TY - GEN
T1 - Information carrying identity proof trees
AU - Winsborough, Wiliam H.
AU - Squicciarini, Anna C.
AU - Bertino, Elisa
PY - 2007
Y1 - 2007
N2 - In open systems, the verification of properties of subjects is crucial for authorization purposes. Very often access to resources is based on policies that express (possibly complex) requirements in terms of what are referred to variously as identity properties, attributes, or characteristics of the subject. In this paper we provide an approach that an entity called a verifier can use to evaluate queries about properties of a subject requesting resources that are relevent deciding whether the requested action is authorized. Specifically, we contribute techniques that enable reuse of previously computed query results. We consider issues related to temporal validity as well as issues related to confidentiality when one entity reuses query results computed by another entity. We employ constraint logic programming as the foundation of our policy rules and query evaluation. This provides a very general, flexible basis, and enable our work to be applied more or less directly to several existing policy frameworks. The process of evaluation of a query against a subject identity is traced through a structure, referred to as identity proof tree, that carries all information proving that a policy requirement is met.
AB - In open systems, the verification of properties of subjects is crucial for authorization purposes. Very often access to resources is based on policies that express (possibly complex) requirements in terms of what are referred to variously as identity properties, attributes, or characteristics of the subject. In this paper we provide an approach that an entity called a verifier can use to evaluate queries about properties of a subject requesting resources that are relevent deciding whether the requested action is authorized. Specifically, we contribute techniques that enable reuse of previously computed query results. We consider issues related to temporal validity as well as issues related to confidentiality when one entity reuses query results computed by another entity. We employ constraint logic programming as the foundation of our policy rules and query evaluation. This provides a very general, flexible basis, and enable our work to be applied more or less directly to several existing policy frameworks. The process of evaluation of a query against a subject identity is traced through a structure, referred to as identity proof tree, that carries all information proving that a policy requirement is met.
UR - http://www.scopus.com/inward/record.url?scp=79959637422&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=79959637422&partnerID=8YFLogxK
U2 - 10.1145/1314333.1314348
DO - 10.1145/1314333.1314348
M3 - Conference contribution
AN - SCOPUS:79959637422
SN - 9781595938831
T3 - WPES'07 - Proceedings of the 2007 ACM Workshop on Privacy in Electronic Society
SP - 76
EP - 79
BT - WPES'07 - Proceedings of the 2007 ACM Workshop on Privacy in Electronic Society
T2 - 6th ACM Workshop on Privacy in the Electronic Society, WPES'07, Held in Association with the 14th ACM Computer and Communications Security Conference
Y2 - 29 October 2007 through 29 October 2007
ER -