2005 IEEE Symposium on Security and Privacy (S&P'05) (2005)
May 8, 2005 to May 11, 2005
DOI Bookmark: http://doi.ieeecomputersociety.org/10.1109/SP.2005.9
Lujo Bauer , CyLab, Carnegie Mellon University
Scott Garriss , Carnegie Mellon University
Michael K. Reiter , CyLab, Carnegie Mellon University
We present a distributed algorithm for assembling a proof that a request satisfies an access-control policy expressed in a formal logic, in the tradition of Lampson et al. We show analytically that our distributed proof-generation algorithm succeeds in assembling a proof whenever a centralized prover utilizing remote certificate retrieval would do so. In addition, we show empirically that our algorithm outperforms centralized approaches in various measures of performance and usability, notably the number of remote requests and the number of user interruptions. We show that when combined with additional optimizations including caching and automatic tactic generation, which we introduce here, our algorithm retains its advantage, while achieving practical performance. Finally, we briefly describe the utilization of these algorithms as the basis for an access-control framework being deployed for use at our institution.
M. K. Reiter, S. Garriss and L. Bauer, "Distributed Proving in Access-Control Systems," 2005 IEEE Symposium on Security and Privacy (S&P'05)(SP), Oakland, California, 2005, pp. 81-95.