Cassandra: Flexible Trust Management, Applied to Electronic Health Records

We study the specification of access control policy in large-scale distributed systems. We present Cassandra, a language and system for expressing policy, and the results of a substantial case study, a security policy for a national Electronic Health Record system, based on the requirements for the ongoing UK National Health Service procurement exercise. Cassandra policies are expressed in a language based on Datalog with constraints. The expressiveness of the language (and its computational complexity) can be tuned by choosing an appropriate constraint domain. Cassandra is role-based; it supports credential-based access control (e.g. between administrative domains); and rules can refer to remote policies (for automatic credential retrieval and trust negotiation). Moreover, the policy language is small, and it has a formal semantics for query evaluation and for the access control engine. For the case study we choose a constraint domain C0 that is sufficiently expressive to encode many...

• Type: Conference
• Year: 2004
• Where: CSFW
• Authors: Moritz Y. Becker, Peter Sewell
• Keywords: Access Control, Case Study, Constraint Domain, CSFW 2004, Security Privacy