Distributed programming with distributed authorization

We propose a programming language, called PCML5, for building distributed applications with distributed access control. Target applications include web-based systems in which programs must compute with stipulated resources at different sites. In such a setting, access control policies are decentralized (each site may impose restrictions on access to its resources without the knowledge of or cooperation with other sites) and spatially distributed (each site may store its policies locally). To enforce such policies PCML5 employs a distributed proof-carrying authorization framework in which sensitive resources are governed by reference monitors that authenticate principals and demand logical proofs of compliance with site-specific access control policies. The language provides primitive operations for authentication, and acquisition of proofs from local policies. The type system of PCML5 enforces locality restrictions on resources, ensuring that they can only be accessed from the site a...

• Type: Conference
• Year: 2010
• Where: TLDI
• Authors: Kumar Avijit, Anupam Datta, Robert Harper
• Keywords: Access Control Policies, Distributed Access Control, Distributed Proof-carrying Authorization, Formal Methods, TLDI 2010