Flexible access control policy specification with constraint logic programming

ABSTRACT

We show how a range of role-based access control (RBAC) models may be usefully represented as constraint logic programs, executable logical specifications. The RBAC models that we define extend the "standard" RBAC models that are described by Sandhu et al., and enable security administrators to define a range of access policies that may include features, like denials of access and temporal authorizations, that are often useful in practice, but which are not widely supported in existing access control models. Representing access policies as constraint logic programs makes it possible to support certain policy options, constraint checks, and administrator queries that cannot be represented by using related methods (like logic programs). Representing an access control policy as a constraint logic program also enables access requests and constraint checks to be efficiently evaluated.

REFERENCES

• 1: Gail-Joon Ahn , Ravi Sandhu, Role-based authorization constraints specification, ACM Transactions on Information and System Security (TISSEC), v.3 n.4, p.207-226, Nov. 2000 [doi>10.1145/382912.382913]
• 2: Vijayalakshmi Atluri , Wei-kuang Huang, An Authorization Model for Workflows, Proceedings of the 4th European Symposium on Research in Computer Security: Computer Security, p.44-64, September 25-27, 1996
• 3: Steve Barker, Data Protection by Logic Programming, Proceedings of the First International Conference on Computational Logic, p.1300-1314, July 01, 2000
• 4: Steve Barker, Protecting Deductive Databases from Unauthorized Retrievals, Proceedings of the IFIP TC11/ WG11.3 Fourteenth Annual Working Conference on Database Security: Data and Application Security, Development and Directions, p.185-196, August 21-23, 2000
• 5: Steve Barker, TRBAC: A Temporal Authorization Model, Proceedings of the International Workshop on Information Assurance in Computer Networks: Methods, Models, and Architectures for Network Security, p.178-188, May 21-23, 2001
• 6: Steve Barker , Arnon Rosenthal, Flexible security policies in SQL, Proceedings of the fifteenth annual working conference on Database and application security, p.167-180, July 15-18, 2001, Niagara, Ontario, Canada
• 7: Elisa Bertino , Claudio Bettini , Elena Ferrari , Pierangela Samarati, An access control model supporting periodicity constraints and temporal reasoning, ACM Transactions on Database Systems (TODS), v.23 n.3, p.231-285, Sept. 1998 [doi>10.1145/293910.293151]
• 8: Elisa Bertino , Piero Andrea Bonatti , Elena Ferrari, TRBAC: a temporal role-based access control model, Proceedings of the fifth ACM workshop on Role-based access control, p.21-30, July 26-28, 2000, Berlin, Germany [doi>10.1145/344287.344298]
• 9: E. Bertino , B. Catania , E. Ferrari , P. Perlasca, A System to Specify and Manage Multipolicy Access Control Models, Proceedings of the 3rd International Workshop on Policies for Distributed Systems and Networks (POLICY'02), p.116, June 05-07, 2002
• 10: Silvana Castano , Maria Grazia Fugini , Giancarlo Martella , Pierangela Samarati, Database security, ACM Press/Addison-Wesley Publishing Co., New York, NY, 1995
• 11: L. Cavedon , J. W. Lloyd, A completeness theorem for SLDNF resolution, Journal of Logic Programming, v.7 n.3, p.177-191, Nov. 1989 [doi>10.1016/0743-1066(89)90020-4]
• 12: C. J. Date, An introduction to database systems (7th ed.), Addison-Wesley Longman Publishing Co., Inc., Boston, MA, 1999
• 13: Ferraiolo, D., Cugini, J., and Kuhn, R. 1995. Role-based access control (RBAC): Features and motivations. In Proceedings of the 11th Annual Computer Security Applications Conference, 241--248.
• 14: Gelfond, M. and Lifschitz, V. 1988. The stable model semantics for logic programming. In Proceedings of 5th International Conference and Symposium on Logic Programming. R. Kowalski and K. Bowen, Eds. MIT Press, Cambridge, MA, 1070--1080.
• 15: Samir Genaim , Michael Codish, Inferring Termination Conditions for Logic Programs Using Backwards Analysis, Proceedings of the Artificial Intelligence on Logic for Programming, p.685-694, December 03-07, 2001
• 16: S. Greco , N. Leone , P. Rullo, COMPLEX: An Object-Oriented Logic Programming System, IEEE Transactions on Knowledge and Data Engineering, v.4 n.4, p.344-359, August 1992 [doi>10.1109/69.149930]
• 17: Joxan Jaffar , Spiro Michaylov , Peter J. Stuckey , Roland H. C. Yap, The CLP( R ) language and system, ACM Transactions on Programming Languages and Systems (TOPLAS), v.14 n.3, p.339-395, July 1992 [doi>10.1145/129393.129398]
• 18: Sushil Jajodia , Pierangela Samarati , Maria Luisa Sapino , V. S. Subrahmanian, Flexible support for multiple access control policies, ACM Transactions on Database Systems (TODS), v.26 n.2, p.214-260, June 2001 [doi>10.1145/383891.383894]
• 19: Andrew D. Kelly , Kim Marriott , Andrew MacDonald , Peter J. Stuckey , Roland Yap, Optimizing compilation of CLP( R ), ACM Transactions on Programming Languages and Systems (TOPLAS), v.20 n.6, p.1223-1250, Nov. 1998 [doi>10.1145/295656.295661]
• 20: Robert A. Kowalski, Logic for Problem Solving, Prentice Hall PTR, Upper Saddle River, NJ, 1979
• 21: J. W. Lloyd, Foundations of logic programming; (2nd extended ed.), Springer-Verlag New York, Inc., New York, NY, 1987
• 22: Kim Marriott , Harald Søndergaard , Philip Dart, A characterization of non-floundering logic programs, Proceedings of the 1990 North American conference on Logic programming, p.661-680, January 1990, Austin, Texas, United States
• 23: Marriott, K. and Stuckey, P. 1998. Programming with Constraints: An Introduction. MIT Press, Cambridge, MA.
• 24: T. C. Przymusinski, On the declarative semantics of deductive databases and logic programs, Foundations of deductive databases and logic programming, Morgan Kaufmann Publishers Inc., San Francisco, CA, 1988
• 25: Reiter, R. 1980. A logic for default reasoning. Artificial Intelligence 13, 81--132.
• 26: Ravi Sandhu , Venkata Bhamidipati , Edward Coyne , Srinivas Ganta , Charles Youman, The ARBAC97 model for role-based administration of roles: preliminary description and outline, Proceedings of the second ACM workshop on Role-based access control, p.41-50, November 06-07, 1997, Fairfax, Virginia, United States [doi>10.1145/266741.266752]
• 27: Ravi S. Sandhu , Edward J. Coyne , Hal L. Feinstein , Charles E. Youman, Role-Based Access Control Models, Computer, v.29 n.2, p.38-47, February 1996 [doi>10.1109/2.485845]
• 28: Ravi Sandhu , David Ferraiolo , Richard Kuhn, The NIST model for role-based access control: towards a unified standard, Proceedings of the fifth ACM workshop on Role-based access control, p.47-63, July 26-28, 2000, Berlin, Germany [doi>10.1145/344287.344301]
• 29: SICStus 1999. Sicstus prolog home page. http://www.sics.se/sicstus/.
• 30: Chris Speirs , Zoltan Somogyi , Harald Søndergaard, Termination Analysis for Mercury, Proceedings of the 4th International Symposium on Static Analysis, p.160-171, September 08-10, 1997
• 31: Sterling, L. and Shapiro, E. 1994. The Art of PROLOG. MIT Press, Cambridge, MA.
• 32: Peter J. Stuckey, Negation and constraint logic programming, Information and Computation, v.118 n.1, p.12-33, April 1995 [doi>10.1006/inco.1995.1048]
• 33: Woo, T. and Lam, S. 1993. Authorizations in distributed systems: A new approach. Journal of Computer Security 2, 2/3, 107--136.

INDEX TERMS

Primary Classification:
  H. Information Systems
  H.2 DATABASE MANAGEMENT
      H.2.7 Database Administration
          Subjects: Security, integrity, and protection

Additional Classification:
  D. Software
  D.3 PROGRAMMING LANGUAGES
      D.3.2 Language Classifications
          Subjects: Constraint and logic languages

  K. Computing Milieux
  K.6 MANAGEMENT OF COMPUTING AND INFORMATION SYSTEMS
      K.6.5 Security and Protection (D.4.6, K.4.2)

General Terms:
Security

Keywords:
Role-based access control, constraint logic programming