\documentclass{llncs}
\usepackage{url,floatflt}
\usepackage{fancyvrb,relsize,url,graphicx,epsfig}
\usepackage{listings}
\usepackage[usenames,dvipsnames]{color}
\usepackage{amssymb,amsmath}
\usepackage{graphicx}

\lstset{ %
language=XML,                % choose the language of the code
basicstyle=\small\ttfamily,       % the size of the fonts that are used for the code
identifierstyle=\color{Sepia}\ttfamily,
showspaces=false,               % show spaces adding particular underscores
showstringspaces=false,         % underline spaces within strings
showtabs=false,                 % show tabs within strings adding particular underscores
breaklines=true,                % sets automatic line breaking
breakatwhitespace=false,        % sets if automatic breaks should only happen at whitespace
%backgroundcolor=\color{SpringGreen},
stringstyle=\color{Blue}\ttfamily,
keywordstyle=\color{ForestGreen}\bf,
keywordsprefix={xlink},
morekeywords={id,name,type,Policy,PolicyDefaults,Target,VariableDefinition,Apply,
AttributeDesignator,Rule,Description,AnyOf,AllOf,Match,AttributeDesignator,AttributeValue,
Condition}
}

\DefineVerbatimEnvironment%
   {VerbatimN3}%
   {Verbatim}%
   {fontsize=\scriptsize, xleftmargin=0.25in}
\DefineVerbatimEnvironment%
   {VerbatimScript}%
   {Verbatim}%
   {fontsize=\scriptsize}

% comment out a section
\long\def\comment#1{\relax}

% something to do with xacml
\newcommand{\xacml}[1]{\emph{#1}}

% something to do with n3
\newcommand{\rdf}[1]{\fontfamily{verdana}\selectfont \bf{#1}}

% qname
\newcommand{\qname}[1]{\textit{#1}}

\newcommand{\notes}[1]{\textcolor[rgb]{0.00,0.59,0.00}{#1}}


% Put remarks in the paper easily located by ``bigodot'' in margin
% Usage: \todo{twf: we need a better example here.}
%\newcommand{\todo}[1]{%
%\mbox{}\marginpar[\hfill$\bigodot$]{$\bigodot$\hfill}
%{\sc#1}}
\newcommand{\todo}[1]{{\bf TODO:} #1}

%% ISWC 2010 Research Track
%% http://iswc2010.semanticweb.org/node/8

\begin{document}

\title{Policy Interoperability Through Rules Interchange Format}

\author{Jie Bao\inst{1} \and Lalana Kagal\inst{2} \and Vladimir Kolovski\inst{3}}

\institute{Rensselaer Polytechinc Institute \\
Troy, NY 12180\\
\email{baojie@cs.rpi.edu}
\and
MIT CSAIL \\
Cambridge, MA 02139 \\
\email{lkagal@csail.mit.edu}
\and
Semantic Technologies Group, Oracle Corporation\\
Nashua, NH 03062\\
\email{vladimir.kolovski@oracle.com}
}


\maketitle
\begin{abstract}

With policy management being a popular mechanism for providing
flexible security, the number of policy languages being proposed is
constantly increasing. The use of disparate policy languages makes
collaboration between and integration over applications and domains
difficult and requires prior negotiation and agreement between
them. These problems could be eased by the adoption of a standard
policy language. Users, however, should not be forced to conform to a
single language as that will reduce their flexibility and
autonomy. Rule Interchange Format (RIF) is a W3C recommendation that
allows the exchange of rules between rule systems. We propose creating
a policy interchange language grounded in RIF.  This policy
interchange language will allow systems to use their own policy
language while still collaborating securely with those that do not. We
plan to study several policy languages and capture their main
functionality in RIF with an aim to identifying their common
subset. Our intuition leads us to believe that a generalized form of
this common subset, expressed in RIF, will act as a policy
interlingua. eXtensible Access Control Markup Language (XACML) is an
OASIS standard language for the specification of access control
policies and has been deployed in many Web-based systems. As a first
step, we show how the semantics of XACML can be expressed in RIF. In
this paper, we present our translation between XACML and RIF that
allows XACML and non-XACML systems to collaborate while maintaining
their security policies.

\end{abstract}

\section{Introduction}

XACML~\cite{XACML3}

contributions?
\begin{itemize}
  \item 1
  \item 2
  \item 3
\end{itemize}

\section{Motivating Example}

show a use case of rule interoperability

\section{XACML}

XACML 3.0

Some features not covered: obligation, delegation, operation parameters (e.g., the \texttt{CombinedDecision} attibute in \texttt{Request})

Also not covered in the syntax: annotations, versioning, defaults, status etc.

Simplified abstract syntax of XACML 3.0\footnote{We use the W3C version of the EBNF grammar: \url{http://www.w3.org/TR/REC-xml/#sec-notation}. \emph{Terminals} are in the Italic font.}:

\begin{figure}[h]
  \centering
  \includegraphics[angle=0, width=0.9\textwidth]{fig/xacml.eps}
  \caption{XACML language model (Figure 3 in ~\cite{XACML3})}
   \label{xbrl-fig}
\end{figure}

\begin{figure}
\begin{small}
\texttt{\begin{tabular}{rll}
  PolicySet & ::= & uriId PolicyCombiningAlg Target (PolicySet|Policy)* \\
  Policy    & ::= & uriId RuleCombiningAlg Target (VariableDefinition|Rule)* \\
  RuleCombiningAlg   & ::= & "deny-overrides"| "permit-overrides" | "first-applicable" | \\
                     &     & "ordered-deny-overrides" | "ordered-permit-overrides" | \\
                     &     & "deny-unless-permit" | "permit-unless-deny" \\
  PolicyCombiningAlg & ::= & RuleCombiningAlg | "only-one-applicable" \\
  Rule      & ::= & strId Target? Condition? Effect\\
  Target    & ::= & (AnyOf)*  \notes{/* disjunction */}\\
  AnyOf     & ::= & (AllOf)+  \notes{/* conjunction */}\\
  AllOf     & ::= & (Match)+  \\
  Match     & ::= & uriId AttributeValue (AttributeDesignator|AttributeSelector)\\
  Effect    & ::= & "Permit" | "Deny"\\
  Condition & ::= & Expression \notes{/* must be a Boolean function*/}\\
\end{tabular}}
\end{small}
  \caption{Policy and Rule Structure in XACML}\label{xacml-1}
\end{figure}

More about functions, expressions and variables

\begin{figure}
\begin{small}
\texttt{\begin{tabular}{rll}
  Expression  & ::= & Apply | AttributeSelector | AttributeValue | \\
              &     & Function | VariableReference | AttributeDesignator\\
  Apply       & ::= & Function Expression? \notes{/* function call*/}\\
  AttributeSelector    & ::= & Category Path DataType MustBePresent\\
  AttributeDesignator  & ::= & Category Attribute DataType MustBePresent\\
  Function    & ::= & uriId \notes{/* e.g., integer-add and string-equal */} \\
  AttributeValue     & ::= & \emph{Literal} DataType \\
  DataType           & ::= & "string" | "boolean" | "integer" ...\\
  MustBePresent      & ::= & "true" | "false" \\
  VariableDefinition & ::= & strId Expression\\
  VariableReference  & ::= & strId\\
\end{tabular}}
\end{small}
  \caption{Expressions in XACML}\label{xacml-2}
\end{figure}


Request matching etc

\begin{figure}
\begin{small}
\texttt{\begin{tabular}{rll}
  Request       & ::= & Attributes+\\
  Attributes    & ::= & Category Content* Attribute*\\
  Attribute     & ::= & uriId AttributeValue+\\
  Category      & ::= & "subject" | "resource" | "action" | "environment" \\
  Content       & ::= & \emph{XMLLiteral}\\
  strId   & ::= & \emph{string} \\
  uriId   & ::= & \emph{uri}\\
\end{tabular}}
\end{small}
  \caption{Other schema elements in XACML}\label{xacml-3}
\end{figure}

Decision - 4 possible result of a policy evaluation: "Permit", "Deny", "Indeterminate" (unable to evaluate, e.g., due to missing attributes or), "NotApplicable" (no policy can be applied).




\section{Representing XACML Policies in RIF}

RIF-PRD~\cite{rif-prd}

\subsection{Mapping Policy and Rule Structure}

\subsection{Mapping Rules}

\subsection{Request Matching}

\subsection{Mapping Rule Combining Algorithms}

\subsection{Correctness of the Mapping}

\section{Related Work}

Other XACML semantics,  \cite{DBLP:conf/www/KolovskiHP07}

Cite "the formal semantics of XACML" by Polar - why it is not a good one for us


Argue about the generality of our approach - other languages that have a logic program translation can be mapped to RIF in the similar way

\section{Summary and Future Work}
% restate AIR contributions, naming of if, then, else, policy
% conflicts, policy defaults

\section*{Acknowledgements}

This work was carried out with funding from ??

\bibliographystyle{abbrv}
\bibliography{paper}

%\appendix
%
%\section*{Appendix: Example in XML Syntax}
%
%not in the submitted version]
%
%Example of XACML (coding the motivating example)
%
%[This is copied from XACML spec and will be replaced by the real example]
%
%\begin{lstlisting}
%<?xml version="1.0" encoding="UTF-8"?>
%<Policy
%  xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"
%  xmlns:xacml="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"
%  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
%  xmlns:xf="http://www.w3.org/2005/xpath-functions"
%  xmlns:md="http:www.med.example.com/schemas/record.xsd"
%  PolicyId="urn:oasis:names:tc:xacml:3.0:example:policyid:2"
%  Version="1.0"
%  RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:deny-overrides">
%  <PolicyDefaults>
%    <XPathVersion>http://www.w3.org/TR/1999/REC-xpath-19991116</XPathVersion>
%  </PolicyDefaults>
%  <Target/>
%  <VariableDefinition VariableId="17590035">
%    <Apply
%      FunctionId="urn:oasis:names:tc:xacml:1.0:function:date-less-or-equal">
%      <Apply
%        FunctionId="urn:oasis:names:tc:xacml:1.0:function:date-one-and-only">
%        <AttributeDesignator
%          MustBePresent="false"
%          Category="urn:oasis:names:tc:xacml:3.0:attribute-category:environment"
%          AttributeId="urn:oasis:names:tc:xacml:1.0:environment:current-date"
%          DataType="http://www.w3.org/2001/XMLSchema#date"/>
%      </Apply>
%      <Apply
%  FunctionId="urn:oasis:names:tc:xacml:1.0:function:date-add-yearMonthDuration">
%        <Apply
%          FunctionId="urn:oasis:names:tc:xacml:1.0:function:date-one-and-only">
%          <AttributeSelector
%            MustBePresent="false"
%            Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
%            RequestContextPath="md:record/md:patient/md:patientDoB/text()"
%            DataType="http://www.w3.org/2001/XMLSchema#date"/>
%        </Apply>
%        <AttributeValue
%          DataType="http://www.w3.org/2001/XMLSchema#yearMonthDuration"
%          >P16Y</AttributeValue>
%      </Apply>
%    </Apply>
%  </VariableDefinition>
%  <Rule
%    RuleId="urn:oasis:names:tc:xacml:3.0:example:ruleid:2"
%    Effect="Permit">
%    <Description>
%      A person may read any medical record in the
%      http://www.med.example.com/records.xsd namespace
%      for which he or she is the designated parent or guardian,
%      and for which the patient is under 16 years of age
%    </Description>
%    <Target>
%      <AnyOf>
%        <AllOf>
%          <Match
%            MatchId="urn:oasis:names:tc:xacml:1.0:function:anyURI-equal">
%            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#anyURI"
%              >urn:example:med:schemas:record</AttributeValue>
%            <AttributeDesignator
%              MustBePresent="false"
%             Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
%           AttributeId= "urn:oasis:names:tc:xacml:2.0:resource:target-namespace"
%             DataType="http://www.w3.org/2001/XMLSchema#anyURI"/>
%          </Match>
%          <Match
%            MatchId="urn:oasis:names:tc:xacml:3.0:function:xpath-node-match">
%            <AttributeValue
%              DataType="urn:oasis:names:tc:xacml:3.0:data-type:xpathExpression"
%       XPathCategory="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
%              >md:record</AttributeValue>
%            <AttributeDesignator
%              MustBePresent="false"
%             Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
%              AttributeId="urn:oasis:names:tc:xacml:3.0:content-selector"
%             DataType="urn:oasis:names:tc:xacml:3.0:data-type:xpathExpression"/>
%          </Match>
%        </AllOf>
%      </AnyOf>
%      <AnyOf>
%        <AllOf>
%          <Match
%            MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
%            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string"
%               >read</AttributeValue>
%            <AttributeDesignator
%              MustBePresent="false"
%              Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action"
%              AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id"
%              DataType="http://www.w3.org/2001/XMLSchema#string"/>
%          </Match>
%        </AllOf>
%      </AnyOf>
%    </Target>
%    <Condition>
%      <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
%        <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
%          <Apply
%         FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
%            <AttributeDesignator
%              MustBePresent="false"
%         Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"
%             AttributeId="urn:oasis:names:tc:xacml:3.0:example:attribute:parent-guardian-id"
%              DataType="http://www.w3.org/2001/XMLSchema#string"/>
%          </Apply>
%          <Apply
%         FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
%            <AttributeSelector
%             MustBePresent="false"
%             Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
%     RequestContextPath="md:record/md:parentGuardian/md:parentGuardianId/text()"
%              DataType="http://www.w3.org/2001/XMLSchema#string"/>
%          </Apply>
%        </Apply>
%        <VariableReference VariableId="17590035"/>
%      </Apply>
%    </Condition>
%  </Rule>
%</Policy>
%\end{lstlisting}


\end{document}
