Using Authority Certificates to Create Management Structures

Abstract

Abstract. We address the issue of updating privileges in a dynamic environment by introducing authority cerrtificates in a Privilege Management Infrastructure. These certificates can be used to create access-level permissions but also to delegate authority to other agents, thereby providing a mechanism for creating management structures and for changing these structures over time. We present a semantic framework for privileges and certificates and an associated calculus, encoded as a logic program, for reasoning about them. The framework distinguishes between the time a certificate is issued or revoked and the time for which the associated privilege is created. This enables certificates to have prospective and retrospective effects, and allows us to reason about privileges and their consequences in the past, present, and future. The calculus provides a verification procedure for determining, given a set of declaration and revocation certificates, whether a certain privilege holds.

Dynamics in Delegation and Revocation Schemes: A Logical Approach

“…The notation is intended to represent a generic access control framework using an ownership-based model with grant option for both positive and negative permissions, and where negative permissions dominate positive ones. We draw the reader's to a simplified version of the distributed authoriza- tion model described in [1,8], and illustrated in Figure 1, where an agent receives a privilege, directly or indirectly, from a source of authority (SOA). The SOA is an agent that has full power over a resource and is the ultimate authority w.r.t.…”

Using the Event Calculus for Tracking the Normative State of Contracts

“…The resulting formalism is used in conjunction with abductive reasoning techniques to perform a priori analysis of policy specifications. In [21], Firozabadi and colleagues develop an EC-based framework for issuing privileges to agents in a community, through declaration and revocation authority certificates. It makes a distinction between the time a certificate is issued, or revoked, and the time for which the associated privilege is created, or discharged, enabling certificates to have prospective and retrospective effects.…”

Permission and Authorization in Policies for Virtual Communities of Agents

“…[18], for example, propose a framework where this power can be delegated as any other power to create institutional facts. We show in this paper that once prohibitions and permissions are not considered as primitive logical entities, the preconditions for their creation emerge.…”