How to Prevent Conflicts Between Security Obligations in Access Systems?

The new NGAC (Next‑Generation Access Control) standards enable workflows where permissions evolve in real time. Yet, defining administrative obligations for these changes is tricky: a tiny mistake can jeopardize the whole authorization state. To tackle this, researchers translated NGAC policies into logical formulas handled by SMT (Satisfiability Modulo Theories). The main challenge is turning procedural obligations—often composed of multiple actions—into declarative expressions without causing interference. The team analyzed every possible conflict among obligation actions and encoded them as SMT formulas. Using the cvc5 solver, they tested the approach on real systems, showing that dynamic access requirements can be verified correctly. In practice, this provides a safer, automated way to ensure security rules don’t cancel each other out, lowering vulnerability risks in systems handling sensitive data.

NGAC policies are built on a three‑level model: users, objects, and attributes, with rules that define who can do what. Administrative obligations are operations that must occur in response to events, such as assigning a role when a user completes training. Translating these obligations into SMT requires formalizing predicates that represent the current state (e.g., "user X has attribute Y") and the transitions induced by actions ("assign role Z"). Conflict arises when two actions within the same obligation modify the same attribute in incompatible ways, creating nondeterminism. To detect such interference, a dependency graph between actions was constructed, identifying cycles and contradictory dependencies. Each conflict is then expressed as an unsatisfiable clause (unsat core) in cvc5, signaling that the obligation is inconsistent. cvc5's support for combined theories (sets, relations, arithmetic) is essential for modeling attributes and permissions. Moreover, the solver provides a counterexample model when a formula is unsatisfiable, allowing administrators to pinpoint exactly which action combination causes the inconsistency. This approach automates verification of complex policies, reducing manual effort and enhancing the robustness of access‑control systems in dynamic environments like cloud, IoT, and critical infrastructures.