Authorization in Distributed Systems: A New Approach¹

Article type: Research Article

Authors: Woo, Thomas Y.C. | Lam, Simon S.

Affiliations: Department of Computer Sciences, The University of Texas at Austin, Austin, Texas 78712-1188, USA

Note: [1] This work was supported in part by NSA INFOSEC University Research Program under contract no. MDA 904-92-C5150 and in part by National Science Foundation grant no. NCR-9004464. A preliminary version of this paper was presented in [37].

Abstract: In most existing systems, authorization is specified using some low-level system-specific mechanisms, e.g., protection bits, capabilities and access control lists. We argue that authorization is an independent semantic concept that must be separated from implementation mechanisms and given a precise semantics. We propose a logical approach to representing and evaluating authorization. Specifically, we introduce a language for specifying policy bases. A policy base encodes a set of authorization requirements and is given a precise semantics based upon a formal notion of authorization policy. The semantics is computable, thus providing a basis for authorization evaluation.

DOI: 10.3233/JCS-1993-22-304

Journal: Journal of Computer Security, vol. 2, no. 2-3, pp. 107-136, 1993