Affiliations: [a] Dipartimento di Scienze dell’Informazione, Università degli Studi di Milano, Via Comelico 39/41, 20135 Milano, Italy. E-mail: bertino@dsi.unimi.it, ferrarie@dsi.unimi.it | [b] Dipartimento DIMET, Università di Reggio Calabria, Feo di Vito, 89100 Reggio Calabria, Italy. E-mail: bucca@ns.ing.unirc.it | [c] Dipartimento di Matematica, Università della Calabria, Arcavacata di Rende, 87030 Rende, Italy. E-mail: rullo@si.deis.unical.it
Correspondence:
[*]
Corresponding author.
Note: [1] A preliminary version of this paper appears in the Proceedings of the 5th European Symposium on Research in Computer Security (ESORICS’98), Louvain-La-Neuve, Belgium, September 1998 under the title “An Authorization Model and its Formal Semantics”.
Abstract: This paper describes an advanced authorization mechanism based on a logic formalism. The model supports both positive and negative authorizations. It also supports derivation rules by which an authorization can be granted on the basis of the presence or absence of other authorizations. Subjects, objects and authorization types are organized into hierarchies, supporting a more adequate representation of their semantics. From the authorizations explicitly specified, additional authorizations are automatically derived by the system, based on those hierarchies. The combination of all the above features results in a powerful yet flexible access control mechanism. The logic formalism on which the system relies is an extension of Ordered Logic with ordered domains. This is an elegant yet powerful formalism whereby the basic concepts of the authorization model can be naturally formalized. Its semantics is based on the notion of stable model and assigns, to a given set of authorization rules, a multiplicity of (stable) models, each representing a possible way of assigning access authorizations. This form of non-determinism entails an innovative approach to enforce access control: when an access request is issued, the appropriate model (set of consistent access authorizations) is chosen, on the basis of the accesses currently under execution in the system.
