do not. So the last scenario removed the assumption: one server described its users in FOAF, the other in vCard, and the ontologies were matched automatically before the policies were reconciled at all — “we matched FOAF and vCard ontologies with the threshold of 0.9 (1 being 100% confident) using an ontology matching API…”, yielding eight correspondences. Those became machine-generated axioms bridging the two vocabularies: “The alignment between FOAF and vCard was used to dynamically produce OWL bridge axioms, which allow for reconciliation between policies using related, but differently named concepts.” A policy phrased in your vocabulary is then evaluable against my data.

The conclusion the authors draw is careful, and the parenthesis in it is load-bearing:

“While policy reconciliation typically requires the sharing of a common vocabulary, we have shown that effective ontology matching can be implemented to allow policy reconciliation across different (but similar) vocabularies.”

“(but similar).” Keep it. Drop it, and an honest claim becomes an overclaim about general ontology matching — which the same authors refuse to make: “Despite sophisticated methods from AI, ontology matching currently can rarely be fully automated beyond relatively simple correspondences, covering syntactic and terminological heterogeneity.” And they grade their own demonstration before anyone else can: “Although the scenario used a rather trivial example of matching, our design and implementation can support more complex alignments, as long as the matcher can first automatically align the ontologies.” A rather trivial example. Their words. We are not going to improve on them.

The same reasoner, applied to a query instead of a message

Policy-governed exchange is not only about who may speak. In a 2012 project demonstration — a demonstration, not a published result, and we label it that way — the same reasoner governed SPARQL queries carried over XMPP, deciding not who may talk to whom but what a client may ask a data store. We built an OWL model of SPARQL itself, so that rules could reason about a query’s shape and its content: forbid CONSTRUCT queries outright; forbid queries with no LIMIT, or a LIMIT above a bound, as a bulk-exfiltration guard; permit questions about dates of birth only to authorized staff.

That last rule is the one worth the ink. It does not match on the text of the query. It matches on any predicate that is owl:equivalentProperty to the one named in the policy — so paraphrasing the query with a synonymous predicate does not evade the policy. No string filter, and no regular expression, can do that; it is available only to a system that reasons about what the query means. And because every BVR rule carries an <explanation> in its head, a blocked query comes back with a statement of exactly which policy it violated and why. Explainability here is not a claim about a model’s internals — it is a string the policy author wrote, returned by the engine that fired the rule.

What We Did Not Measure

Two details from that demonstration belong here, because they bear on reconciliation specifically, not on the enforcement mechanism covered by the sibling use case.

  • Toy attributes, deliberately. The presence policies keyed on a person’s gender and on the first letter of her address, because the point was the machinery, not the attribute. The security-label scenario had users type the classification in brackets at the start of the message body — a demo affordance, not a protocol-level security control, and we do not borrow the credibility of the commercial products that do it properly.
  • The only numeral in the whole flagship that is the result of anything is the ontology-matching threshold: 0.9, yielding 8 FOAF-to-vCard correspondences — a configuration and a list, not a measurement. And the authors’ own verdict on the scenario it powered is “a rather trivial example.”

Proof Points

Reconciliation

Two Servers Agreed a Policy Neither Wrote

Two independently administered servers exchange policies, one computes a reconciled policy, ships it, and both then enforce it: “We were able to successfully compute a reconciled policy, propagate it to the other server, and enforce it.” And in the strongest scenario, they do it without a shared vocabulary — FOAF on one side, vCard on the other, matched automatically at a 0.9 threshold into OWL bridge axioms, “across different (but similar) vocabularies.” Boundaries, and they are real: the reconciliation operation is stated only in the conference talk, not the paper; the papers never define when reconciliation is impossible; explicit reconciliation requires each side to disclose its full policy; and non-disclosable policies and trust management are explicitly out of scope.

Selected Publications

Semantic Policy Enforcement and Reconciliation for Information Exchange in XMPP

Ulicny, B., Ng, W., Simakoff, O., Moskal, J. & Kokar, M.M.

Proceedings of the Sixth International Conference on Semantic Technologies for Intelligence, Defense, and Security (STIDS 2011), CEUR-WS Vol-808, pp. 22-29

View PDF

Situations and Policies

Ulicny, B., Powell, G.M., Ng, W., Moskal, J. & Kokar, M.M.

2012 IEEE International Multi-Disciplinary Conference on Cognitive Methods in Situation Awareness and Decision Support (CogSIMA), pp. 7-14

View Publication

A Demonstration of Formal Policy Reasoning Using an Extended Version of BaseVISor

Matheus, C.J., Kokar, M.M. & Dionne, R.

2008 IEEE Workshop on Policies for Distributed Systems and Networks (POLICY 2008), pp. 225-227

View Publication

See the full list of VIStology publications →

Related

Policy Reasoning & Secure Information Exchange The solution this use case belongs to Policy-Governed Information Exchange The sibling use case: compile the sentence Ontology Development The ontology matching behind the bridge axioms BaseVISor The engine that enforces the reconciled policy All Publications The full research record

Reconcile the Policies, Keep the Exchange

If two organizations need to exchange information and neither can adopt the other’s policy wholesale, we can help you compute a policy both sides can enforce.

Get in Touch