Decidable Administrative Controls based on Security Properties

A security property is a high-level statement about what may occur (is authorized) within a system. One of the oldest such security properties is information flow confidentiality. Given a security property p, it is a desirable goal for an authorization model to be expressive for p (enabling p to be both enforced and violated in different parts of the system), robust (enabling the authorization state to change without invalidating p where it holds), and analyzable (so it can be understood where p holds). Of particular interest in analyzing an authorization model is the decidability of security properties. If the system is not analyzable, how does one know what protections are being provided? Protections can be provided at two levels: the ordinary privileges and the ability to change the system via administrative controls. Administrative controls provide a graceful means to perform the inevitable modifications to the system, that is to provide robust authorization systems. To date, existing authorization systems are known to achieve at most two of expressibility, robustness, and decidability with respect to a security property. This paper proves that a previously proposed authorization model with administrative controls is decidable with respect to information flow confidentiality, thus simultaneously achieving all three of these goals.