Design of a role-based trust-management framework

TLDR

RT combines role‑based access control and trust‑management systems, making it well suited for attribute‑based access control. The paper introduces the RT framework, a family of role‑based trust‑management languages for representing policies and credentials in distributed authorization. RT uses simple credential forms to provide localized authority, delegation, linked and parameterized roles, and introduces manifold roles for threshold and separation‑of‑duty policies, with its semantics formally defined via a translation to Datalog rules. The translation demonstrates that the RT semantics are algorithmically tractable.

Abstract

We introduce the RT framework, a family of role-based trust management languages for representing policies and credentials in distributed authorization. RT combines the strengths of role-based access control and trust-management systems and is especially suitable for attribute-based access control. Using a few simple credential forms, RT provides localized authority over roles, delegation in role definition, linked roles, and parameterized roles. RT also introduces manifold roles, which can be used to express threshold and separation-of-duty policies, and delegation of role activations. We formally define the semantics of credentials in the RT framework by presenting a translation from credentials to Datalog rules. This translation also shows that this semantics is algorithmically tractable.