AIR: A Policy Language Enabling Dependency Tracking for Policy Explanation

Ian Jacobi

23 October 2009

Overview

• What is AIR? Why do we need it?
• The AIR Reasoner
• AIR, in detail
• Examples
• Future Work

AIR Policy Language

• Rule-based policy language for accountability and access control
• Explanations for policy decisions generated using dependency tracking
• Grounded in Semantic Web technologies for greater interoperability, reusability, and extensibility

The AIR Reasoner

• Python web application
• Given policy and event log, reasons over events for compliance with policy.
• Production rule system repeatedly applies rules in policy.
• Uses dependency tracking to build explanations of reasoning output.

The Rete Production Rule System

• Alpha memory contains pattern matches
• Beta nodes contain intermediate pattern-match results
• Join nodes merge alpha memory with beta nodes
• Production nodes at bottom "produce" the rule result.

Dependency Tracking

"The angles of a triangle
 sum to more than 180 degrees"
  -> "Given a point and line,
         no parallel line exists"
    -> Riemann

"The angles of a triangle
 sum to less than 180 degrees"
  -> "Given a point and line,
         infinite parallel lines exist"
    -> Lobachevsky

Johnny asks: "What do the angles
              of a triangle sum to?"
      

• Dependencies are the specific set of premises from which any conclusion/policy decision was derived
• Dependency tracking is the process of maintaining dependency sets for derived conclusions
• We use a Truth Maintenance System (TMS) for tracking dependencies of conclusions
  • keeps track of the logical structure of a derivation
  • associates dependencies with each fact in the KB
  • has ability to assume and retract hypothetical premises

AIR specifications

• AIR policies are written in the N3 serialization of RDF
• Each AIR policy (air:Policy) consists of one or more rules (air:rule)
  policy ::= { rule }
• A rule is made up of a pattern (air:if) that the reasoner will attempt to match. Based on whether the pattern matches or not, the reasoner will choose an appropriate action (air:then when matching, air:else if not)
  rule ::= pattern, { action }
• An action can either be an assertion (air:assert), which is a set of facts that are added to the knowledge base, or a nested rule
  action := assertion | rule

:Policy1 a air:Policy;
    air:rule [
        air:if { ... };
        air:then [ air:assert [ air:statement { ... } ] ];
        air:else [ air:rule [ ... ] ]
    ].

Example 1:

• Police may view criminal records.

:CaptainMcCluskey a p:PoliceOfficer .
:VitoCorleoneRapSheet a p:CriminalRecord .
:VirgilSollozoPersonalRequest a p:PersonalRequest .

:request1972 a p:RecordRequest ;
    p:record :VitoCorleoneRapSheet ;
    p:requester :CaptainMcCluskey ;
    p:purpose :VirgilSollozzoPersonalRequest .

:DickTracy a p:PoliceOfficer .
:AlphonseCapriceRapSheet a p:CriminalRecord .
:DickTracyAttemptedMurderInvestigation a p:ActiveCriminalInvestigation .

:request1931 a p:RecordRequest ;
    p:record :AlphonseCapriceRapSheet ;
    p:requester :DickTracy ;
    p:purpose :DickTracyAttemptedMurderInvestigation .
      

Example 1:

• Police may view criminal records.

@forAll :A, :P, :R.

:Policy a air:Policy;
    air:rule :Policy_1 .

:Policy_1 a air:Belief-rule ;
    air:if { :A a p:RecordRequest ;
                p:record :R ;
                p:requester :P .
             :R a p:CriminalRecord . } ;
    air:then [ air:rule :Policy_1a ] .

:Policy_1a a air:Belief-rule ;
    air:if { :P a p:PoliceOfficer . } ;
    air:then [
        air:assert [ air:statement { :A air:compliant-with :Policy . } ];
        air:description (:P " is a police officer requesting criminal record " :R) ];
    air:else [
        air:assert [ air:statement { :A air:non-compliant-with :Policy . } ];
        air:description (:P " is requesting criminal record " :R " but is not a police officer") ] .
      

Example 2:

• Police may view criminal records if the request is related to an ongoing investigation..

@forAll :A, :P, :R, :I.

:Policy a air:Policy;
    air:rule :Policy_1 .

:Policy_1 a air:Belief-rule ;
    air:if { :A a p:RecordRequest ;
                p:record :R ;
                p:requester :P ;
                p:purpose :I ;
             :R a p:CriminalRecord . } ;
    air:then [ air:rule :Policy_1a ] .

:Policy_1a a air:Belief-rule ;
    air:if { :P a p:PoliceOfficer .
             :I a p:ActiveCriminalInvestigation . } ;
    air:then [
        air:assert [ air:statement { :A air:compliant-with :Policy . } ];
        air:description (:P " is a police officer requesting criminal record " :R
                         " pertaining to an active criminal investigation " :I) ];
    air:else [
        air:assert [ air:statement { :A air:non-compliant-with :Policy . } ];
        air:description (:P " is either not a police officer or is a police officer "
                         "requesting criminal record " :R " not in relation to an "
                         "active criminal investigation") ] .
      

Future Work

• Implementing assumption-based reasoning for "pragmatic" policy implementations
• Making semantics of the explanation clearer
• Construction of meta-policies by reasoning over reasoner output

Questions?

Redistribution License