Abstract
Declarative authorization languages promise to simplify the administration of access control systems by allowing the authorization policy to be factored out of the implementation of the resource guard. However, writing a correct policy is an error-prone task by itself, and little attention has been given to tools and techniques facilitating the analysis of complex policies, especially in the context of access denials. We propose the use of abduction for policy analysis, for explaining access denials and for automated delegation. We show how a deductive policy evaluation algorithm can be conservatively extended to perform abduction on Datalog-based authorization policies, and present soundness, completeness and termination results.
This is a preview of subscription content, log in via an institution to check access.
Preview
Unable to display preview. Download preview PDF.
Similar content being viewed by others
References
Li, N., Mitchell, J.C., Winsborough, W.H.: Design of a role-based trust management framework. In: Symposium on Security and Privacy, pp. 114–130 (2002)
DeTreville, J.: Binder, a logic-based security language. In: IEEE Symposium on Security and Privacy, pp. 105–113 (2002)
Li, N., Mitchell, J.C.: Datalog with constraints: A foundation for trust management languages. Practical Aspects of Declarative Languages, 58–73 (2003)
Becker, M.Y., Sewell, P.: Cassandra: Flexible trust management, applied to electronic health records. In: IEEE Computer Security Foundations Workshop (2004)
Becker, M.Y., Fournet, C., Gordon, A.D.: Design and semantics of a decentralized authorization language. In: IEEE Computer Security Foundations Symposium (2007)
Peirce, C.: Abduction and Induction. In: Philosophical Writings of Peirce (1955)
Kakas, A.C., Kowalski, R.A., Toni, F.: The role of abduction in logic programming. In: Gabbay, D.M., Hogger, C.J., Robinson, J.A. (eds.) Handbook of Logic in Artificial Intelligence and Logic Programming, vol. 5, pp. 235–324 (1998)
Becker, M.Y., Nanz, S.: The role of abduction in declarative authorization policies. Technical Report MSR-TR-2007-105, Microsoft Research (2007), http://research.microsoft.com/research/pubs/view.aspx?tr_id=1348
Becker, M.Y., Sewell, P.: Cassandra: distributed access control policies with tunable expressiveness. In: IEEE International Workshop on Policies for Distributed Systems and Networks, pp. 159–168 (2004)
Tamaki, H., Sato, T.: OLD resolution with tabulation. In: Shapiro, E. (ed.) ICLP 1986. LNCS, vol. 225, pp. 84–98. Springer, Heidelberg (1986)
Chen, W., Warren, D.S.: Tabled evaluation with delaying for general logic programs. Journal of the ACM 43(1), 20–74 (1996)
Abiteboul, S., Hull, R., Vianu, V.: Foundations of Databases. Addison-Wesley, Reading (1995)
Alferes, J.J., Pereira, L.M., Swift, T.: Abduction in well-founded semantics and generalized stable models via tabled dual programs. Theory and Practice of Logic Programming 4(4), 383–428 (2004)
Denecker, M., Schreye, D.D.: SLDNFA: An abductive procedure for abductive logic programs. Journal of Logic Programming 34(2), 111–167 (1998)
Verbaeten, S.: Termination analysis for abductive general logic programs. In: International Conference on Logic Programming, pp. 365–379 (1999)
Winsborough, W.H., Seamons, K.E., Jones, V.E.: Automated trust negotiation. In: DARPA Information Survivability Conference and Exposition, vol. 1 (2000)
Winsborough, W.H., Li, N.: Towards practical automated trust negotiation. In: IEEE International Workshop on Policies for Distributed Systems and Networks (2002)
Koshutanski, H., Massacci, F.: Interactive access control for web services. In: International Information Security Conference, pp. 151–166 (2004)
Kapadia, A., Sampemane, G., Campbell, R.H.: Know why your access was denied: regulating feedback for usable security. In: ACM conference on computer and communications security, pp. 52–61 (2004)
Bonatti, P.A., Olmedilla, D., Peer, J.: Advanced policy explanations on the web. In: European Conference on Artificial Intelligence, pp. 200–204 (2006)
Becker, M.Y., Nanz, S.: A logic for state-modifying authorization policies. In: European Symposium on Research in Computer Security (2007)
Author information
Authors and Affiliations
Editor information
Rights and permissions
Copyright information
© 2007 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Becker, M.Y., Nanz, S. (2007). The Role of Abduction in Declarative Authorization Policies. In: Hudak, P., Warren, D.S. (eds) Practical Aspects of Declarative Languages. PADL 2008. Lecture Notes in Computer Science, vol 4902. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-540-77442-6_7
Download citation
DOI: https://doi.org/10.1007/978-3-540-77442-6_7
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-540-77441-9
Online ISBN: 978-3-540-77442-6
eBook Packages: Computer ScienceComputer Science (R0)