Design and Semantics of a Decentralized Authorization Language

by: Moritz Becker, Cedric Fournet, Andrew Gordon

Computer Security Foundations Symposium, 2007. CSF '07. 20th IEEE (2007), pp. 3-15.

View FullText article

DOI, IEEE Explore

Reviews [Write a review of this article]

There are no reviews of this article

Find related articles from these CiteULike users

weqa, jmackay

Find related articles with these CiteULike tags

authorization, datalog, decentralized, distributed, languages, logic, security, systems

摘要

We present a declarative authorization language that strikes a careful balance between syntactic and semantic simplicity, policy expressiveness, and execution efficiency. The syntax is close to natural language, and the semantics consists of just three deduction rules. The language can express many common policy idioms using constraints, controlled delegation, recursive predicates, and negated queries. We describe an execution strategy based on translation to Datalog with Constraints, and table-based resolution. We show that this execution strategy is sound, complete, and always terminates, despite recursion and negation, as long as simple syntactic conditions are met.

@inproceedings{citeulike:1533849, abstract = {We present a declarative authorization language that strikes a careful balance between syntactic and semantic simplicity, policy expressiveness, and execution efficiency. The syntax is close to natural language, and the semantics consists of just three deduction rules. The language can express many common policy idioms using constraints, controlled delegation, recursive predicates, and negated queries. We describe an execution strategy based on translation to Datalog with Constraints, and table-based resolution. We show that this execution strategy is sound, complete, and always terminates, despite recursion and negation, as long as simple syntactic conditions are met.}, author = {Becker, Moritz and Fournet, Cedric and Gordon, Andrew }, citeulike-article-id = {1533849}, doi = {http://dx.doi.org/10.1109/CSF.2007.18}, journal = {Computer Security Foundations Symposium, 2007. CSF '07. 20th IEEE}, keywords = {authorization, decentralized}, pages = {3--15}, posted-at = {2007-08-03 20:31:40}, priority = {2}, title = {Design and Semantics of a Decentralized Authorization Language}, url = {http://dx.doi.org/10.1109/CSF.2007.18}, year = {2007} }

RIS record

TY - CONF ID - citeulike:1533849 L3 - citeulike-article-id:1533849 N2 - We present a declarative authorization language that strikes a careful balance between syntactic and semantic simplicity, policy expressiveness, and execution efficiency. The syntax is close to natural language, and the semantics consists of just three deduction rules. The language can express many common policy idioms using constraints, controlled delegation, recursive predicates, and negated queries. We describe an execution strategy based on translation to Datalog with Constraints, and table-based resolution. We show that this execution strategy is sound, complete, and always terminates, despite recursion and negation, as long as simple syntactic conditions are met. JF - Computer Security Foundations Symposium, 2007. CSF '07. 20th IEEE EP - 15 TI - Design and Semantics of a Decentralized Authorization Language SP - 3 KW - authorization KW - decentralized AU - Becker, Moritz AU - Fournet, Cedric AU - Gordon, Andrew PY - 2007/// UR - http://dx.doi.org/10.1109/CSF.2007.18 ER -

RIS BibTeX