SecPAL: Design and semantics of a decentralized authorization language

Moritz Y. Becker, Cedric Fournet, Andrew D. Gordon

Research output: Contribution to journalArticlepeer-review


We present a declarative authorization language. Policies and credentials are expressed using predicates defined by logical clauses, in the style of constraint logic programming. Access requests are mapped to logical authorization queries, consisting of predicates and constraints combined by conjunctions, disjunctions, and negations. Access is granted if the query succeeds against the current database of clauses. Predicates ascribe rights to particular principals, with flexible support for delegation and revocation. At the discretion of the delegator, delegated rights can be further delegated, either to a fixed depth, or arbitrarily deeply.Our language strikes a careful balance between syntactic and semantic simplicity, policy expressiveness, and execution efficiency. The syntax is close to natural language, and the semantics consists of just three deduction rules. The language can express many common policy idioms using constraints, controlled delegation, recursive predicates, and negated queries. We describe an execution strategy based on translation to Datalog with Constraints, and table-based resolution. We show that this execution strategy is sound, complete, and always terminates, despite recursion and negation, as long as simple syntactic conditions are met.
Original languageEnglish
Pages (from-to)619-665
Number of pages47
JournalJournal of Computer Security
Issue number4
Publication statusPublished - 1 Jan 2010


Dive into the research topics of 'SecPAL: Design and semantics of a decentralized authorization language'. Together they form a unique fingerprint.

Cite this