Logic and Logic Programming in Distributed Access Control

Logic and Logic Programming in Distributed Access Control (Part One) Ninghui Li Department of Computer Science and CERIAS Purdue University Ninghui Li (Purdue University)

Outline n n A brief introduction to trust management Logic-based semantics for SDSI Ninghui Li (Purdue University) 2

The Trust-Management (TM) Approach n Multi-centric access control using delegation q q access control decisions are based on distributed policy statements issued by multiple principals policy statements contain n n attributes of principals such as permissions, roles, qualifications, characteristics trust relationships Ninghui Li (Purdue University) 3

Common characteristics of TM systems n n Use public-key certificates for non-local statements Treat public keys as principals to be authorized q authentication consists of verifying signatures Ninghui Li (Purdue University) 4

Digital Signature Scheme n Key space: a set of key pairs (K, K-1) q q n A signing algorithm sig q n K is the verification key and is publicly available K-1 is the signing key and is kept private sig(K-1, M) outputs a digital signature on M A verification algorithm ver q q q ver(K, M, ) outputs yes or no ver(K, M, sig(K-1, M)) = yes w/o knowing K-1, it is difficult to find s. t. ver(K, M, )=yes Ninghui Li (Purdue University) 5

Public-Key Certificates n n A certificate is a data record together with a digital signature A certificate is signed using K-1 q n n we say that it is issued by a public key K A certificate binds some information to another public key (the subject key) Can be verified by anyone who knows the issuer’s public key q can one trust the issuer’s public key? Ninghui Li (Purdue University) 6

Early Trust Management Langugaes n Policy. Maker q q n Key. Note q n Blaze, Feigenbaum & Lacy: “Decentralized Trust Management”, S&P’ 96. Blaze, Feigenbaum & Strauss: “Compliance-Checking in the Policy. Maker Trust Management System”, FC’ 98. Blaze, Feigenbaum, Ioannidis & Keromytis: “The Key. Note Trust. Management System, Version 2”, RFC 2714. SPKI (Simple Public Key Infrastructure) / SDSI (Simple Distributed Security Framework) q q q Rivest & Lampson: SDSI A Simple Distributed Security Infrastructure, Web-page 1996. Ellison et al. : SPKI Certificate Theory, RFC 2693. Clarke et al. : Certificate Chain Discovery in SPKI/SDSI, JCS’ 01. Ninghui Li (Purdue University) 7

Datalog-based Trust Management Languages n Delegation Logic q n SD 3 (Secure Dynamically Distributed Datalog) q n Jim: “SD 3: A Trust Management System with Certified Evaluation”, S&P’ 01. Binder q n Li, Grosof & Feigenbaum: “Delegation Logic: A Logic-based Approach to Distributed Authorization”, TISSEC’ 03. (Conference versions appeared in CSFW’ 99 and S&P’ 00) De. Treville: “Binder, a Logic-Based Security Language”, S&P’ 02. RT: A Family of Role-based Trust-management Languages Ninghui Li (Purdue University) 8

Other Closely Related Logic-based Security Languages n ABLP logic (Abadi, Burrows, Lampson, et al. ) q q n QCM (Query Certificate Managers) q n Lampson et al. : “Authentication in Distributed Systems: Theory and Practice”, TOCS’ 92. Abadi et al. : “A Calculus for Access Control in Distributed Systems”, TOPLAS’ 93. Gunter & Jim: “Policy-directed Certificate Retrieval”, SPE’ 00 AF logic q Appel & Felton: “Proof-Carrying Authentication”, CCS’ 99 Ninghui Li (Purdue University) 9

History of SPKI/SDSI n SDSI (Simple Distributed Security Infrastructure) q q n SPKI (Simple Public Key Infrastructure) q n SDSI 1. 0 and 1. 1 Rivest & Lampson 96 SPKI 1. 0 (Ellison 1996) SPKI/SDSI 2. 0 q q RFC 2693 [1999] [Clarke et al. JCS’ 01] Ninghui Li (Purdue University) 10

An Example in SDSI 2. 0 n SDSI Certificates q q q n (KC access KC mit faculty secretary) (KC mit KM) (KM faculty KEECS faculty) (KEECS faculty KRivest) (KRivest secretary KRivest alice) (KRivest alice KAlice) From the above certificates, KC concludes that KAlice has access Ninghui Li (Purdue University) 11

4 -tuple Reduction in RFC 2693 n Name strings can be reduced using 4 -tuples q (K 1 A 1 K 2) reduces “K 1 A 2 … An” to “K 2 A 2 … An” n q e. g. , (KC mit KM) reduces “KC mit faculty secretary” to “KM faculty secretary” (K 1 A 1 K 2 B 1 … Bm) reduces “K 1 A 2 … An” to “K 2 B 1 … Bm A 2 … An” n e. g. , (KM faculty KEECS faculty) reduces “KM faculty secretary” to “KEECS faculty secretary” Ninghui Li (Purdue University) 12

Applying 4 -tuple Reduction in the Example n From (KC access) to (KC mit faculty secretary) to (KM faculty secretary) to (KEECS faculty secretary) to (KRivest alice) to (KAlice) (KC access KC mit faculty secretary) (KC mit KM) (KM faculty KEECS faculty) (KEECS faculty KRivest) (KRivest secretary KRivest alice) (KRivest alice KAlice) Ninghui Li (Purdue University) 13

Papers on Semantics for SPKI/SDSI n Develop specialized modal logics q q q n Abadi: “On SDSI's Linked Local Name Spaces”, CSFW’ 97, JCS’ 98. Halpern & van der Meyden: n “A logic for SDSI's linked local name spaces”, CSFW’ 99, JCS’ 01 n “A Logical Reconstruction of SPKI”, CSFW’ 01, JCS’ 03 Howell & Kotz: “A Formal Semantics for SPKI”, ESORICS’ 00 Other approaches q q q Li: “Local Names in SPKI/SDSI”, CSFW’ 00 Jha & Reps: “Analysis of SPKI/SDSI Certificates Using Model Checking”, CSFW’ 02 Li & Mitchell: “Understanding SPKI/SDSI Using First-Order Logic”, CSFW’ 03 (Contains the results presented here) Ninghui Li (Purdue University) 14

What is a Semantics? n Elements of a semantics q q q syntax for statements syntax for queries an entailment relation that determines whether a query Q is true given a set P of statements Ninghui Li (Purdue University) 15

Why a Formal Semantics? n What can we gain by a formal semantics q q n understand what queries can be answered defines the entailment relation in a way that is precise, easy to understand, and easy to compute How can one say a semantics is good q subjective metrics: n q q simple, natural, close to original intention defines answers to a broad class of queries can use existing work to provide efficient deduction procedures for answering those queries Ninghui Li (Purdue University) 16

Concepts in SDSI n Concepts q principals identifiers q local names q name strings q K, K 1 A, B, A 1 e. g. , mit, faculty, alice K A, K 1 A 1 e. g. , KM faculty, KRivest alice K A 1 A 2 … An , 1 e. g. , KC mit faculty secretary Ninghui Li (Purdue University) 17

Statements in SDSI n 4 -tuple (K, A, , V) q q n K is the issuer principal A is an identifier is a name string V is the validity specification We write (K A ) for a 4 -tuple q ignoring validity specification Ninghui Li (Purdue University) 18

A Rewriting Semantics for SDSI n n n A set P of 4 -tuples defines a set of rewriting rules, denoted by RS[P] Queries have the form “can 1 rewrite into 2? ” Answer a query is not easy. q cannot naively search for all ways of rewriting 1, as there may be recursions n n e. g. , (K friend K friend) What can we do? Ninghui Li (Purdue University) 19

Deduction Based on the Rewriting Semantics (1) n Limit queries to the form “can 1 rewrite into K? ” q In [Clarke et al. ’ 01], the following closure mechanism is used n rewrite 4 -tuples q n e. g. , apply (KC mit KM) to rewrite (KC access KC mit faculty secretary), one gets (KC access KM faculty secretary) compute the closure of a set of 4 -tuples, q obtained by applying 4 -tuples that rewrites to a principal then use the resulting shortening 4 -tuples to rewrite 1 Search is not goal-directed n q Ninghui Li (Purdue University) 20

Deduction Based on the Rewriting Semantics (2) n Limit to queries like “can 1 rewrite into K? ” q In [Li CSFW’ 00], the following XSB logic program is given : - table(contains/2). contains([P 0, N 0 | T], P 2) : contains([P 0, N 0], P 1), contains([P 1 | T], P 2). contains([P 0, N 0], P) : credential([P 0, N 0], CN 2), contains(CN 2, P). contains([P], P, []) : - is. Principal(P). Ninghui Li (Purdue University) 21

Deduction Based on the Rewriting Semantics (3) n [Li, Winsborough & Mitchell, CCS’ 01, JCS’ 03] q develop a graph-based search algorithm for a language RT 0, a superset of SDSI n n combines bottom-up search and goal-directed topdown search with tabling specifically for the kind of rules in RT 0 can deal with distributed discovery Ninghui Li (Purdue University) 22

Deduction Based on the Rewriting Semantics (4) n Use techniques for model checking pushdown systems [Jha & Reps CSFW’ 02] q q SDSI rewriting systems correspond to string rewriting systems modeled by pushdown systems algorithms for model checking pushdown systems can be used n takes time O(N^3), where N is the total size of the SDSI statements Ninghui Li (Purdue University) 23

SDSI and Pushdown Systems Stack: A 1 B 2. . . A 2 A 3 B 1 Apply the rewriting rule: K 1 A 1 to K 2 A 3 B 2. . . State: K 2 State: K 1 A name string corresponds to a configuration “rewrites into” equivalent to “reaches” Ninghui Li (Purdue University) 24

Recap of the Rewriting-based Semantics n n n Defines answers to queries having the form “can 1 rewrite into 2? ” Specialized algorithms (either developed for SDSI or for model checking pushdown systems) are needed Papers by Abadi and Halpern and van der Meyden try to come up with axiom systems for the rewriting semantics Ninghui Li (Purdue University) 25

Set-based Semantic Intuitions n n Each name string is bound to a set of principals (K A ) means the local name “K A” is bound to a superset of the principal set that is bound to Ninghui Li (Purdue University) 26

Defining Set-based Semantics (1) n n A valuation V maps each local name to a set of principals A valuation V can be extended to map each name string to a set of principals q V (K) = { K } q V (K A) = V (K A) q V (K B 1 … Bm) = V (Kj B 2… Bm) j = 1. . n n where m>1 and V (K B 1) = {K 1, K 2, …, Kn} Ninghui Li (Purdue University) 27

Defining Set-based Semantics (2) n n n A 4 -tuple (K A ) is the following constraint q V (K A) V ( ) The semantics of P is the least valuation VP that satisfies all the constraints Queries q n “can rewrite into K? ” answered by checking whether “K VP ( )”. Does not define answers to “can 1 rewrite into 2”. q asking whether VP ( 1) VP ( 2) is incorrect Ninghui Li (Purdue University) 28

Relationship Between the Rewriting Semantics and the Set Semantics n n Theorem: Given P, 1, and 2, 1 rewrites into 2 using P if and only if for any P’ P, VP’ ( 1) VP’ ( 2). Corrolary: Given P, , and K, rewrites into K using P if and only if VP ( ) { K } Ninghui Li (Purdue University) 29

A Logic-Programming-based Semantics Derived from the Set-based Semantics n Translate each 4 -tuple into a LP clause q q q n Using a ternary predicate m n m(K, A, K’) is true if K’ V (K A) (K A K’) to m(K, A, K’) (K A K 1 A 1) to m(K, A, ? x) : - m(K 1, A 1, ? x) (K A K 1 A 2) to m(K, A, ? x) : - m(K 1, A 1, ? y 1), m(? y 1, A 2, ? x) (K A K 1 A 2 A 3) to m(K, A, ? x) : - m(K 1, A 1, ? y 1), m(? y 1, A 2, ? y 2), m(? y 2, A 3, ? x) The minimal Herbrand model determines the semantics Ninghui Li (Purdue University) 30

An Alternative Way of Defining the LPbased Semantics (1) n Define a macro contains q contains[ ][K’] means that K’ V ( ) contains[K][K’] (K= K’) n contains[K A][K’] m(K, A, K’) n contains[K A 1 A 2 … An][K’] y (m(K, A 1, y) contains[y A 2 … An][K’]) where n>1 n Ninghui Li (Purdue University) 31

An Alternative Way of Defining the LPbased Semantics (2) n Translates a 4 -tuple (K A ) into a FOL sentence q n n z (contains[K A][z] contains[ ][z]) This sentence is also a Datalog clause A set P of 4 -tuples defines a Datalog program, denoted by SP[P] q The minimal Herbrand model of SP[P] defines the semantics Ninghui Li (Purdue University) 32

An Example of Translation From (KC access KC mit faculty secretary) to z ( contains[KC access][z] contains[KC mit faculty secretary][z] ) to z ( m(KC, access, z) y 1 (m(KC, mit, y 1) contains[y 1 faculty secretary][z] ) to z y 1 (m(KC, access, z) m(KC, mit, y 1) y 2 (m(y 1, faculty, y 2) contains[y 2 secretary] [z] ) to z y 1 y 2 (m(KC, access, z) m(KC, mit, y 1) m(y 1, faculty, y 2) m(y 2, secretary, z]) ) Ninghui Li (Purdue University) 33

Set semantics is equivalent to LP semantics n The least Herbrand model of SP[P] is equivalent to the least valuation, i. e. , q K’ VP (K A) iff. m(K, A, K’) is in the least Herbrand model of SP[P] n Same limitation as set-based semantics q does not define answers to containment between arbitrary name strings Ninghui Li (Purdue University) 34

A First-Order Logic (FOL) Semantics n n A set P of 4 -tuples defines a FOL theory, denoted by Th[P] A query is a FOL formula q q n “ 1 rewrites into 2” is translated into z (contains[ 1][z] contains[ 2][z]) Other FOL formulas can also be used as queries Logical implication determines semantics Ninghui Li (Purdue University) 35

FOL Semantics is Extension of LP Semantics n LP semantics is FOL semantics with queries limited to LP queries q m(K, A, K’) is in the least Herbrand model of SP[P] iff. Th[P] |= m(K, A, K’) Ninghui Li (Purdue University) 36

Equivalence of Rewriting Semantics and FOL Semantics n Theorem: for string rewriting queries, the string rewriting semantics is equivalent to the FOL semantics q Given a set P of 4 -tuples, it is possible to rewrite 1 into 2 using the 4 -tuples in P if and only if Th[P] |= z (contains[ 1][z] contains[ 2][z]) Ninghui Li (Purdue University) 37

Advantages of FOL semantics: Computation efficiency n A large class of queries can be answered efficiently using logic programs q q including rewriting queries e. g. , whether rewrites into K B 1 B 2 under P can be answered by determining whether SP[P (K’ A’ ) (K B 1 K’ 1) (K’ 1 B 2 K’ 2)] |= m(K’, A’, K’ 2) where K’, K’ 1, and K’ 2 are new principals n this proof procedure is sound and complete n q this result also follows from results in proof theory regarding Harrop Hereditary formulas Ninghui Li (Purdue University) 38

Advantages of FOL semantics: Extensibility n Additional kinds of queries can be formulated answered, e. g. , q n z (m(K 1, A 1, z) m(K 1, A 2, z)) z (m(K 2, A 1, z) m(K 2, A 2, z)) Additional forms of statements can be easily handled, e. g. , q (K A K 1 A 1 K 2 A 2) maps to z (m(K, A, z) m(K 1, A 1, z) m(K 2, A 2, z)) Ninghui Li (Purdue University) 39

Summary: 4 Semantics String Rewriting: Set: difficult to extend limited in queries First-Order Logic Programming Ninghui Li (Purdue University) 40

Advantages of FOL Semantics: Summary n Simple q q n Extensible q q n captures the set-based intuition defined using standard FOL additional policy language features can be handled easily allow more meaningful queries Computation efficiency Ninghui Li (Purdue University) 41