Authorization in distributed systems: a formal approach

It is argued that authorization is an independent semantic concept that must be separated from implementation mechanisms and given a precise semantics. A logical approach to representing and evaluating authorization is proposed. Specifically, a language for specifying policy bases is introduced. A policy base encodes a set of authorization requirements and is given a precise semantics based on a formal notion of authorization policy. The semantics is computable, thus providing a basis for authorization evaluation. Two composition operators for policy bases which are appropriate for modeling distributed systems with multiple administrative domains are introduced.<
>