Policy Conflicts and Resolution
When dealing with policy based systems, it is unavoidable that conflicts arise in the set of policies. Ideally conflicts are detected by static analysis of the policy set. However it is often not possible to perform such analysis on policies that depend on run-time state. In order to overcome such a issue, we designed a strategy that deterministically resolves the conflicts between two or more policies that apply to the same (subject, target, action)-triple.
To determine the precedence between two or more policies we based our conflict resolution algorithm on domain nesting. The domain nesting resolution gives precedence to policies that apply to a more specific instance of subjects, targets, or both. In other words, a policy that applies to a subdomain is more specific than a policy that applies to any ancestor domains. The main strength of this approach is that it is intuitively applicable to a domain-based system. However, it is possible that policies could be specified on subjects that are at different levels in the domain structure but on the same target, and vice-versa. In the following, we present several cases of such conflicts and we discuss how our strategy resolve them.
There are several case in which conflicts can arise and we provide an overview in the following scenarios: