Ninghui Li
Benjamin N. Grosof
Skip Abstract Section
Abstract
We address the problem of authorization in large-scale, open, distributed systems. Authorization decisions are needed in electronic commerce, mobile-code execution, remote resource sharing, privacy protection, and many other applications. We adopt the trust-management approach, in which "authorization" is viewed as a "proof-of-compliance" problem: Does a set of credentials prove that a request complies with a policy?We develop a logic-based language, called Delegation Logic (DL), to represent policies, credentials, and requests in distributed authorization. In this paper, we describe D1LP, the monotonic version of DL. D1LP extends the logic-programming (LP) language Datalog with expressive delegation constructs that feature delegation depth and a wide variety of complex principals (including, but not limited to, k-out-of-n thresholds). Our approach to defining and implementing D1LP is based on tractably compiling D1LP programs into ordinary logic programs (OLPs). This compilation approach enables D1LP to be implemented modularly on top of existing technologies for OLP, for example, Prolog.As a trust-management language, D1LP provides a concept of proof-of-compliance that is founded on well-understood principles of logic programming and knowledge representation. D1LP also provides a logical framework for studying delegation.
- Abadi. M. 1998. On SDSI's linked local name spaces. J. Comput. Secu. 6, 1/2 (Jan./Feb.), 3--21.]] Google Scholar
- Abadi, M., Burrows, M., Lampson, B., and Plotkin, G. 1993. A calculus for access control in distributed systems. ACM Trans. Prog. Lang. and Systems. 15, 4 (Oct.), 706--734.]] Google Scholar
- Aura, T. 1998. On the structure of delegation networks. In Proceedings of the IEEE Computer Security Foundations Workshop (CSFW-11) (June). IEEE Computer Society Press, Los Alamitos, Calif., pp. 14--26.]] Google Scholar
- Baral C. and Gelfond, M. 1994. Logic programming and knowledge representation. J. Logic Prog. 19/20 (May/July), 73--148.]]Google Scholar
- Bertino E., Buccafurri F., Ferrari, E., and Rullo, P. 1999. A logical framework for reasoning on data access control policies. In Proceedings of the IEEE Computer Security Foundations Workshop (CSFW-12), (July). IEEE Computer Society Press, Los Alamitos, Calif., pp. 175--189.]] Google Scholar
- Blaze, M., Feigenbaum J., Ioannidis J., and Keromytis, A. D. 1999a. The KeyNote trust-management system, version 2. IETF RFC 2704, September 1999.]] Google Scholar
- Blaze, M., Feigenbaum, J., Ioannidis, J., and Keromytis, A. D. 1999b. The role of trust management in distributed systems. In Secure Internet Programming, Lecture Notes in Computer Science, 1603. Springer, Berlin, pp. 185--210.]] Google Scholar
- Blaze M., Feigenbaum, J., and Lacy, J. 1996. Decentralized trust management. In Proceedings of the IEEE Symposium on Security and Privacy (May). IEEE Computer Society Press, Los Alamitos, Calif., pp 164--173.]] Google Scholar
- Blaze, M., Feigenbaum, J., and Strauss, M. 1998. Compliance-checking in the PolicyMaker trust management system. In Proceedings of Second International Conference on Financial Cryptography (FC'98), (Feb.). Lecture Notes in Computer Science, 1465. Springer, Berlin, pp. 254--274.]] Google Scholar
- CCITT. 1989. Recommendation X.509: The Directory-Authentication Framework. Consultation Committee, International Telephone and Telegraph, International Telecommunications Union, Geneva.]]Google Scholar
- Chen W. and Warren, D. S. 1996. Tabled evaluation with delaying for general logic programs. J. ACM 43, 1 (Jan.), 20--74.]] Google Scholar
- Chu, Y.-H., Feigenbaum, J., Lamacchia, B., Resnick, P., and Strauss, M. 1997. REFEREE: Trust management for web applications. World Wide Web Journal. 2, 706--734.]] Google Scholar
- Clarke, D., Elien, J.-E., Ellison, C., Fredette, M., Morcos, A., and Rivest, R. L. 2001. Certificate chain discovery in SPKI/SDSI. J. Comput. Secu. 9, 4 (Nov.), 285--322.]] Google Scholar
- DeTreville, J. 2002. Binder, a logic-based security language. In Proceedings of the IEEE Symposium on Security and Privacy (May). IEEE Computer Society Press, Los Alamitos, Calif., pp. 105--113.]] Google Scholar
- Ellison, C., Frantz, B., Lampson, B., Rivest, R. L., Thomas, B., and Ylonen, T. 1999a. SPKI certificate theory. IETF RFC 2693, September 1999.]] Google Scholar
- Ellison, C., Frantz, B., Lampson, B., Rivest, R. L., Thomas, B., and Ylonen, T. 1999b. Simple public key certificates. Internet Draft (work in progress), July 1999. http://world.std.com∼cme/spki.txt.]]Google Scholar
- Finney, H. 1996. Transitive trust and MLM. Post to cypherpunks mailing list, archived at http://www.inet-one.com/cypherpunks/dir.1996.05.02-1996.05.08/msg00415.html. May 1996.]]Google Scholar
- Halpern J. and van der Meyden, R. 2001. A logic for SDSI's linked local named spaces. J. Comput. Secu. 9, 1/2 (Feb./May), 47--74.]] Google Scholar
- Herzberg, A., Mass, Y., Mihaeli, J., Naor, D., and Ravid, Y. 2000. Access control meets public key infrastructure, or: Assigning roles to strangers. In Proceedings of the IEEE Symposium on Security and Privacy (May). IEEE Computer Society Press, Los Alamitos, Calif., pp. 2--14.]] Google Scholar
- Howell, J. R. 2000. Naming and sharing resources acroos administrative boundaries. PhD thesis, Dartmouth College, May 2000.]] Google Scholar
- Jajodia, S., Samarati, P., and Subrahmanian, V. S. 1997a. A logical language for expressing authorizations. In Proceedings of the IEEE Symposium on Security and Privacy (May). IEEE Computer Society Press, Los Alamitos, Calif., pp. 31--42.]] Google Scholar
- Jajodia, S., Samarati, P., Subrahmanian, V. S., and Bertino, E. 1997b. A unified framework for enforcing multiple access control policies. In Proceedings of ACM SIGMOD International Conference on Management of Data. ACM Press, New York, NY, pp. 474--485.]] Google Scholar
- Jim, T. 2001. SD3: A trust management system with certified evaluation. In Proceedings of the IEEE Symposium on Security and Privacy (May). IEEE Computer Society Press, Los Alamitos, Calif., pp. 106--115.]] Google Scholar
- Kent, S. T. 1993. Internet privacy enhanced mail. Comm. ACM. 36, 8 (Aug.), 48--60.]] Google Scholar
- Lampson, B., Abadi, M., Burrows, M., and Wobber, E. 1992. Authentication in distributed systems: theory and practice. ACM Trans. Comput. Systems 10, 4 (Nov.), 265--310.]] Google Scholar
- Langheinrich, M. 2002. A P3P Preference Exchange Language 1.0 (APPEL1.0). W3C Working Draft, April 2002.]]Google Scholar
- Li, N. 2000a. Local names in SPKI/SDSI. In Proceedings of the IEEE Computer Security Foundations Workshop (CSFW-13), (July). IEEE Computer Society Press, Los Alamitos, Calif., pp. 2--15.]] Google Scholar
- Li, N. 2000b. Delegation Logic: A Logic-based Approach to Distributed Authorization. PhD thesis, New York University, September 2000.]] Google Scholar
- Li, N. 2000c. XD1LP: An implementation of D1LP in XSB. http://cs.nyu.edu/ninghui/xd1lp/.]]Google Scholar
- Li, N., Feigenbaum, J., and Grosof, B. N. 1999. A logic-based knowledge representation for authorization with delegation (extended abstract). In Proceedings of the IEEE Computer Security Foundations Workshop (CSFW-12) (June). IEEE Computer Society Press, Los Alamitos, Calif., pp. 162--174.]] Google Scholar
- Li, N., Grosof, B. N., and Feigenbaum, J. 2000. A practically implementable and tractable Delegation Logic. In Proceedings of the IEEE Symposium on Security and Privacy (May). IEEE Computer Society Press, Los Alamitos, Calif., pp. 27--42..]] Google Scholar
- Li, N., Mitchell, J. C., and Winsborough, W. H. 2002. Design of a role-based trust management framework. In Proceedings of the IEEE Symposium on Security and Privacy (May). IEEE Computer Society Press, Los Alamitos, Calif., pp. 114--130.]] Google Scholar
- Li, N., Winsborough, W. H., and Mitchell, J. C. 2003. Distributed credential chain discovery in trust management. J. Comput. Secu. To appear. Extended abstract appeared in Proceedings of the ACM Conference on Computer and Communications Security (Nov, 2001). ACM Press, New York, NY, pp. 156--165.]] Google Scholar
- Lloyd, J. W. 1987. Foundations of Logic Programming, 2nd Edition. Springer, Berlin.]] Google Scholar
- Marchiori, M. 2002. The Platform for Privacy Preferences 1.0 (P3P1.0) Specification. W3C Recommendation. April.]]Google Scholar
- Maurer, U. 1997. Modelling a public-key infrastructure. In Proceedings of the European Symposium on Research in Computer Security. Lecture Notes in Computer Science, 1146. Springer, Berlin, pp. 325--350.]] Google Scholar
- Naish, L. 1992. Types and the intended meaning of logic programs. In F. Pfenning, editor, Types in Logic Programming. The MIT Press, Cambridge, Mass., pp. 189--216.]]Google Scholar
- Padawitz, P. 1998. Computing in Horn Clause Theories. EATCS monographs on Theoretical Computer Science, vol. 16. Springer Berlin.]] Google Scholar
- Pfenning, F. ed. 1992. Types in Logic Programming. Logic Programming Series. The MIT Press, Cambridge, Mass.]] Google Scholar
- Rivest, R. L. and Lampson, B. 1996. SDSI: a simple distributed security infrastructure. http://theory.lcs.mit.edu/∼rivest/sdsi11.html. October 1996.]]Google Scholar
- Weeks, S. 2001. Understanding trust management systems. In Proceedings of the IEEE Symposium on Security and Privacy (May). IEEE Computer Society Press, Los Alamitos, Calif., pp 94--105.]] Google Scholar
- The XSB Research Group. 2002. The XSB programming system. http://xsb.sourceforge.net/.]]Google Scholar
Index Terms
- Delegation logic: A logic-based approach to distributed authorization
Recommendations
A rule-based framework for role-based delegation and revocation
Delegation is the process whereby an active entity in a distributed environment authorizes another entity to access resources. In today's distributed systems, a user often needs to act on another user's behalf with some subset of his/her rights. Most ...
Design of a Role-Based Trust-Management Framework
SP '02: Proceedings of the 2002 IEEE Symposium on Security and PrivacyWe introduce the RT framework, a family of Role-based Trust-managementlanguages for representing policies and credentials in distributedauthorization. RT combines the strengths of role-based access controland trust-management systems and is especially ...
A Virtual Enterprise Oriented Access Control Mechanism
ISECS '09: Proceedings of the 2009 Second International Symposium on Electronic Commerce and Security - Volume 01Virtual enterprise is a temporary alliance of enterprises that come together to share skills, core competencies or resources. The members in virtual enterprise need to collaborate in a distributed, dynamic, open and heterogeneous environment. ...
Comments