Delegation Logic: A Logic-based Approach to Distributed Authorization

We address the problem of authorization in large-scale, open, distributed systems. Authorization decisions are needed in electronic commerce, mobile-code execution, remote resource sharing, pri-vacy protection, and many other applications. We adopt the trust-management approach, in which “authorization ” is viewed as a “proof-of-compliance ” problem: Does a set of credentials prove that a request complies with a policy? We develop a logic-based language, called Delegation Logic (DL), to represent policies, creden-tials, and requests in distributed authorization. In this paper, we describe D1LP, the monotonic version of DL. D1LP extends the logic-programming (LP) language Datalog with expressive delega-tion constructs that feature delegation depth and a wide variety of complex principals (including, but not limited to, k-out-of-n thresholds). Our approach to defining and implementing D1LP is based on tractably compiling D1LP programs into ordinary logic programs (OLPs). This compila-tion approach enables D1LP to be implemented modularly on top of existing technologies for OLP