Department of Computer Science 4400 University Drive MS#4A5 Fairfax, VA 22030-4444 USA George Mason University http://cs.gmu.edu/ Technical Report Series 703-993-1530
Security Policy Cognizant Module Composition
Paul Seymer, Angelos Stavrou, Duminda Wijesekera, and Sushil Jajodia {pseymer|astavrou|dwijesek|jajodia}@gmu.edu Technical Report GMU-CS-TR-2010-1
Abstract curity and performance policies. For QoP, we show two kinds policies; viz., access to individual modules and in- Component-based software development and deploy- formation flown between them as a consequent to com- ment is based on developing individual software mod- position. For QoS, we show how to integrate local re- ules that are composed on an as needed basis. Such source control policies of individual modules and com- modules expose the computations they provide and their munication resource policies between them. Figure 1 dependencies on providing these computations - that re- shows our overall architecture. sults in a well known requires-provides specifications As an example, consider multimedia conferencing, for modules. This paper provides a framework to com- where the conference coordinator residing at one site bine modules that specify their requires-provides inter- wants to use two other conferees with differing comput- faces in a policy dependent way. Our framework specify ing and communicating resources that are subjected to policies as combinations of Constraint Logic Program- different access control and communication policies. For ming (CLP) based rules and our policies can cover mul- example, the coordinator may reside at a site that allows tiple aspects associated of compositions, such as secu- video, audio, and HAIPE encryption, where one partici- rity and quality of service. We apply our framework to pantwith a land-linemay only be allowed to use DES en- specify Quality of Protection (QoP) and Quality of Ser- cryption with audio and video capabilities and the other vice (QoP) policies. An example shows the applicability participant joining by mobile telephone may only have of our policy language to a teleconferencing application the audio stream, but no video or encryption capabilities. with multiple security and resource usage policies. Consequently, for the modules to be correctly composed, the conference should deliver both audio and video en- crypted using DES to the second participant and only an 1 Introduction audio stream to the third participant. In component-based software development, modules are The advantage of this framework are many. Firstly, it developed independently and composed on an as needed separates independent aspects of composition (e.g. QoP basis [30]. In order to facilitate such compositions (ei- and QoS) from structural composability criteria. Sec- ther statically or dynamically), the composer needs to ondly, it further provides a framework to separates dif- be aware of what each module provides as a service and ferent sub-aspects within an aspects. Thirdly, it provides what it requires in order to provide that service - result- a basis to reason about all aspects and sub-aspects uni- ing in the well known requires-provides specification of formly. Lastly, it adds policies to aspect-oriented com- modules. Making these requires-provides interfaces pol- position. icy dependentis the objectiveof this paper. In order to do The rest of the paper is written as follows. Section 2 so, we propose a Constraint Logic Programming based presents the formal language of the rule-based composi- rule language to specify the requires-provides policies. tion framework that is sufficiently expressible to accom- Our sample policies shown in this paper addresses two modate many notions of module composition mostly re- aspects of software composition; viz., Quality of Protec- flecting existing definitions. Section 3 presents the sub- tion (QoP) and Quality of Service (QoS), specifying se- language for security policies. Section 4 presents the
1 QoS QoS n. Policy E x p o r t The rest of the paper uses names starting with an upper r t E x p o x
E p
o r t case letter for variables and names starting with a lower Local Local QoS Communication QoS QoS case letter for constants, and sometimes use a name with a hat above (for example ReqM) to describe a term with
E x p o r t d Composition variables and constants, when it is too long the write out Provides Module1 Module2 Requires Requires Provides the details within a rule. We now describe the other parts of our language. E x p o r t
Global flow module(Name,Location,Req,Prov,Depth): Local Local control policy Security access control access control policy policy is a 5-ary predicate where the Name is a constant or
E x p o r t variable from Set representing a name. Similarly, E x p o r t N o r t Security E x p Policy Location is a constant or a variable from SetL, representing a location (or a set of locations). Req Figure 1: Architecture of the Policy Framework is a constant or a variable representing an ordered triple of the type SetI × SetQoP × SecQoS used to model a set with elements of the form (interface, Set of QoP and QoS options) representing the collection sub-language for QoS policies. Section 5 presents the of requires interfaces with their options and Depth semantics and models for module composition syntax. (sometimes denoted as ’Z’) is a set term used to encode Section 6 presents an example composition of a telecon- the recursive depth. Similarly, Prov is a constant or ference. Section 7 presents related work and Section 8 variable from the same type as that of Req, representing presents our conclusions. the interfaces and the options of the provides interfaces of the component. In this version where we do not use recursive compositions, we use the value of ∅ for the 2 A Rule-based Language to Spec- Depth attribute. ify Module Composition cModule(Name,Location,Req,Prov,Depth):] is a 5-ary predicate with the same type of predicates We propose using a set constraint based logic program- as the module predicate, representing a composed ming language to specify policies. The version of set module. In this version where we do not use recursive theory we use is CLP(SET ), the hereditarily finite set compositions, we use the value of ∅ for the Depth theory developed by Dovier et al. [15, 16, 17], where the attribute. hereditarily finiteness refers to the fact that all sets are composable2(Name1,Location1,Req1,Prov1, constructed out of a finite universe (of so called urele- Name2,Location2,Req2,Prov2,Depth): ments) by applying a finite collection of composition op- is an 9-ary predicate where erators. The set of operators we use are {=, 6=, ∈, 6∈, ∪3, 6 (Name1,Location1,Req1,Prov1), ∪3, k, 6k}, where ∪3 is the ternary predicate X ∪3 Y = Z, (Name2,Location2,Req2,Prov2) are the An analogous explanation applies for ∩3. Similarly X k two components, and the provides interfaces of Y holds iff X ∩ Y = ∅. Our constraints are conjunctions the second are connected to the requires interfaces and disjunctions of these constraint predicates, instanti- of the first and Depth is a set term used to en- ated with terms belonging to a chosen set of sorts. We code the recursive depth. We also use another use five sorts for Modules (N), Locations (L), Interfaces predicate composable3(Name1,Location1, (I), QoP policies (QoP )and QoS options(QoS), respec- Req1,Prov1,Name2,Location2,Req2,Prov2, tively refereed to as KerN ,KerL,KerI ,KerQoP and Name3,Location3,Req3,Prov3,Depth) that KerQoS. Each sort has its own constants and function composes three modules where the provides interfaces symbols. We use five constant symbols to denote un- of the second and the third modules are connected to the defined values ⊥N , ⊥L, ⊥I , ⊥QoP and ⊥QoS to model requires interfaces of the first. partial functions. structOK2(Name1,Location1,Req1,Prov1, In addition, we use sets created with the ∅, such as Name2,Location2,Req2,Prov2,Depth): {∅, {∅}} to model the structure of any well-founded is an 9-ary predicate where finitely branching tree. As will be seen shortly, we (Name1,Location1,Req1,Prov1), use such nested sets to limit the recursive backtracking (Name2,Location2,Req2,Prov2) belong to two through rule chains. We also use nested sets to code in- components and Depth is a set term used to encode the tegers. For example {{. . . {∅} . . .}} where the empty set recursive depth. This predicate specifies the structural ∅ is embedded in n braces is used to represent the integer compatibility requirements between the provider and the
2 requester modules. Similarly, we use a 12-ary predicate 2.2 Structural Composition Policies structOK3(Name1,Location1,Req1,Prov1, Name2,Location2,Req2,Prov2,Name3,, Structural composability can be specified using the set Location3,Req3,Prov3) to model the structural constraint language and other user defined predicates as integrity of a module composed from three sub-modules. given in the following two examples: qopOK2(Name1,Location1,Req1,Prov1, structOK2(N1,L1,Re1, P r1,N2,L2,Re2, P r2,Z) ← Name2,Location2,Req2,Prov2,Depth): cModule(N1,L1,Re1, P r1,S1), is an 9-ary predicate where each of cModule(N2,L2,Re2, P r2,S2), (Name1,Location1,Req1,Prov1) and typeOK2(N1,L1,Re1, P r1,N2,L2, Re2, P r2,Stype), (Name2,Location2,Req2,Prov2) belong to P r1 ∩ P r2= ∅,Re1 ∩ Re2= ∅,Re1 ⊆ P r2, two modules. The predicate qopOK2is used to specify S1,S2,Stype ∈ S. the security policy for module composition. Similarly, we use a 12-ary qopOK3() predicate for composing This example says that two modules N1 and N2 are three modules. structurally compassable iff they do not share any pro- vides interfaces or requires interfaces and the requires qosOK2(Name1,Location1,Req1,Prov1, interfaces of the first module N1 are providedby the sec- Name2,Location2,Req2,Prov2, Depth): is ond module N2. By adding an extra clause Re1 ⊆ P r2 an 9-ary predicate where to the last line of the policy, we can allow partial com- (Name1,Location1,Req1,Prov1), positions where we the second module N2 can provides (Name2,Location2,Req2,Prov2) are pa- more interfaces than those required by N1. Also by re- rameters belonging to two modules and Depth is versing the constraint Re1 ⊆ P r2 to Re1 ⊇ P r2, we a set term used to encode the recursive depth. The can accept partial compositions where the second mod- predicate qosOK2 is used to specify QoS policies of the ule is unable to provide all required interfaces. By doing composition. We also use a 12-ary predicate qosOK3() so, we can partially compose N1 and N2 and then com- to specify QoS preferences for three modules. pose this intermediate result with another module N3 to typeOK2(Name1,Location1,Req1,Prov1, obtain a different definition of composition showing the Name2,Location2,Req2,Prov2,Depth): flexibility of our design. The condition S1,S2,Stype ∈ S is an 9-ary predicate where all interfaces in is used to ensure the termination of queries. (Name1,Location1,Req1,Prov1) match the respective interfaces of (Name2,Location2, Req2,Prov2) in type and Depth is a set term used to encode the recursive depth. Similarly, we use a 12-ary 3 QoP Policies predicate typeOK3() to specify type compatibility of three modules. As mentioned, our sample QoP policies either control ac- cess to modules or information that flow between them. We modify Attribute-based Access Control [54] of Wang et al. for the former and FlexFlow [12] of Chen et al. for 2.1 Specifying Module Composition Poli- the latter. These policies have their own languages and cies are evaluated separately. Their evaluations are then im- ported into the module composition framework by using In this section we specify rules about module compo- two kinds of predicates. sition. Composition rules must satisfy some structural Flow Control: secureFlow2(Sub1,Role1, properties such as the requirement that one module pro- Org1,N1,L1,Req1,Prov1,Sub2,Role2, vide the interfaces needed by the other module. First, we Org2,N2,L2,Req2,Prov2,Z), say that informa- specify the structural composition rules. tion is allowed to flow between modules N1 and composable2(N1, L1,Re1,Pr1, N2, L2,Re2,Pr2, Z) ← N2 when they are composed. A similar predicate structOK2(N1, L1,Re1,Pr1, N2, L2,Re2,Pr2, Zs), secureFlow3(Sub1,Role1,Org1,N1, qopOK2(N1, L1,Re1,Pr1, N2, L2,Re2,Pr2, Zp), L1,Req1,Prov1,Sub2,Role2,Org2,N2,L2, qosOK2(N1, L1,Re1,Pr1, N2, L2,Re2,Pr2, Zq ) Req2,Prov2, Sub3,Role3,Org3,N3,L3, Zs, Zp, Zq ∈ Z. Req3,Prov3,Z) is used to exercise flow control be- This rule defines structural compatibility using tween the modules N1, N2 and N3. The last variable Z is structOK2(), security policy specified using the used to ensure that recursion terminates. predicate qopOK2() and QoS policy specified using the Access Control: do(Sub,Role,Org,Loc,Mod, predicate qosOK2(). A similar definition can be given Int,Z) says that a subject Sub playing role Role be- for composable3(). longing to organization Org at location Loc can execute
3 interfaces Int belonging to module Mod and the last Predicates in Stratum 4: Consists of two predicate variable Z is used to ensure that recursion terminates. secureFlow2(Sub1,Role1,Org1,N1,L1, Using the above two predicates exported from Req1,Prov1, Sub2,Role2,Org2,N2,L2, the global flow control policy specification mod- Req2,Prov2,Z) and secureFlow3(Sub1, ule and the two local policy specification mod- Role1,Org1,N1,L1,Req1,Prov1,Sub2, ules at locations L1 and L2 are related to Role2,Org2,N2,L2,Req2,Prov2,Sub3, qopOK2(N1,L1,Re1, P r1,N2,L2, Re2, P r2,Z) by Role3,Org3,N3,L3,Req3,Prov3,Z) that the following rule. evaluates the final decision to allow information flow. qopOK2(N1,L1,Re1, P r1,N2,L2,Re2, Pr2,Z) ← A flow controlpolicy is a finite collection of rules con- secureFlow2(Sub1,Role1,Org1,N1,L1,Re1, P r1, structed according to the following constraints: Sub2,Role2,Org2,N2,L2,Re2, P r2,Zf), Rules in Stratum 1: Rules specify basic facts such as the doL1(Sub1,Role1,Org1,L1,N1, P r1∪Re1,Z1)), roles played by modules and modules belonging to orga- doL2(Sub2,Role2,Org2,L2,N2, P r2∪Re2,Z2)), nizations etc. Hence they should have a head predicate Zf ,Z1,Z2 ∈ Z. belonging to Stratum 1 and an empty body, and there- As described, in the above rule, the requester- fore should be of the followingform, owner(s,m, ∅) ←, provider policy is considered secure if the playRole(s, r, ∅) ← and organization(s, org, ∅) ←. flow is permitted by flow control predicate Rules in Stratum 2: The head predicate must be one secureFlow2(N1,L1,Re1, P r1,N2,L2,Re2, P r2, of canFlow2(), cannotFlow2(), canFlow3() Zf ), and the two access control predicates or cannotFlow3() and the bodies may con- doL1(Sub1,Role1,Org1,L1,N1, P r1 ∪ Re1,Z1) tain predicates from stratum 1 and constraints and doL2(Sub2,Role2,Org2,L2,N2, P r2 ∪ Re2,Z2) from CLP(Set). An example rule is as follows: allow subject Sub1 to execute N1’s interfaces and cannotFlow2(Sub1,Role1,Org1,N1,L1,Req1, P rov1, subject Sub2 to execute N2’s interfaces respectively. Sub2,Role2,Org2,N2,L2,Req2, Prov2,Z) ← organization(L1, O1,Z1), 3.1 The Flow Control Sub-language organization(L2, O2,Z1), securityLevel(O1,S1,Z2), In order specify flow control policies, we add three more securityLevel(O2,S2,Z3), sorts, Sub for subjects and and Role for roles and Org S2 4 specification language. Therefore, some variables need body B may have predicates from lower strata and to be shared between the two sub-policy frameworks. constraint expressions. These are used to state basic Section 6 shows how to use the flow controlsub language facts about granting/denying access to services. in enforcing security policies for module composition. Rules in Stratum 3: Rules with cando* or cannotdo* heads can have have cando*, 3.2 The Access Control Sub-language cannotdo* predicates in their bodies only posi- tively, but may have cando and other non-reserved Discretionary access control polices that are stated in predicates and constraint terms. terms of (Subject,Object,Access-method) Rules in Stratum 4: do(X,Y,Z,W,U,V,Z) ← needs to be replaced with sextuple cando ∗ (X,Y,Z,W,U,V,Z+), ¬cannotdo ∗ (Subject,Role,Organization,Module (X,Y,Z,W,U,V,Z−), Z+,Z− ∈ Z is the only Name, Location, Interfaces) in order to rule at this stratum. specify module composition policies. We do so by using Any finite collection of rules conforming to con- the following predicates, appropriately adopted from straints (1) through (4) is said to be an access control [54]. policy. Wang et al. [54] provides a fixed point seman- Predicates in Stratum 1: Has predicates to represent tics for similar access control policies. But their use in basic facts such as ownerships, subject-role assignments, the module composition framework is limited to being object and subject hierarchies etc. an exported predicate, and therefore taken as true, iff the Predicates in Stratum 2: cando(Subject, instance is exported. Role,Organization,Module Name,Location, Interfaces,Z) and cannotdo(Subject, 4 QoS Policies Role,Organization, Module Name, Location,Interfaces,Z) state which module In QoS policies, we represent total resources require- options are permitted or prohibited from executing. ments (of a module and inter-module communication) Stated attributes represents Subjects, Roles played by as a multiset (i.e. a bag) where every resource unit of the subjects, organizations that roles and subjects belong a given type is represented by an element in the bag. to, module name and interfaces with their security and For example, if a mobile phone has 2 CPU threads QoS options. and 3 units of buffer space (say in Kilo bytes) avail- Predicates in Stratum 3: cando*(Subject, able for applications, total resources available are repre- Role,Organization,Module sented as {| cpu,cpu,buf,buf,buf |}, where the sym- Name,Location, Interfaces,Z) and bols in between the braces {| and |} are the (repeated) cannotdo*(Subject, elements of the resource bag. We decide if a module Role,Organization,Module Name, to be used has sufficient resources to execute iff its re- Location,Interfaces) are two predicates sources can be packed inside the resource bag offered used to recursively extend the definitions of cando() by the hosting platform. For example, to verify that and cannotdo(). the hardware platform of a mobile phone with resources Predicates in Stratum 4: do(Subject,Role, {| cpu,cpu,buf,buf,buf |} can accommodate an ap- Organization,Module Name,Location, plication with an estimated resource requirement (mul- Interfaces,Z) expresses the final decision about a tiset) U, we need to check if U is a (multi) subset of module being able to execute with specified options. {| cpu,cpu,buf,buf,buf |}. With this representation, Our access control policies are constructed using re- we propose a three level stratified logic programming served predicates and possibly other application specific language with multi-set constraints as follows: predicates using the following stratification: Predicates in Stratum 1: This stratum specifies service Rules in Stratum 1: Specify basic relationships dependencies. The predicate needs(S,T ) says that the and application specific facts written as predicate (subsidiary) set of services T are required to provide the instances (i.e. rules with empty bodies). Some set of (primary) services S. allNeeds(S,T ) says that examples are owner(Subject, Module, ∅) ←, the set of services T consists of all subsidiary services role(Subject, Role, ∅) ←, and required to provide the set of primary services S. organization(Subject, Org, emptyset) ←. Predicates in Stratum 2: This stratum computes Rules in Stratum 2: Rules using cando resource requirements for a given set of services with and cannotdo heads must be of the all of its QoP and QoS options. In order to express form cando(X,Y,Z,W,U,V,Z) ← B or the resources needed to communicate, two predicates cannotdo(X,Y,Z,W,U,V,Z) ← B where the comRes(N1,L1, P r1, Re1,N2,L2,Re2, P r2,R,Z) 5 and comRes ∗ (N1,L1,Re1, P r1,N2,L2, P r2,R,Z) sively define comRes*() and localRes*() using are used. The first one says that R re- positive occupancies of themselves, comRes(), sources are required to communicate between localRes() and (multi)set constraints respectively. modules N1 and N2. The second predicate Consequently, B may have any predicate from stratum comRes∗(N1,L1,Re1, P r1,N2,L2,Re2, P r2,R,Z) 1, but bodies B and D should not have comRes() and is used to recursively compute resource needs localRes() appearing negatively. allComRes() of dependent services. Finally, the predicate and allLocalRes() collect all resources needed allComRes(N1,L1,Re1, P r1,N2,L2, Pr2, to communicate between sites L1 and L2 and at site Re2,R,Z) says that the total amount of resources L1 respectively. Bodies C and E may have any available to be consumed by all software modules is R. other predicates belonging to lower strata. In the Similarly, to compute the resource needs for local following four rules, Z1,...,Zn are the set variables platforms, we use two predicate localRes(N1,L1, P r1, that occur as the last parameter in predicates used in R,Z) and localRes ∗ (N1,L1,Re1, P r1,R,Z) the bodies of the rule B,C,D and E respectively. where (N1,L1,Re1, P r1) requires resources R. comRes ∗ (N1, L1,Re1,Pr1, N2, L2,Re2,Pr2,R,Z) localRes(N1,L1, Re1, P r1, R) say that R re- ← B, Z1,...,Zn ∈ Z. sources are needed to service (N1,L1,Re1, P r1), allComRes(N1, L1,Re1,Pr1, N2, L2,Re2,Pr2,R,Z) and localRes ∗ (N1,L1, P r1, Re1,R,Z) is ← comRes ∗ (N1, L1,Re1,Pr1, N2, L2,Pr2, used in recursive rules that compute the re- Re2,R,Z),C,Z1,,...,Zn ∈ Z. sources needed to execute all dependent services. localRes ∗ (N1, L1,Re1,Pr1,R,Z) allLocalRes(N1,L1,Re1, P r1,R,Z) says that the ← D, Z1,...,Zn ∈ Z. total resources requirement to service the module allLocalRes(N1, L1,Re1,Pr1,R,Z)) ← (N1,L1,Re1, P r1,Z) is R. localRes ∗ (N1, L1,Re1,Pr1,R,Z),E,Z1,...,Zn ∈ Z. Predicates in Stratum 3: This level computes resource availability on local platforms and communication Rules in Stratum 3: Rules in this stratum may have links. In order to do so we use two predicates localLimit(L1,R,Z) or commLimit(L1,L2,R,Z) as localLimit(L1, R1) and commLimit(L1,L2, R2) heads and (set and multi-set) constraints, but their bodies which respectively says that module L1 has R1 amount may not have predicatesfrom stratum 2. They are used to of resources to execute and the total amount of resources specify resource limitations on the communication chan- required to communicate between locations L1 and L2 nels and local sites. is R2. Rules in Stratum 4: Rules at this stratum Predicates in Stratum 4: This level renders the has comResOK(N1, L1,Re1,Pr1, N2, L2,Re2,Pr2, Z) final decision to allow a module to execute on a or localResOK(N1, L1,Re1,Pr1, Z) heads and bodies host, and connectable modules to connect to each consisting of predicates from lower strata with the usual other. In order to indicate so, we use two predicates, Z1,...,Zn ∈ Z. These predicates say that QoS require- comResOK(N1,L1,Re1, P r1,N2,L2,Re2, P r2, ments are satisfied for communication and local compu- R,Z) and localResOK(N1,L1,Re1, P r1,R,Z), tations respectively. saying that with R resources, the module N1 can We use these predicates to compute the total resource execute on its proposed host and modules N1 and N2 utility of a module and to specify the policy of deciding can be connected to each other, respectively. if the modules are to be composed. For example, one Predicates listed above can be used in rules of the fol- could use an optimistic policy of composing modules if lowing kinds. they consume about 110% of the total available resources Rules in Stratum 1: Rules at this stratum are of the (such as in air-line seat reservations). Conversely, a pes- forms P (X1,...,Xn,Z) ←, needs(X,Y, ∅) ← simistic policy would not commit more than 60% of the and allNeeds(X,Y,Z) ← Body, where total available resources. More complex policies can P (X1,...,Xn,Z) is any application dependent be composed based on better resource estimates. The predicate that encodes facts. needs(X, Y ) say that predicates at Stratum 4 are related to exported QoS poli- service X depends on services Y, and consequently, in cies using a rule of the following kind, where qosOK2 order to have X, resources must also be provided for Y . or qosOK3() are defined using localResOK() and The Body of the last rule may contain application de- comResOK(). pendent predicates, depends, positive occurrences of qoSOK2(N1, L1,Re1,Pr1, N2, L2,Re2,Pr2, Z) allNeeds multiset constraints and Z1,,...,Zn ∈ Z ← localResOK(N1, L1,Re1,Pr1, Z1), where Z1,...,Zn are the set variables that occur as the localResOK(N2, L2,Re2,Pr2, Z2), last parameter in predicates used in the body of the rule. comResOK3(N1, L1,Re1,Pr1, N2, L2,Re2,Pr2, Zc), Rules in Stratum 2: Rules at this stratum recur- Z1, Z2, Zc ∈ Z. 6 ΦP(V):ΦP (V )= W is defined as: This rule says that the QoS requirements are satisfied iff the local computing requirements and communication • W (H) = T if there is a ground clause ∗ requirements are satisfied. A similar definition can be H←B1,...,Bn in P such that V (Bi) = T for given for qosOK3(). i ≤ n. • W (H) = F if for every ground clause ∗ 5 Semantics H←B1,...,Bn in P such that V (Bi) = F for some i ≤ n. This section describes models of our module composi- tion syntax and their policies. Taken as a constraint logic • W (H)= ⊥ otherwise. program, our syntax has a three valued Kripke-Kleene In evaluating Φ, negation is interpreted as ¬T = model [36, 22] where every predicate instance evaluates F, ¬F = T and ¬⊥ = ⊥. Now we define bottom-up to one of three truth values true, false or undefined. We semantic operators for both T and Φ , where Ψ stand will shortly show that every query (a request) will evalu- P P for either of them in the following. ate to either true or false, and therefore has only two truth values - ensuring that every module composition request 0 P V , where V assigns F (false) is either granted or denied. Because we allow nested • Ψ ↑ ( )= false false to all instantiated atom. negative predicates, we need to interpret negation. We can either use negation as failure or constructive negation • Ψα+1 ↑ (P ) = Ψ(Ψα ↑ (P )) for every successor [10, 11] as proposed by Fages [20, 19]. This is because ordinal α. the third alternative namely using constructive negation as proposed by Stuckey [49, 50] requires that the con- α β • Ψ ↑ (P )= Wβ<α(Ψ ↑ (P )) for every limit ordi- straint domain be admissibly closed. But Dovier shows nal α. that set constraints as we use them are not admissibly closed, and proposes an alternative formulation to handle For Horn clauses (i.e. those without negative non- nested negations [18]. Conversely, at the cost of requir- constraint predicates in the body) T (P ) has a least fixed ing some uniformity in computing negated subgoals of point, that is considered the model theoretic semantics of a computation tree, Fages’s formulation does not require P [23] that is Tω(P ). But for three-valued semantics, the constraint domain to be admissible closed [20, 19]. the least fixed point may not be obtained at ordinal ω. Formalities follow. We first repeat some standard defini- But following standard practice we take Φω(P ) as the tions as they appear in [23] in order to clarify notation. meaning (i.e. semantics) of our combined rule base (i.e. ∗ composition rules + QoP policies + QoS Policies) P as Definition 1 (P ,TP and ΦP ↑ operators) Suppose formalized in definition 2. that P is a logic program, and let P ∗ be all ground in- stances of atoms in P . We take A← as A and any ground Definition 2 (bottom-up semantics) Let P be a policy atom A not in the head of any rule as A←false. We and Φ be the three-valued immediate consequence oper- now define two and three valued truth lattices to be ator stated in definition 1. Then we say that S Φi(P) 2 = h{T, F },< i and 3 = h{T,F, ⊥},< i respec- i∈ω 2 3 is the model of P. tively, where T , F and ⊥ are taken to mean true, false and unknown truth values. Partial order- Definition 2 says that we obtain a model of P by eval- ings <2 and <3 satisfy the conditions F < T and 2 uating the Φ operator ω many times. As promised, we ⊥ < T, ⊥ < F respectively. A mapping V from 3 3 now show that S Φi(P) only takes two truth values. instantiated clauses of P to 2 and 3 is said to be i∈ω In order to do so, we consider a version of the stan- respectively a two-valued or a three-valued valuation dard operational semantics for constraint logic programs. of P . Given a valuation V , the two and three valued Thereafter by defining a rank for a formula so that the immediate consequence operators T (V ) and Φ (V ) P P rank decreases as one proceeds from the root towards the are defined as follows. leaves of a top down computation tree, we show that ev- TP(V) : T (V )= W is defined as: P ery computation terminates. The property we use here is • W (H) = T if there is a ground clause the well-foundedness of the membership predicate built ∗ into some of our predicates (namely, those that would H←B1,...,Bn in P such that V (Bi) = T for i ≤ n. interleave recursion and negation). In order to do so, we now repeat (a version of) operational semantics proposed • W (H)= F otherwise. for constraint logic programs [33, 35]. 7 Definition 3 (operational semantics) A state is a pair are well-ordered in Lemma 1 to show that any applica- (A, C) of multisets of predicates A and constraints C. tion of any of our rules reduces the rank of the rule state, Let P be an ABAC policy and (A, C) (A′, C′) are states. and therefore must terminate finitely. We say that: Lemma 1 (miscellaneous properties of ranks) Suppose h B is a derivation rule where the • (A∪{p(~s)}, C) →1 (A∪B, C ∪C”∪{~s = ~t}) is a ← one-step derivation provided p(~t)←B, C” is a rule last attribute is fully instantiated (i.e. variable in P and p(~s)←B, C” is a renamed apart instance free). Then R(h) > R(b) for any reserved of p(~s)←B, C”. predicate b in the body B. Furthermore, if (A ∪ {p(~s)}, C) →1 (A ∪ B, C ∪ C” ∪ {~s = ~t}) • We say that (A, C) fails if A 6= ∅ and there is no is a one-step derivation where p(~t)←B, C” is a rule predicate p ∈ A where p(~t)←B, C” is a rule in P. in P and p(~s)←B, C” is a named apart instance of p(~s)←B, C”. Then R(A ∪{p(~s)}) > R((A ∪ B). • We say that (A, C) is successful if (A, C) →∗ (∅, C′) for some constraint set C′ satisfiable by an Proof: assignment σ of variables to values, where →∗ is Case 1: Predicates of the Access Control Sub lan- the reflexive transitive closure of →1. guage To prove the first claim, according to policy defi- • A query (A, C) is said to flounder if it neither suc- nition, the reserved predicates are cando cando*, cessful nor fails. cannotdo, cannotdo* and do. We consider each of them now. The third clause of definition 3 usually reads as (A, C) cando, cannotdo: cando(−, −, −,..., {∅})←B ′ is said to be successful if (A, C) →∗ (∅, C ) for some where B consists of non-reserved predicates or is empty. consistent constraint set C′. But Dovier et al. shows that This is the only allowed form of cando in a rule head. in the computable set theory we use, a set of constraints Thus, R(cando(−, −, −,..., {∅})) = 1 and R(b) = 0 C′ is consistent iff it is satisfiable by some assignment for any predicate b in B. A similar argument holds for of variables to values [15, 16, 17]. Coincidentally, the cannotdo. operational semantics given by definition 3 and the fixed cando* and cannotdo*: According to the third rule point semantics given by definition 2 coincide [33, 35]. in the policy definition, if cando ∗ (−, −, −,...,Z) is in We now proceed to show that our policies do not floun- the body and cando ∗ (−, −, −,...,Z′) is in the body, der. then Z = {Z′|U} for some set U. Hence by defini- tion 4, R(cando ∗ (−, −, −,...,Z)) ≥ 1+ R(cando ∗ Definition 4 (rank) We say that the rank of a well- (−, −, −,Z′)). founded set is the maximum nesting of braces in it, for- do: The same argument applies for rules with a mally defined rank(s) to bemax{1+rank(u),rank(v)} cando ∗ (−, −,...,Z) head. The only rule with a when s is of the form {u | v} and as 0 otherwise. We say do(−, −,...,Z) head is do(X,Y, −, {Z}) ← cando ∗ that the rank of an instance of a reserved predicate is the (−, −,...,Z1), ¬cannotdo ∗ (−, −,...,Z2). Thus, rank of its last variable, and the rank of a rule instance R(do(−, −,..., {Z})) = 1+ max{R(cando ∗ is the rank of its head predicate. (−, −,...,Z1)), R(cannotdo ∗ (−, −,...,Z2))}. Suppose A is a finite multiset of predicates, and Case 2: Predicates of the Flow Control Sub Language {a1,...,an} lists elements of A in the decreasing or- This case is similar to that of Case 1, due to the simi- der of their ranks. That is, they satisfy the condition larity of the rules at the same starts. that i > j → R(ai) ≥ R(aj ), where R(aj ) is the Case 3: Predicates of the QoS Policy Sub Language rank of aj . Suppose m is the highest rank in A. That This case is similar to that of Case 1, due to the simi- is, m =max{R(a) : a ∈ A}, and let C(A, i) =| larity of the rules at the same starts. {R(aj) : R(aj ) = i} | for every i ≤ m. That is, Case 4: Predicates for Composition C(A, i) is the number of predicates with rank i. Then For predicates module, cModule, typeOK2, define R(A), the rank of the multiset A as the vector typeOK3, structOK2 and structOK3 are base (C(A, m),..., C(A, 0)). We order multiset ranks (that predicates, where the last attribute is ∅. Hence they have is (C(A, m),..., C(A, 0))) lexicographically. Rank 0, and therefore do not flounder. For the predicate composable2, the prescribed rule Definition 4 defines the ranks for reserved predicates, of usage is as follows. rules and multisets of predicates. Because the multiset composable2(N1,L1,Re1, P r1,N2,L2,Re2, P r2,Z) ← ranks are finite sequences of non-negative integers. We structOK2(N1,L1,Re1, P r1,N2,L2,Re2, P r2,Zs), use the fact that finite sequences of non-negative integers qopOK2(N1,L1,Re1, P r1,N2,L2,Re2, P r2,Zp), 8 qosOK2(N1,L1,Re1, P r1,N2,L2,Re2, P r2,Zq), 6 An Example Zs,Zp,Zq ∈ Z. Hence the rank of any instance of composable2 This section shows an example application of our frame- is max {structOK2, qopOK2, qosOK2}+1. A work to a conference call manager. As shown in the similar argument holds for composable3. schematic of Figure 6, the talking phase of the tele- Now we use the first claim to justify the second. Sup- conferencing module is constructed from three exist- manager pentagon pose that (A ∪ {p(~s)}, C) →1 (A ∪ B, C ∪ C” ∪ ing modules, a located at the , {~s = ~t}) is a one-step derivation using the ABAC rule a land phone located at ftMeade and a mobile p(~t)←B, C” is a rule in P and p(~s)←B, C” is a fresh phone located in iraq . The provides interfaces of the instance of p(~s)←B, C”. To prove that R(A∪{p(~s)}) > manager is used by the conferees and the requires in- terfaces are connected to the provides interfaces of the R(A ∪ B), suppose R(A ∪ {p(~s)}) = (km,...,k0), land phone and mobile phone modules. The re- R(P ) = t < m, and R(B) = (tu,...,t0) where quires interfaces of these modules are used by the con- u < t. Then R(A ∪ B) = (km,...,kt+1, kt − ferees at their respective sites. 1, kt,...,ki + ti,...,k0). In the lexicographical order- ing, (km,...,k0) > (km,...,kt+1, kt − 1, kt,...,ki + ti,...,k0), implying R(A ∪{p(~s)}) > R(A ∪ B). talk t o Land A , B listen m x, y f r o We now use Lemma 1 to show that composition talk Manager x, y t o queries terminate. listen C , D f r o m talk Mobile Theorem 1 (finite termination of queries) Every listen query (A, C) either fails or succeeds, where A is a reserved predicate with a fully instantiated first Figure 2: The Composed Teleconferencing Module attribute. Proof: The call manager has four interfaces: two dedicated Suppose (A, C) →1 (A0, C0) →1 (A1, C1),... is per conferee where the first interface is used to send an infinite sequence of one-step reductions. Then by multimedia streams consisting of some combination of lemma 1, R(A, C) > R(A0, C0) >... is an infinite de- audio, video and textual data and the second interface scending sequence, contradicting the well-foundedness is used to receive the same data from the other two of the rank function. This is a contradiction, as the lexi- conferees. Hence we model the conference manager cographical ordering on integers is well-founded. As as module manager, pentagon, ReqM, ProvM ( d d ) a corollary, we now obtain that any query always gives a where ReqM is {(toLand,A,B),(fromLand,A,B), yes or no answer, implying that following theorem which d (toMobile,C,D),(fromMobile,C,D)} and ProvM is says that all three valued models have only two truth val- d {(talkM,X,Y),(listenM,X,Y)}. The manager module ues true and false. is specified using the following rule: cModule3(manager, L, {(toLand,A,B), Corollary 1 (three valued model has two truth values) (fromLand,A,B), (toMobile,C,D), {fomMobile, Every three valued model of a composition policy as- C,D}, {(talkM,X,Y ), (listenM,X,Y )}, ∅) signs either T or F for reserved predicates where the ←{des}⊆ X ⊆{des, 3des, aes}, first attribute is instantiated. In that case, bottom-up {audio}⊆ Y ⊆{audio, video, text}, semantics and the well-founded constructions assigns {3des}⊆ A ⊆{des, 3des, aes}, the same truth values to the same predicate instances {des}⊆ C{des, 3des, aes}, {audio, text}⊆ B, and have the same answer sets. D ⊆{audio, video, text},X = A ∪ C, Y = B ∪ D. The head predicate cModule3() of the above rule Proof: See [7]. says that the module manager, located at L, has two Corollary 1 show that every composition request is ei- provides interfaces talkM and listenM, has shared ther honored or rejected. But notice that our model is not security and QoS parameter sets X and Y . The a fixed point of the Φ operator , as it is well known that head predicate also says that this module has four re- the least fixed point of the Φ operator is not ω - mean- quires interfaces: toLand, fromLand, toMobile ing that the fixed point of Φ is not attained in a countable and fromMobile, where the first two are to be con- number of iteration. Φ [24, 19]. ([24] gives a simple nected to a land line with respective QoP and QoS pa- counter example) rameter sets A and B. The latter two interfaces can be 9 connected to a mobile phone with QoP and QoS pa- configurable subjected to the constraints {des} ⊆ rameter sets C and D. The design constraints of the C ⊆ {des, 3des, aes} and {audio} ⊆ D ⊆ manager module appears in the body of the rule, and {audio, video, text} in the second and third lines of the are as follows: The QoS parameters of the provides in- rule. Now we specify the composition. terfaces talkM and listenM must be the same (be- cModule2(telecon, pentagon, ReT con, P rT Con, Z) d d cause they are given as (talkM,X,Y) and (listenM,X,Y)) ← composable3((manager,pentagon, ReqM, P rovM), d d and contain des and is contained in des,3des,aes, (land, ftMeade, ReqLand, P rovLand), d d specified as {des}⊆ X ⊆{des, 3des, aes} in the fourth (mobile, iraq, ReqMobile, ProvMobile), ∅), d d line of the rule. Similarly, QoS parameters must con- P rT con = PrM, ReT Con = ReqLand ∪ ReqMobile d d d d d tain audio and must be chosen from audio, video Above rule with a cModule2() head says that location and text, stated in the sixth line as {audio} ⊆ Y ⊆ pentagon requires a module telecon that provides {audio, video, text}. Similarly, the land line must pro- PrTcon and requires capabilities ReTcon. The right d d vide at least 3des encryption and could include des or hand side of the rule says that the telecon module that aes, as stated in the seventh line as {3des} ⊆ A ⊆ is constructed from three modules manager, land {des, 3des, aes}. Similarly, the land line must provide at and mobile, located at the pentagon, ftMeade and least audio and text and may include video, stated iraq respectively. The required and provided interfaces as {audio, text}⊆ B, E ⊆{audio, video, text} in the of the composed module telecon can now be con- eighth line. The last line of the rule, X = A ∪ C, Y = structed from the last two lines of the rule above as fol- B ∪ D says that the provides interface of the manager lows: module must match all the security and QoS options available to its requires interfaces. P rT con = P rovM The Land Conferee’s module is modled as d d module(land,ftMeade,ReqLand,ProvLand, ∅) = {(talkM,X,Y ), (listenM,X,Y )}, where ReqLand is (talkLand,A,B), listenLand,A,B ) ReT con = ReqLand ∪ ReqMobile d { { } d d d and ProvLand is (toLand,A,B),(fromLand,A,B) = {(talkLand, A, B), (listenLand, A, B), d { } defined using the following rule. (talkMobile,C,D), (listenMobile, C, D)}) module(land, L, {(talkLand, A, B), (listenLand, A, B)} {(toLand, A, B), (fromLand, A, B}, ∅← {des} ⊆ A ⊆ {des, 3des, aes}, {audio} ⊆ B ⊆ Subjected to the following constraints: {audio, video, text} {des} ⊆ X,A,C ⊆ {des, 3des, aes} The rule above shows that the land conference mod- {audio} ⊆ Y,B,D ⊆ {audio, video, text} ule, located at L, consists of two provides interfaces X A C toLand and fromLand and two requires interfaces = ∪ talkLand and listenLand. As the rule says, the Y = B ∪ D security and QoS parameters, respectively given by set variables A and B are configurable subjected to the con- We now explain how the composition is written. straints {des} ⊆ C ⊆ {des, 3des, aes} and {audio} ⊆ Firstly, PrM says that the composed module name D ⊆ {audio, video, text} in the second and third lines d telecon at the pentagon must provide the capabil- of the rule. ities listed in PrTcon, requiring capabilities ReTcon. The Mobile Conferee’s module is modeled as d d Notice that PrM is a set with two ordered triples module(mobile, iraq, ReqMobile, P rovMobile, ∅) d d d (talkM,X,Y ) and (listenM,X,Y ), which says that it where ProvMobile is {(toMobile,C,D), (fromMo- d may provide the ability to translate audio with pos- bile,C,D) and ReqMobile is (talkMobile,C,D), } d { sibly more QoS capabilities than audio and possi- (listenMobile,C,D)} defined using the following rule. bly more QoP capabilities than des. The specifica- module(mobile, L, {(toMobile, C, D), (fromMobile, tion says that the conference manager’s site must have C, D)}{(talkMobile, C,D), (listenMobile, C, D)}, ∅) ← all QoP and QoS related services available for all mo- {des} ⊆ C ⊆ {des, 3des, aes}{audio} ⊆ D ⊆ bile and land phone conferees. Notice that the secu- {audio, text}. rity and QoS capabilities are specified using set vari- Above rule says that the mobile component ables, such as X, Y etc., that may be instantiated by the at location L consists of two provides interfaces caller of the rule, and resolved by the constraint solver toMobile and fromMobile and two requires in- CLP(Set) during the composition process. Notice also terfaces talkMobile and listenMobile, with that composable3() is specified using the structural QoP and QoS given by set variables C and D are rule struct3() as defined in Section 2.2. 10 We nowshowtheQoP andQoS policies. Inordertodo expose location specific information inadvertently. We now so, we specify global cross-domain flow control policies specify the access control polices at the mobile phone, and that apply to the communication links spanning across omit others for the sake of brevity. all three sites and access control policies that regulate the accesses to the resources at each site. The facts about candomobile(S,R,Org,mobile,L, {(talkMobile,A,B), the modules, their users and the roles played by these (listenMobile, C, D)}, Z) ← owner(S, mobile, ∅), ∅ ∈ Z. users are stored at different locations as stated in Ta- candomobile(S,R,Org,mobile,L, {(toMobile, A, B), ble 1. The table has site specific information for the four (fromMobile,C,D)}, Z) ← des ∈ C,des ∈ A, sites: the conference manager’s site pentagon, the role(S,R, ∅), owner(mobile, S, ∅), land phone’s site ftMeade and the mobile phone’s R ∈ {recon, commander}, site iraq. The square at the right hand bottom corner of L 6∈ {china, Afghanistan}, ∅ ∈ Z. Table 1 stores information about the teleconference mod- ule. There, we have stored multiple owners, a new role cannotdomobile(S,R,Org,mobile,L, {(toMobile, A, B), name teleconferencing and a non-physical loca- (fromMobile,C,D)}, ∅) ← video ∈ B ∪ D, tion global. L ∈ {china, Afghanistan}. We now state the flow control policies. The first rule cando ∗mobile (S,R,Org,mobile,L,Pr,Re,Z) ← places some constraints on information that can flow candomobile(S,R,Org,mobile,L,Pr,Re,Z1) from the two modules land (telephone) and mobile Z1 ∈ Z. (telephone) to the (teleconference) manager module simultaneously. They are (1) the manager’s organization cannotdo ∗mobile (S,R,Org,mobile,L,Pr,Re,Z) ← must be either the pentagon or jtChiefs, (2) the cannotdomobile(S,R,Org,mobileL,Pr,Re, ∅), other two modules belongs either of usArmy, usNavy ∅ ∈ Z. or the usAF, the manager of the teleconference must play the roles of a commOfficer (communications domobile(S,R,Org,mobile,L,Pr,Re,Z) ← officer) or a commander. It further stipulates that cando ∗mobile (S,R,Org,mobile,L,Pr,Re,Z+), the users of other modules must play the roles of ¬cannotdo ∗mobile (S,R,Org,mobile,L,Pr,Re,Z−) commOfficer, recon (reconnaissance) or signal Z+, Z− ∈ Z. (officer) and prohibits the mobile module being The access control policy at the mobile module says that located in china. the owner of that device may talk and listen to the device canF low3(Sub1, Role1,Org1,manager,L1,Req1,, in the first rule. The second rule says that the device may manager P rov1,Sub2, Role2,Org2,land,L2,Req2, P rov2, connect to a teleconference through two interfaces toMobile fromMobile Sub3, Role3,Org3, mobile, L3,Req3, P rov3, ∅) and provided that both streams are des ← Org1 ∈ {pentagon,jtChiefs},Org2,Org3 ∈ able to use encryption, the owner of the mobile device {usArmy,usNavy, usAF }, L2 6= china, is using it in playing the role of a reconnaissance officer or a china Role1 ∈ {commOfficer, commander}, commander, and the device is not being operated from Afghanistan Role2,Role3 ∈ {commOficer, recon, signal}. or . The third rule of the policy explicitly pro- hibits using video from china or Afghanistan. Fourth and fifth rules are there to resolve authorization conflicts and canF low Sub , Role ,Org , N , L ,Req , P rov , 3 ∗ ( 1 1 1 1 1 1 1 to ensure that every request is answered affirmatively or nega- Sub , Role ,Org , N , L ,Req , P rov ,Sub , Role , 2 2 2 2 2 2 2 3 3 tively (i.e. no queries flounder). Similarly, the other two mod- Org N , L ,Req , P rov , Z 3 3 3 3 3 ) ← ules manager and land telephone can have their own access canF low Sub , Role ,Org , N , L ,Req , P rov , 3( 1 1 1 1 1 1 1 control policies. Sub2, Role2,Org2, N2, L2,Req2, P rov2,Sub3, Role3, Following the stratification stated in Section 4, we first state Org3, N3, L3,Req3, P rov3, Z1), Z1 ∈ Z service dependencies as rules. They are stated in Table 2 for safeFlow3(Sub1, Role1,Org1, N1, L1,Req1, P rov1, any site that has a (mobile or land line) telephone. As stated Sub2, Role2,Org2, N2, L2,Req2, P rov2, in the table, audio and video individually require cpuau, cpuv Sub3, Role3,Org3N3, L3,Req3, P rov3, Z) ← units of CPU resources and bufau, bufv units of buffer space canF low3(Sub1, Role1,Org1, N1, L1,Req1, P rov1, in order to maintain the continuity of the media streams. But Sub2, Role2,Org2, N2, L2,Req2, P rov2, if audio and video are present together, they need an ex- Sub3, Role3,Org3, N3, L3,Req3, P rov3, Z1), Z1 ∈ Z tra cpulip amount of CPU and 2.(bufau + bufv) buffer (for The last two rules are required to complete the policy double-buffering) in order to maintain lip-synchronization at specification, where canFlow3*() allows canFlow3() to any local site (not for communication). Consequently, the rules be defined recursively and safeFlow3() defines the final of strata 1 and 2 are as follows: decision after any potential conflict resolution about flows. needs({audio, video}, {lipSync}, ∅) ← The important issue here is that safeFlow3() and all the needs(X,X,, ∅) ← predicates used to define safeFlow3() must be globally needs ∗ (X,Y,Z) ← needs(X,Y,Z1). available, including the geographical locations, users and the needs ∗ (X,Y ∪ Z, Z1) ← needs ∗ (X,Z,Z2), needs ∗ roles of the participants of the teleconference, which may (Z,Y,Z3), Z1, Z2 ∈ Z3. 11 At the Manager’s site: Pentagon At the Land Phone’s site: Ft. Mead owner(cptJones, land, ∅) ← owner(ltCook, manager, ∅) ← playRole(cptJones, signal, ∅) ← playRole(ltCook, commOfficer, ∅) ← organization(cptJones, usNavy, ∅) ← organization(ltCook, pentagon, ∅) ← At the Mobile Phone’s Site: Iraq At the Teleconference’s “site”- to be determined owner(sgtJane, mobile, ∅) ← owner({ltCook, cptJones, sgtJane}, telecon, ∅) ← playRole(sgtJane, reconn, ∅) ← playRole(participants, {conferencing}, ∅) ← organization(sgtJane, usArmy, ∅) ← organization(participants, global, ∅) ← Table 1: Facts Stored in Local Access Control Policy Bases Service Needed Services Resource Requirements Multi-Set Representation audio auContinuity cpua, bufa {| cpua,bufa |} video vContinutiy cpuv,bufv {| cpuv,bufv |} text cput,buft {| cput,buft |} {audio,video} lipSync cpulip, 2.(bufau + bufv) {| cpulip,cpua,cpua,bufa,bufa, cpuv,bufv,cpuv,bufv, |} Table 2: Service Dependencies of the Teleconferencing Application at Local sites allNeeds(X,Y,Z) ← needs ∗ (X,Y,Z1), Z1 ∈ Z. localResOK(N1, L1,Re1,Pr1,Res,Z) ← allLocalRes(N1, L1,Re1,Pr1,Res,Z1), The first rule state that {audio,video} needs localLimit(L1, MaxRes, ∅), {lipSync}. The next two rules say that needs* is Res ⊑ MaxRes, ∅, Z1 ∈ Z. the transitive closure of needs, and the last rule collects all The simple rule above says that if the CPU and Buffer space dependencies of X. The given set of rules imply the conclusion is below that of the maximum available at the local site L1, allNeeds({audio,video},{audio,video,lipSync}).then the local QoS policy permits the module to be invoked. We now state the rules for computing all resources required at a local site. localRes2 ∗ (N1, L1, {( , , {X | C}) | B},Re1,Res, 7 Related Work Z) ← allNeeds(X,Y,Z1), resourceMap(Y,Res, ∅), localRes2 ∗ (N1, L1, {( , ,C) | B},Re1,Res,Z2). The subject matter addressed in this paper, gluing software localRes2 ∗ (N1, L1, {( , , ∅) | B},Re1,Res) modules to construct new modules and applications is an area ← localRes ∗ (N1, L1,B,Re1,Res,Z3) that has received much attention in the last two decades. It Z1, Z2, Z3∅ ∈ Z. falls within the areas of component-based software engineer- allLocalRes(N1, L1,Re1,Pr1,Res,Z) ← ing [30], architecture description languages [13] and to some localRes ∗ (N1, L1,Re1,Pr1,Res,Z1), Z1 ∈ Z. extent, aspect-oriented software design [21]. It belongs in the Two rules above show that the CPU and buffer require- latter because of our concentration in the aspects of QoP and ments for resources {( , {X|C}|B} in the provides inter- QoS. face is recursively computed using the resources required to The comprehensive survey [13] summarizes the most promi- offer all the services needed for executing X and adding nent architecture description languages (ADLs). According them to the buffer requirement of {( , ,C), B}. The to [13], there are about five main ADLs, Rapide [37], Uni- required resource lookup table is given by the predicate Con [1], ArTek [29], Wright [3], Meta-H [53] and Darwin [40], resourceMap(services,resources). Similar recursive rules of which we review and compare with some. More recently, an can be written for the requires interface and added to the XML-based ADL has been introduced by Dashofy et al. [14]. total resources required for the provides interfaces. The Broy et al. [9] also addresses the central question of what char- last rule computes all the required resources in the predicate acterizes a software component? The authors argue that a allLocalRes(). We now model the resource allocation component should (1) encapsulate data (hence hides informa- policy for the communication part of the teleconference as fol- tion representation and computational algorithms), (2) imple- lows: mentable in most programming languages, (3) can be hierar- 12 chically nested, (4) has clearly defined interfaces and (5) can ing, assigning modules to module variables, freezing values of be incorporated in a framework. The framework we propose variables etc. The authors show that the (module composition) have all these properties. terms in their module calculus has a normal form. In an anal- Beugnard et al. [8] have identified the following four levels ogous attempt Lumpe [38] describes λ-forms, a λ-calculus for of contracts that can be specified in components and their inter- forms with form variables, bindings of modules to module vari- connections: (1) Syntactic contracts to specify data type com- ables, extensions and restrictions of modules, de-refencing and patibility, (2) Behavioral contracts to specify pre-conditions, assigning context for modules. Although this work addresses post-conditions and invariants, (3) Synchronization contracts the syntactic contacts in the sense described by Beaugnard et to specify dependency constraints between information ex- al. [8], they also have a normal form for λ-forms expressions. changed within a concurrent context and (4) Quality of Service Goguen et al. [28] also develops an Intuitions [27] based calcu- contracts to specify quantitative properties like maximum re- lus for module composition. Formulated using Category The- sponse time etc. Our paper extends this list by adding a fifth ory [39], they use aggregation, re-naming, enrichment (i.e. add level of security and separate policy from design by having a functionality to a module) information hiding, and parametriza- modular design framework that taken multiple policies, as im- tion of modules as operators. plied by the plethora of emerging policy research [48, 52]. Two papers, Gensler et al. [26] and Kim et al. [34] de- One of the most cited publications in the area of mod- scribe rule-based formulations of module compositions. [26] ule composition is Allen and Garlands’s A Formal Basis for describes a module with respect to its input and output param- Architectural Connection [4] provides an operational seman- eters, public interfaces and mandatory properties. The modeler tics for the Wright architecture description language. They then expresses these properties using custom-made predicates, say [4] [3] that two modules connecting to each other must ex- and specifies Prolog rules to make inferences about properties press a role and a port for that purpose. Informally, the role of modules. But these rules do not provide a general framework describes the purpose of the connection and exposes its inter- to specify policies on propositionally, QoS and security. [34] face name so that it can be used by the port which formally describes roles and rules about modules in an adaptable com- specify the allowable interactions. They are connected using puting model, inspired by software engineering concerns. The a connection that specify the interaction protocol. The ports rules sets they have described covers business concerns such as and roles are formalized using Communicating Sequential Pro- subscriptions, contracts and sales of customer bases etc. Al- cesses (CSP) [31]. The consistency of the specification of two though we were inspired by these attempts, we recognized the connecting ports with that of their end connectors is addressed need to expand upon their work to develop a comprehensive as a refinement problem in the failure divergence model of CSP rule-based framework that specifies policies for module com- and is checkable by the FDR tool [25]. position, QoP and QoS. To the extent we know, two other publications have elabo- JBCDL [44] introduces the Jade Bird Component Descrip- rated in the behavioral specification of ports and their connec- tion Language, that is a part of a component description lan- tions. The first is the ADL Darwin [40] where port behaviors guage developed for the Jade Bird Component Library that al- are specified using π-Calculus [41, 45]. The advantage of this lows hierarchical composition of classes of libraries. This sys- work over [4] is its ability to reason about making connections tem provides templates to describe software modules consisting to mobile modules. of parameters, provided and required functions, connections, Moschoyiannis [42] has formalized component composition class members, their implementation code and code dependen- using a set-theoretic framework where the (requires and pro- cies. Although implementable, this work does not explicitly vides) interfaces are given as a collection of methods and the cover QoS and security either. Secondly, parameterized tem- synchronous interactions between the two parties are specified plates made for software modules are difficult to use to express as an abstract partial ordering. The consistency of a connection compositional policies. between two interfaces is verified by checking the consistency [32] makes the important observation that exceptions could of the partial orders expressed by the two interfaces. In a pre- arise (due to faults) when linked software modules are executed vious work, Shields et al. [46] formalized port behaviors as au- and proposes to specify exception handlers (using an appropri- tomatons. Consequently, the former becomes a more abstract ate fault model) to address them during the design phase. We versions of the latter. Moschoyiannis [42] continues to advance extend this suggestion to incorporate security policies to handle set theory and automata based formulation of module composi- misuses that may arise due to mal-acts (using some mal-actor tion. Our rule-based formulation of module composition using model). computable set constraints [15, 16, 17] policies were inspired Templeton and Levitt [51] proposes an abstract syntax to by his set-based formalizations. specify attacks using a requires-provides syntax. This work There have also been attempts to use λ-calculus [6] based has inspired other work that specify security vulnerabilities us- formulations of module composition. Anancona and Zucca [5] ing pre-conditions and post-conditions. Sidiroglou et al. [47] have developed the calculus for module systems (CMS) by proposes to construct mediated overlay networks as a compass- mixing λ-calculus and the object calculus of Abadi and able service. They argue that many security vulnerabilities can Cardelli [2]. In this calculus, a module is chracterized by the be avoided by using the appropriate security services. Further- values it imports (like requires), exports (like provides) and has more Makio [43] proposes a requires-provides based language as internal variables. Although the definition of module linking to specify negotiation structures that can model complex mar- is somewhat similar to that of [42], this work defines more op- ket place negotiations. Their models specify synchronization erators on modules: taking the sum, reducing modules, renam- details of the ports to specify acceptable business negotiation 13 strategies. [11] David Chan. An extension of constructive negation and its application in coroutining. In E. Lusk and R. Over- beek, editors, Proc. North-American Conference on Logic 8 Conclusions Programming, pages 477–489. The MIT Press, 1989. [12] Shiping Chen, Duminda Wijesekera, and Sushil Jajodia. We have constructed a CLP(Set) based policy language that is Flexflow: A flexible flow control policy specification capable of specifying module composition based on their ex- framework. In DBSec, pages 358–371, 2003. posed requires-provides interfaces. As shown, our language is able to specify and enforce policies related to multiple aspects [13] Paul Clements. A survey of architecture description lan- of the composition. We have shown how QoP and QoS can be guage. In Eighth International Workshop on Software used as sample aspects, and a modular way to decompose and Specification and Design, pages 16–28, 1996. specify policies that govern the composition into sub-aspects [14] Eric M. Dashofy, Andre van der Hoek, and Richard Tay- within an aspect. Towards this end, we have shown how access lor. A highly-extensioble, xml-based architecture descrip- and flow control policies can be specified as sub components of tion language. In Proceedings of the IEEE/IFIP Work- security policies. ing Conference on Software Architecture, pages 103–112, We have also provided an operational semantics for the en- 2001. tire policy language and shown that our policies are flounder- [15] Agostino Dovier, Carla Piazza, Enrico Pontelli, and Gi- free. That is the rule execution engine will always return an yes anfranco Rossi. Sets and constraint logic programming. and no response to every composition request. ACM Transactions of Programming Languages and Sys- tems, 22(5):861–931, 2000. [16] Agostino Dovier, Carla Piazza, and Gianfranco Rossi. A References uniform approach to constraint-solving for lists, multi- sets, compact lists, and sets. Technical Report Quaderno [1] The UniCon Architecture Description Language. 235, Department of Mathematics, University of Parma, [2] Martin Abadi and Luca Cardelli. A Theory of Ob- Italy, 2000. jects. Monographs in Computer Science, Springer- [17] Agostino Dovier, Alberto Policriti, and Gianfranco Rossi. Verlag, 1996. A uniform axiomatic view of lists, multisets, and sets, and [3] Robert Allen and David Garlan. Beyond definition/use: the relevant unification algorithms. Fundamenta Infor- Architectural interconnection. In Proceedings of the maticae, 36(2/3):201–235, 1998. Workshop on Interface Definition Languages, Portland, [18] Agostino Dovier, Enrico Pontelli, and Gianfranco Rossi. Oregon, 1994. Constructive negation and constraint logic programming [4] Robert Allen and David Garlan. A formal basis for ar- with sets. New Generation Comput, 19(3):209–256, May chitectural connection. ACM Transactions on Software 2001. Engineering and Methodology, 6(3):213–249, July 1997. [19] Francois Fages. Constructive negation by pruning. Jour- [5] Davide Anancona and Elena Zucca. A calculus of module nal of Logic Programming, 32(2):85–118, 1997. systems. Journal of Functional Programming, 12(2):91– [20] Francois Fages and Roberta Gori. A hierarchy of seman- 132, 2002. tics for normal constraint logic programs. In Algebraic [6] Henk P. Barendrecht. The Lambda Calculus – Its Syntax and Logic Programming, pages 77–91, 1996. and Semantics. North-Holland, rev. edn, 1984. [21] Robert E. Filman, Tzilla Elrad, Siobhan Clark, and [7] Steve Barker and Peter J. Stuckey. Flexible access control Mehmet Aksit. Aspect-oriented Software Development. policy specification with constraint logic programming. Addison-Wesley, 2005. ACM Transactions on Information and System Security, [22] Melvin C. Fitting. A kripke-kleene semantics for logic 2004. to appear. programs. Journal of Logic Programming, 2(4):295–312, 1985. [8] Antoine Beaugnard, Jean-Marc Jezequel, Noel Plouzeau, and Damian Watkins. Making components contract [23] Melvin C. Fitting. Fixedpoint semantics for logic pro- aware. IEEE Computer, 32(7):38–45, 1999. gramming. Theoretical Computer Science, 278:25–31, 2002. [9] Mansfred Broy, Anton Dieme, Jurgen Henn, Kai Koskimies, Frantisek Plasil, Gustav Pomberger, Wolf- [24] Melvin C. Fitting and Marion Ben-Jacob. Stratified, weak gang Pree, Michael Stal, and Clemnts Szyperski. What stratified, and three-valued semantics. Fundamenta In- characterizes a (software) component. Software-Concepts formaticae, Special issue on LOGIC PROGRAMMING, and Tools, 19:49–56, 1998. 13(1):19–33, March 1990. [10] David Chan. Constructive negation based on the com- [25] FormalSystems. The FDR Tool. available at pleted databases. In R. A. Kowalski and K. A. Bowen, ed- http://www.fsel.com/fdr2 download.html. itors, Proc. International Conference on Logic Program- [26] Thomas Gensler and Christian Zeidler. Rule-driven com- ming (ICLP), pages 111–125. The MIT Press, 1988. ponent composition for embedded systems. 14 [27] Joseph Goguen and Rodney Burstall. Intuitions: Abstract [44] Wu Qiong, Chang Jichuan, Mei Hong, and Yang Fuqing. model for specification and programming. Journal of the Jbcdl: An object-oriented component description lan- Association of Computing Machinery, 39(1):95–146, jan- guage. In TOOLS ’97: Proceedings of the Technology of uary 1992. Object-Oriented Languages and Systems-Tools - 24, page [28] Joseph Goguen and Grigoe Rosu. Composition of Mod- 198, Washington, DC, USA, 1997. IEEE Computer Soci- ules with Hidden Information over Inclusive Institutions, ety. volume LNCS 2635, chapter 11. Springer-Verlag, 2004. [45] David Sangiorgi and David Walker. The π-Calculus: A [29] Terry Hays-Roth and Ross Klein. Abstractions for soft- Theory of Mobile Processes. Cambridge University Press, 2001. ware architectures and tools to support them. Carnegie Mellon University, 1994. [46] Michael W. Shields and Sotris Moschoyiannis. An au- tomata theoretic view of software components. Techni- [30] George T. Heineman and William T. Councill. cal Report SCOMP-TC-02-04, Department of Comput- Component-based Software Engineering: Putting ing, University of Surrey, 2004. the Pieces Together. Addison-Wesley professional, 2001. [47] Stelios Sidiroglou, Angelos Stavrou, and Angelos D. [31] C. A. R. Hoare. Communicating Sequential Processes. Keromytis. Network security as a composable service. Prentice-Hall International Series in Computer Science, In Proceedings of the IEEE Sarnoff Symposium., January 1985. 2007. [32] Viliam Holub. Enhancing behavior protocols with excep- [48] John Strassner. Policy-Based Network Management. tions. Morgan Kaufmann, 2004. [33] Joxann Jaffar and Jean-Louise Lassez. Constraint logic [49] Peter J. Stuckey. Constructive negation for constraint programming. Proceedings of Principles of of Program- logic programming. In Logic in Computer Science, pages ming Languages, pages 111–119, 1987. 328–339, 1991. [34] Jeong Ah Kim, JinYoung Taek, and SunMyung Hwang. [50] Peter J. Stuckey. Negation and constraint logic pro- Rule-based component development. In SERA ’05: Pro- gramming. Information and Computation, 118(1):12–33, ceedings of the Third ACIS Int’l Conference on Software 1995. Engineering Research, Management and Applications, pages 70–74, Washington, DC, USA, 2005. IEEE Com- [51] Steven Templeton and Karl Levitt. A requires/provides puter Society. model for computer attacks. In Proceedings of the 2000 New Security Paradigms Workshop, pages 31–38, 2000. [35] Dexter C. Kozen. Set constraints and logic programming. Information and Computation, 142:2–25, 1998. Article [52] Dinesh Verma. Architecture and Algorithms. New Riders, No IC972694. 2000. [36] Kenneth J. Kunen. Negation in logic programming. [53] S. Vestal. Mode changes ina real-time architecture de- Journal of Logic Programming, 4(4):298–308, December scription language. In Proceedings of the International 1987. Workshop on Configurable Distributed Systems. Honey- well Technology Center and University of Maryland. [37] David Luckham, John J. Kenney, Larry M. Augustine, James Vera, Dough Bryan, and Walter Mann. Specifi- [54] Lingyu Wang, Duminda Wijesekera, and Sushil Jajodia. cation and analysis of system architecture using Rapide. A logic-based framework for attribute based access con- Technical report, Stanford University, 1993. trol. In FMSE, pages 45–55, 2004. [38] Markus Lumpe. A Lmabda Calculus with Forms, volume LNCS 3628, chapter 11, pages 83–98. Springer-Verlag, 2005. [39] Saunders MacLane. Categories for a Working Mathe- matician. Springer-Verlag, 1998. [40] Richard Magee, Narankar Dulay, Susan Eisenbach, and Jeffery Kramer. Specifying distributed software architec- ture. In Proceedings of the Fifth Europeon Software En- gineering Conference ESEC’95, 1995. [41] Robin Milner. Communicating and Mobile Systems: the π-calculus. Cambridge University Press, 2001. [42] Sotris Moschoiannis and Michael Shields. A set-theoretic framework for component composition. Fundamenta In- formaticae, 59:373–396, 2004. [43] Juho Mki and Ilka Weber. Component-based specification and composition of market structures. 15