## 4 Access Control Policy Conflict Detection and Resolution
### Modality conflict  
When the subjects in two access control policies are the same or have an inheritance relationship, and they perform the same operation on the same resource under the same conditions, but obtain opposite authorization results, it is called a modality conflict. It can be formalized as \(sa_{1}\cap sa_{2}\
eq\emptyset\) & \(oa_{1}=sa_{2}\) & \(con_{1}=con_{2}\) & \(eff_{1}\
eq eff_{2}\). **C. Condition conflict**. When the same or inherited subjects perform the same operation on the same resource, but with different access conditions, resulting in the same authorization result, it is called a condition conflict. It can be formalized as \(sa_{1}\cap sa_{2}\
eq\emptyset\) & \(oa_{1}=sa_{2}\) & \(con_{1}\
eq con_{2}\) & \(eff_{1}=eff_{2}\). Different detection methods are applied for different conflict types. For model conflict, if the attributes item of \(pol_{1}\) satisfies both _sa.rank_!= null & _oa.rank_!= null, and \(op1\) = \"_read_\" \(\wedge\)_eff_ = \"1\" \(\wedge\)_sa.rank_ \(>\)_oa.rank_ \(\wedge\)_pol_\({}_{1}\) is the conflicted policy. For modality conflict, the detection algorithm is shown in Algorithm 1. ```
Input: Access policy set \(Po\) Output: Access policy set with modality conflict \(Pm\), access policy set passing the detection \(Po\)
```
1:begin
2:for\(v\,pi\in Po\)do
3:for\(v\,pi\in\) pick \(i\
eq j\)do
4:for\(v\,pi\in\) pick \(i\
eq j\)do
5:if same attribute value of \(pi\) and \(pi\) in \(CON\)
6:compare the next attribute value
7:else if the different value is \(eff\)then
8:added pi to Pm, and remove pi from Po
9:endfor
10:endfor
11:end ```
**Algorithm 1** Detecting modality conflict  
For condition conflict, the detection algorithm is shown in Algorithm 2. ``` Input: Access policy set \(Po\) Output: Access policy set with condition conflict \(Pc\), access policy set passing the detection \(Po\) ```
1:begin
2:for\(v\,pi\in Po\)do
3:for\(v\,pi\in\) pick \(i\
eq j\)do
4:read each attribute value of \(pi\) and \(pi\) in \(AA\) = [SA, OA  
Then, the attributes of the owner, specialness, and model are compared, so as to select the policy of obvious higher priority regardless of the content. Moreover, as for the policies of the same model, we choose the corresponding priority principle according to the characteristics of the model itself and perform deep synthesis when required based on the method proposed in Section 3. Finally, consistency judgment is conducted, to determine whether the newly synthesized policy meets the expectations of the entities involved in the policy synthesis. If not, the administrator has the right to specify the result to complete the conflict resolution. The joint priority principles of the conflict resolution are defined as follows:  
* **Owner Priority Principle**. If the priorities of the policy owners are not equal, select the policy with the higher priority of the policy owner as the result. * **Specialness Priority Principle**. A special policy refers to a policy whose subject domain and object domain are included in another one. The special policy is considered to be the resolution result of conflict resolution. * **Model Priority Principle**. Within multiple access control models, we first determine the type of access control policy based on the Equation (11). If two access control policies conform to different models, the conflict resolution of access control policy is completed according to the predetermined priority order of [MAC, DAC, UCON, TBAC, RBAC, ABAC]. \[\textit{Type }(pol)=\left\{\begin{array}{l}\textit{sap.rank}\textit{ }=\textit{null }\&\&\textit{coap.rank}\textit{  
* **High-level object priority principle. ** In the MAC model, it focuses on protecting the security of resources. The policy with a higher security level for the object is given priority in conflict resolution. * **New loading priority principle**. In the DAC model, to ensure the timeliness of authorization, select the most recently loaded access control policy as the result of conflict resolution. * **Attributes in use priority principle.