Design and Semantics of a Decentralized Authorization Language

Moritz Y. Becker; Cédric Fournet; Andrew D. Gordon

doi:10.1109/CSF.2007.18

Design and Semantics of a Decentralized Authorization Language

Moritz Y. Becker, Cédric Fournet, Andrew D. Gordon

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

Abstract

We present a declarative authorization language that strikes a careful balance between syntactic and semantic simplicity, policy expressiveness, and execution efficiency. The syntax is close to natural language, and the semantics consists of just three deduction rules. The language can express many common policy idioms using constraints, controlled delegation, recursive predicates, and negated queries. We describe an execution strategy based on translation to datalog with constraints, and table-based resolution. We show that this execution strategy is sound, complete, and always terminates, despite recursion and negation, as long as simple syntactic conditions are met.

Original language	English
Title of host publication	20th IEEE Computer Security Foundations Symposium, CSF 2007, 6-8 July 2007, Venice, Italy
Publisher	Institute of Electrical and Electronics Engineers
Pages	3-15
Number of pages	13
ISBN (Print)	0-7695-2819-8
DOIs	https://doi.org/10.1109/CSF.2007.18
Publication status	Published - Jul 2007

Access to Document

10.1109/CSF.2007.18

http://dx.doi.org/10.1109/CSF.2007.18

Cite this

@inproceedings{fb213354da7b493eb14ccf3f22353bde,

title = "Design and Semantics of a Decentralized Authorization Language",

abstract = "We present a declarative authorization language that strikes a careful balance between syntactic and semantic simplicity, policy expressiveness, and execution efficiency. The syntax is close to natural language, and the semantics consists of just three deduction rules. The language can express many common policy idioms using constraints, controlled delegation, recursive predicates, and negated queries. We describe an execution strategy based on translation to datalog with constraints, and table-based resolution. We show that this execution strategy is sound, complete, and always terminates, despite recursion and negation, as long as simple syntactic conditions are met.",

author = "Becker, {Moritz Y.} and C{\'e}dric Fournet and Gordon, {Andrew D.}",

year = "2007",

month = jul,

doi = "10.1109/CSF.2007.18",

language = "English",

isbn = "0-7695-2819-8",

pages = "3--15",

booktitle = "20th IEEE Computer Security Foundations Symposium, CSF 2007, 6-8 July 2007, Venice, Italy",

publisher = "Institute of Electrical and Electronics Engineers",

address = "United States",

}

TY - GEN

T1 - Design and Semantics of a Decentralized Authorization Language

AU - Becker, Moritz Y.

AU - Fournet, Cédric

AU - Gordon, Andrew D.

PY - 2007/7

Y1 - 2007/7

N2 - We present a declarative authorization language that strikes a careful balance between syntactic and semantic simplicity, policy expressiveness, and execution efficiency. The syntax is close to natural language, and the semantics consists of just three deduction rules. The language can express many common policy idioms using constraints, controlled delegation, recursive predicates, and negated queries. We describe an execution strategy based on translation to datalog with constraints, and table-based resolution. We show that this execution strategy is sound, complete, and always terminates, despite recursion and negation, as long as simple syntactic conditions are met.

AB - We present a declarative authorization language that strikes a careful balance between syntactic and semantic simplicity, policy expressiveness, and execution efficiency. The syntax is close to natural language, and the semantics consists of just three deduction rules. The language can express many common policy idioms using constraints, controlled delegation, recursive predicates, and negated queries. We describe an execution strategy based on translation to datalog with constraints, and table-based resolution. We show that this execution strategy is sound, complete, and always terminates, despite recursion and negation, as long as simple syntactic conditions are met.

U2 - 10.1109/CSF.2007.18

DO - 10.1109/CSF.2007.18

M3 - Conference contribution

SN - 0-7695-2819-8

SP - 3

EP - 15

BT - 20th IEEE Computer Security Foundations Symposium, CSF 2007, 6-8 July 2007, Venice, Italy

PB - Institute of Electrical and Electronics Engineers

ER -

Design and Semantics of a Decentralized Authorization Language

Abstract

Access to Document

Fingerprint

Cite this