A study in the expressiveness of semantically different policy modelling schemes Christos Tsarouchis, Declan O’Sullivan, David Lewis Knowledge & Data Engineering Group (KDEG) Department of Computer Science & Statistics, Trinity College Dublin, Dublin, Ireland {tsaroucc | Declan.OSullivan | Dave.Lewis}@cs.tcd.ie Abstract— Policy Engineering is the process of authoring IT management policies, detecting and resolving policy conflicts and revising existing policies to accommodate changing IT resources, business goals and business processes. Policy authoring is often followed by policy enforcement where the actions specified by subjects are performed on targets (resources). In this paper, we study the use of semantically enhanced techniques, such as ontologies, to model resources and their corresponding actions, coupled with a mechanism that can accommodate frequent organizational change, to model policy subjects. For the modeling of policy subjects, the rule-based Community-based Policy management will be used. This integration falls into the category of combining Description Logics (DL) and Logic Programs (LP). We aim to study this integration primarily from the scope of overall system expressivity, but also from the scope of minimizing the cognitive load perceived by policy authors. Such an evaluation can help determine shortfalls in the design of the software system or of the policy model used. To study the balance in modeling with DL and LP techniques, the encoding of part of the Trinity College Dublin statutes will be performed, which is a sufficiently complex real- world example. Keywords; IT policy engineering, policy modeling, DL and LP integration I. INTRODUCTION Policy Engineering is the process of authoring IT management policies, detecting and resolving policy conflicts and revising existing policies to accommodate changing IT resources, business goals and business processes[1]. Policy authoring is often followed by policy enforcement where the actions specified by subjects are performed on targets (resources). In this paper, we study the use of semantically enhanced techniques, such as ontologies, to model resources and their corresponding actions, coupled with a mechanism that can accommodate frequent organizational change, to model policy subjects. Other research initiatives have attempted to solve such problems by combining the efficiency and the expressive power of rule-based systems with the semantic richness found in Description Logics [2]. For instance, a rule-based system can express variables and causality relationships whereas ontologies on the other hand, can represent relationships between entities in a taxonomic manner that could simplify maintainability. In this paper, for the modeling of policy subjects, the rule- based Community-based Policy management will be used. This integration falls into the category of combining Description Logics (DL) [3] and Logic Programs (LP) [4]. We aim to study this integration primarily from the scope of overall system expressivity, as well as from the scope of minimizing the cognitive load [5] perceived by policy authors, which is particularly important in collaborative environments, with multiple policy authors. II. BENEFITS OF USING SEMANTICALLY ENHANCED RESOURCES One of the requirements in policy engineering is the need to have an accurate and up-to-date view of the managed resources as well as of the actions that can be performed on these resources. This is particularly challenging in the case when not only these resources are frequently changing but also when their corresponding actions change as well. For instance, using the example shown in [6] , we assume that a corporation needs to keep a record of all assets they possess, such as network routers, servers, PCs, etc, as well as a list of countermeasures that need to be taken either when the security of those assets is compromised, or proactively, so that they won’t be compromised. These countermeasures include software patches, malware scans, fine-grained control of firewall ports etc. It is worth pointing out that such an ecosystem could be implemented in devices with different architectures, with each one having different characteristics (e.g. different memory size). These devices can also be based on different operating systems, which could require a different set of actions during a software update. For example, one system might require install only, the other might require install and reboot. Ideally, a policy author should be able to correctly enforce a policy of the following form: “Install software update X on all applicable devices”. As the complexity of the managed resources is increasing, the enforcement of such a high level policy poses a very challenging problem. This policy would require its “refinement” into the appropriate low-level policies, something that often takes various stages of gradual refinement until the policy reaches an enforceable stage. One possible solution could be to push the need to know all about the resources and their corresponding actions as late in the policy engineering lifecycle as possible. This would not only assist policy authoring by abstracting away (frequently changing) details about the managed system, but can provide quality feedback as well, in case of policy conflicts. This can be achieved by having an up-to-date snapshot of the resources and