On Generalized Authorization Problems关于广义授权问题.pptVIP

14 January 2002 On GeneralizedAuthorization Problems Weighted Pushdown Systemsand their Application toQuery Evaluation in SPKI/SDSI Authorization Problems Traditionally, authorization restrictions are specified using access control lists (ACLs) Associate permissions with objects For directory D: reps rlidwka jha rlidwk reps:students rl SPKI/SDSI Local name spaces reps students reps students spouse Delegation SPKI/SDSI Name Certs Auth Certs Certificate Chain Pushdown System (PDS) Pushdown System (PDS) Pushdown System (PDS) Pushdown System (PDS) Rules Define a Transition Relation Pushdown System (PDS) PDS = Pushdown automaton without an input tape Mechanism for defining a class of infinite-state transition systems σ, A ? σ, A A PDS Terminology PDS Terminology A Certificate Chain is a Run Basic Authorization Query:KOwner[H],? ? Pre*({KAlice,□, KAlice,■})? Representation Issue The set of configurations pre*(S) can be infinite Example σ,A ? σ, e pre* ( {σ,A}) = { σ Ai | i ≥ 1 } Solution in the PDS literature: Represent a set of configurations with an automaton {KAlice, ,KAlice, } What Does the Automaton Represent? A set of configurations: K, a1 … am is in the set if there is a path Initial automaton represents {KAlice, ,KAlice, } From M to Pre*(M) Pre*({KAlice, ,KAlice, }) Pre*({KAlice, , KAlice, }) Pre*({KAlice, , KAlice, }) Time and Space Complexity nK : number of principals |C|: sum of the lengths of the right-hand sides of the certs in C Pre* Time complexity: O(nK |C|) Space complexity: O(nK |C|) Post* Time and space complexity: O(nK |C| + nk |C|2) Weighted Pushdown System (WPDS) Privacy using a Weighted PDS Privacy using a Weighted PDS Idempotent Semiring (D, ?, ?, 0, 1)[= Meet Semilattice (D, ?, ..., ?, ...)] Idempotent Semiring (D, ?, ?, 0, 1)[= Meet Semilattice (D, ?, ..., ?, ...)] “Auth Cert Reduction is Incomplete” Li Mitchell [CSFW 03] Authorization using a Weighted