loading...
 This Article 
   
 Share 
   
 Bibliographic References 
   
 Add to: 
 
Digg
Furl
Spurl
Blink
Simpy
Google
Del.icio.us
Y!MyWeb
 
 Search 
   
16th IEEE Computer Security Foundations Workshop (CSFW'03)
Understanding SPKI/SDSI Using First-Order Logic
Pacific Grove, California
June 30-July 02
ISBN: 0-7695-1927-X
ASCII Text
x 
 
Ninghui Li, John C. Mitchell, "Understanding SPKI/SDSI Using First-Order Logic," Computer Security Foundations Workshop, IEEE, pp. 89, 16th IEEE Computer Security Foundations Workshop (CSFW'03), 2003.
 
 
BibTex
x
 
@article{ 10.1109/CSFW.2003.1212707,
author = {Ninghui Li and John C. Mitchell},
title = {Understanding SPKI/SDSI Using First-Order Logic},
journal ={Computer Security Foundations Workshop, IEEE},
volume = {0},
year = {2003},
issn = {1063-6900},
pages = {89},
doi = {http://doi.ieeecomputersociety.org/10.1109/CSFW.2003.1212707},
publisher = {IEEE Computer Society},
address = {Los Alamitos, CA, USA},
}
 
 
RefWorks Procite/RefMan/Endnote
x 
 
TY - CONF
JO - Computer Security Foundations Workshop, IEEE
TI - Understanding SPKI/SDSI Using First-Order Logic
SN - 1063-6900
SP
EP
A1 - Ninghui Li,
A1 - John C. Mitchell,
PY - 2003
KW - null
VL - 0
JA - Computer Security Foundations Workshop, IEEE
ER -
 
Ninghui Li, Stanford University
John C. Mitchell, Stanford University
SPKI/SDSI is a language for expressing distributed access control policy, derived from SPKI and SDSI. We provide a first-order logic (FOL) semantics for SDSI, and show that it has several advantages over previous semantics. For example, the FOL semantics is easily extended to additional policy concepts and gives meaning to a larger class of access control and other policy analysis queries. We prove that the FOL semantics is equivalent to the string rewriting semantics used by SDSI designers, for all queries associated with the rewriting semantics. We also provide a FOL semantics for SPKI/SDSI and use it to analyze the design of SPKI/SDSI. This reveals some problems. For example, the standard proof procedure in RFC 2693 is semantically incomplete. In addition, as noted before by other authors, authorization tags in SPKI/SDSI are algorithmically problematic, making a complete proof procedure unlikely. We compare SPKI/SDSI with RT_1^C which is a language in the RT Role-based Trust-management framework that can be viewed as an extension of SDSI. The constraint feature of RT_1^C based on Constraint Datalog, provides an alternative mechanism that is expressively similar to SPKI/SDSI tags, semantically natural, and algorithmically tractable.
Citation:
Ninghui Li, John C. Mitchell, "Understanding SPKI/SDSI Using First-Order Logic," csfw, pp.89, 16th IEEE Computer Security Foundations Workshop (CSFW'03), 2003
Usage of this product signifies your acceptance of the Terms of Use.