A logical language for expressing authorizations

TLDR

Existing access control systems are typically designed for a single policy, making it difficult or impossible to specify diverse protection requirements. This paper proposes a model that can accommodate multiple access control policies. The proposed Authorization Specification Language (ASL) lets users define authorizations together with the governing policy, using rules for derivation, conflict resolution, access control, and integrity checks. We demonstrate ASL’s capability by representing constraints that are rarely supported by current systems.

Abstract

A major drawback of existing access control systems is that they have all been developed with a specific access control policy in mind. This means that all protection requirements (i.e. accesses to be allowed or denied) must be specified in terms of the policy enforced by the system. While this may be trivial for some requirements, specification of other requirements may become quite complex or even impossible. The reason for this is that a single policy simply cannot capture the different protection requirements that users may need to enforce on different data. In this paper, we take a first step towards a model that is able to support different access control policies. We propose a logical language for the specification of authorizations on which such a model can be based. The Authorization Specification Language (ASL) allows users to specify, together with the authorizations, the policy according to which access control decisions are to be made. Policies are expressed by means of rules which enforce the derivation of authorizations, conflict resolution, access control and integrity constraint checking. We illustrate the power of our language by showing how different constraints that are sometimes required, but very seldom supported by existing access control systems, can be represented in our language.