Aspect-oriented state machines for resolving conflicts in XACML policies

Abstract

Authorizationin collaborativesystemsisdefinedbyaglobal policy that represents the combination of the collaborators’ access policies. However, the enforcement of such a global policy may create conflicting authorization decisions. In this paper, we categorize two types of conflicts that may occur in such policies. Furthermore, to resolve these conflicts and to reach a unique decision for an access request, we present an approach that uses XACML policy combining algorithms and considers the category of the detected conflicts. The approach is implemented using aspect-oriented finite state machines.