Modelling Delegation and Revocation Schemes in IDP

TL;DR

This paper demonstrates how the IDP knowledge base system can efficiently implement various revocation schemes in ownership-based access control systems with delegation chains, using a declarative approach.

Contribution

It introduces a method to model and execute different revocation schemes within IDP for ownership-based access control, combining ASP, SAT, and CP techniques.

Findings

IDP effectively models delegation and revocation schemes.

Declarative specifications enable flexible revocation strategies.

Efficient implementation of revocation schemes demonstrated.

Abstract

In ownership-based access control frameworks with the possibility of delegating permissions and administrative rights, chains of delegated accesses will form. There are different ways to treat these delegation chains when revoking rights, which give rise to different revocation schemes. In this paper, we show how IDP - a knowledge base system that integrates technology from ASP, SAT and CP - can be used to efficiently implement executable revocation schemes for an ownership-based access control system based on a declarative specification of their properties.