Abstract: Conflict detection and resolution are the two main research directions on consistency of security policy. Existing consistency detection methods take a high time complexity and are lack of flexibility and expansibility. Changing policy conditions and priority-based conflict resolution may generate new conflicts, and assignments of policy priority are within subjective factors and difficult to implement. Based on the above consideration, this paper formalizes and analyzes policy and policy conflict by logic, and proposes a polynomial time algorithm for consistency detection based on logic unify concept. Then it classifies the policy conflicts into inclusive conflict, intersectant conflict and complementary conflict, proposes an automatic solution for inclusive and intersectant conflicts, and demonstrates the feasibility and completeness of the method. Furthermore, it uses the mechanism and theory of debate to analyze the semantic of policy conflict which provides a theoretical basis for priority-based solution, proposes a consistency policy subset computational algorithm and analyzes its complexity.

Key words: security policy, consistency, logic, argument

摘要： 冲突检测和冲突消解是策略一致性研究的两个主要方向。现有的冲突检测算法时间复杂度高，且缺乏灵活性和扩展性。改变策略条件和基于优先级的冲突消解方法容易引起新的不一致性问题，而且优先权的赋予带有主观因素，难以实现。在此基础上，使用逻辑对策略和策略冲突进行形式化描述和分析，并提出了一种基于逻辑合一思想的多项式时间内的策略一致性检测算法；把策略冲突分为包容冲突、相交冲突和互补冲突，给出了一种包容冲突和相交冲突的自动解决方法，证明了该方法的可行性和完备性；利用辩论机制和理论对策略互补冲突进行了语义分析，为基于优先级的解决方案提供了理论基础；提出了一种策略互补冲突下的一致性策略子集的计算算法,并进行了复杂度分析。

关键词: 安全策略, 一致性, 逻辑, 辩论