Technical report of "The Knowledge Base Paradigm Applied to Delegation Revocation"

TL;DR

This paper explores delegation revocation in access control using the knowledge base paradigm, enabling formal reasoning about different revocation schemes and their effects on system state and permissions.

Contribution

It introduces a formal knowledge base framework to analyze and compare various delegation revocation schemes in ownership-based access control systems.

Findings

Knowledge base formalization of revocation schemes

Ability to simulate system state progression

Verification of system invariants and outcomes

Abstract

In ownership-based access control frameworks with the possibility of delegating permissions and administrative rights, delegation chains will form. There are different ways to treat delegation chains when revoking rights, which give rise to different revocation schemes. In this paper, we investigate the problem of delegation revocation from the perspective of the knowledge base paradigm. A knowledge base is a formal specification of domain knowledge in a rich formal language. Multiple forms of inference can be applied to this formal specification in order to solve various problems and tasks that arise in the domain. In other words, the paradigm proposes a strict separation of concerns between information and problem solving. The knowledge base that we use in this paper specifies the effects of the various revocation schemes. By applying different inferences to this knowledge base, we can solve the following tasks: to determine the state of the system after a certain delegation or revocation; to interactively simulate the progression of the system state through time; to determine whether a user has a certain permission or administrative right given a certain state of the system; to verify invariants of the system; and to determine which revocation schemes give rise to a certain specified set of desired outcomes.