A Logical Framework for Reasoning on Data Access Control Policies (1999)
| Venue: | In Proceedings of the 12th IEEE Computer Security Foundations Workshop (CSFW-12 |
| Citations: | 18 - 0 self |
BibTeX
@INPROCEEDINGS{Bertino99alogical,
author = {Elisa Bertino and Elena Ferrari and Francesco Buccafurri},
title = {A Logical Framework for Reasoning on Data Access Control Policies},
booktitle = {In Proceedings of the 12th IEEE Computer Security Foundations Workshop (CSFW-12},
year = {1999},
pages = {175--189},
publisher = {IEEE Computer Society Press}
}
Years of Citing Articles
Bookmark
 |
 |
 |
 |
 |
 |
OpenURL
Abstract
In this paper we propose a logic formalism that naturally supports the encoding of complex security specifications. This formalism relies on a hierarchically structured domain made of subjects, objects and privileges. Authorizations are expressed by logic rules. The formalism supports both negation by failure (possibly unstratified) and true negation. The latter is used to express negative authorizations. It turns out that conflicts may result from a set of authorization rules. Dealing with such conflicts requires the knowledge of the domain structure, such as grantor priorities and object/subject hierarchies, which is used in the deductive process to determine which authorization prevails, if any, on the others. Often, however, conflicts are unsolvable, as they express intrinsic ambiguities. We have devised two semantics as an extension of the well-founded and the stable model semantics of logic programming. We have also defined a number of access policies, each based on two orthogo...
