Design and semantics of a decentralized authorization language

被引：57

作者：

Becker, Moritz Y. ^{[1
]}

Fournet, Cedric ^{[1
]}

Gordon, Andrew D. ^{[1
]}

机构：

[1] Microsoft Res, Cambridge CB3 0FB, England

来源：

20TH IEEE COMPUTER SECURITY FOUNDATIONS SYMPOSIUM (CSFS20), PROCEEDINGS | 2007年

关键词：

D O I：

10.1109/CSF.2007.18

中图分类号：

TP301 [理论、方法];

学科分类号：

081202 ;

摘要：

We present a declarative authorization language that strikes a careful balance between syntactic and semantic simplicity, policy expressiveness, and execution efficiency. The syntax is close to natural language, and the semantics consists of just three deduction rules. The language can express many common policy idioms using constraints, controlled delegation, recursive predicates, and negated queries. We describe an execution strategy based on translation to Datalog with Constraints, and table-based resolution. We show that this execution strategy is sound, complete, and always terminates, despite recursion and negation, as long as simple syntactic conditions are met.

引用

页码：3 / +

页数：3

共 49 条

[1] A CALCULUS FOR ACCESS-CONTROL IN DISTRIBUTED SYSTEMS [J].

ABADI, M ;

BURROWS, M ;

LAMPSON, B ;

PLOTKIN, G .

ACM TRANSACTIONS ON PROGRAMMING LANGUAGES AND SYSTEMS, 1993, 15 (04) :706-734

[2]

Abadi M., 1998, Journal of Computer Security, V6, P3

[3]

Abiteboul S., 1995, Foundations of databases, V1st

[4]

[Anonymous], 1997, RBAC 97

[5] Constrained delegation [J].

Bandmann, O ;

Dam, M ;

Firozabadi, BS .

2002 IEEE SYMPOSIUM ON SECURITY AND PRIVACY, PROCEEDINGS, 2002, :131-140

[6]

Barker S., 2003, ACM Transactions on Information and Systems Security, V6, P501, DOI 10.1145/950191.950194

[7]

Becker M., 2005, UCAMCLTR648

[8] Cassandra: Distributed access control policies with tunable expressiveness [J].

Becker, MY ;

Sewell, P .

FIFTH IEEE INTERNATIONAL WORKSHOP ON POLICIES FOR DISTRIBUTED SYSTEMS AND NETWORKS, PROCEEDINGS, 2004, :159-168

[9] Cassandra: Flexible trust management, applied to electronic health records [J].

Becker, MY ;

Sewell, P .

17TH IEEE COMPUTER SECURITY FOUNDATIONS WORKSHOP, PROCEEDINGS, 2004, :139-154

[10]

BECKER MY, 2006, SECPAL DESIGN SEMANT

← 1 2 3 4 5 →