User loginNavigation |
A Type Discipline for Authorization Policies
Cedric Fournet; Andrew D. Gordon; Sergio Maffeis. A Type Discipline for Authorization Policies. ESOP 2005.
Distributed systems and applications are often expected to enforce high-level authorization policies. To this end, the code for these systems relies on lower-level security mechanisms such as, for instance, digital signatures, local ACLs, and encrypted communications. In principle, authorization specifications can be separated from code and carefully audited. Logic programs, in particular, can express policies in a simple, abstract manner. We consider the problem of checking whether a distributed implementation based on communication channels and cryptography complies with a logical authorization policy. We formalize authorization policies and their connection to code by embedding logical predicates and claims within a process calculus. We formulate policy compliance operationally by composing a process model of the distributed system with an arbitrary opponent process. Moreover, we propose a new dependent type system for verifying policy compliance of implementation code. Using Datalog as an authorization logic, we show how to type several examples using policies and present a general schema for compiling policies. Another "extreme" use of static typing... By Ehud Lamm at 2005-09-23 18:57 | Logic/Declarative | Parallel/Distributed | Type Theory | other blogs | 9747 reads
|
Browse archives
Active forum topics |
Recent comments
13 weeks 3 days ago
13 weeks 3 days ago
13 weeks 3 days ago
35 weeks 4 days ago
39 weeks 6 days ago
41 weeks 3 days ago
41 weeks 3 days ago
44 weeks 1 day ago
48 weeks 5 days ago
48 weeks 5 days ago