A Logic of Trust for Reasoning about Delegation and Revocation

Abstract

In ownership-based access control frameworks with the possibility of delegating permissions and administrative rights, chains of delegated accesses will form. There are different ways to treat these delegation chains when revoking rights, which give rise to different revocation schemes. Hagström et al. [8] proposed a framework for classifying revocation schemes, in which the different revocation schemes are defined graph-theoretically; they motivate the revocation schemes in this framework by presenting various scenarios in which the agents have different reasons for revocating. This paper is based on the observation that there are some problems with Hagström et al.'s definitions of the revocation schemes, which have led us to propose a refined framework with new graph-theoretic definitions of the revocation schemes. In order to formally study the merits and demerits of various definitions of revocation schemes, we propose to apply the axiomatic method originating in social choice theory to revocation schemes. For formulating an axiom, i.e. a desirable property of revocation frameworks, we propose a logic, Trust Delegation Logic (TDL), with which one can formalize the different reasons an agent may have for performing a revocation. We show that our refined graph-theoretic definitions of the revocation schemes, unlike Hagström et al.'s original definitions, satisfy the desirable property that can be formulated using TDL.

Postulates for Revocation Schemes

“…This way of applying the axiomatic method is more in line with standard applications of this methodology in social choice theory and belief revision. We show that one of the simple postulates that we introduce in this paper is not satisfied by the framework that was introduced in Cramer et al [7]. This means that the approach of the present paper, based on simpler postulates, can help to detect problems that the approach from [7] cannot detect.…”

“…The only existing work on delegation revocation that takes the same methodological approach as the present paper is Cramer et al [7]. The relation between the present paper and [7] has already been sketched in the Introduction, and will be discussed further throughout the rest of the paper.…”

“…Depending on the reasons for the revocation, different ways to treat the delegation chain can be desirable [11,1,7]. For example, if one is revoking a permission given to an employee because he is moving to another position in the company, it makes sense to keep in place the permissions she previously granted; but if one is revoking a permission from a user who has abused his rights and is hence distrusted, it makes sense to delete the permissions she previously issued.…”

“…The idea to use this methodology in the study of delegation revocation was first put forward in Cramer et al [7] (the main author of which is also the main author of the current paper). The main goal of Cramer et al [7] was to state postulates that fully characterize all the revocation schemes.…”

“…The main goal of Cramer et al [7] was to state postulates that fully characterize all the revocation schemes. This could only be achieved by introducing a dedicated logic, called Trust Delegation Logic, that allows to formalize the reasons that principals have for delegating and revoking.…”