The Center for Education and Research in Information Assurance and Security (CERIAS)

The Center for Education and Research in
Information Assurance and Security (CERIAS)

Dr. William H. Winsborough - George Mason University

Students: Spring 2023, unless noted otherwise, sessions will be virtual on Zoom.

Specification and Management of Attribute-based Authorization Policy

Oct 08, 2003


An approach to authorization that is based on attributes of the resource requester provides flexibility and scalability that is essential in the context of large distributed systems. Logic programming provides an elegant, expressive, and well-understood framework in which to work with attribute-based authorization policy. This talk will summarize one specific attribute-based authorization framework built on logic programming: RT, a family of Role-based Trust-management languages. RT's logic programming foundation has facilitated the conception and specification of several extensions that greatly enhance its expressivity with respect to important security concepts such as parameterized roles, thresholds, and separation of duties. After examining language design issues, the talk will consider the problem of assessing authorization policies with respect to vulnerability of resource owners to a variety of security risks due to delegations to other principals, risks such as undesired authorizations and unavailability of critical resources. We will consider several such properties of RT policies, many of which we will see can be decided efficiently. For other properties, we will see that the complexity depends on the subset of RT in which the policy is expressed. The research is joint work with Professor Ninghui Li of Purdue University and Professor John C. Mitchell of Stanford University. The talk will conclude by discussing some prospects for continued research in this area.

About the Speaker

William H. Winsborough received his PhD at the University of Wisconsin-Madison in 1989. He recently joined the Center for Secure Information Systems at George Mason University as a Research Associate Professor. In the intervening years his affiliations included the University of Chicago, Argonne National Laboratory, Penn State University, Transarc Corporation, IBM, and Network Associates Laboratories.

Dr. Winsborough\'s research interests include computer security, authorization, trust management, trust negotiation, and release control, as well as programming languages, program analysis, language implementation technologies, and programming-support tools. He is the author of about 30 refereed research articles and papers, and he has served on the program committee of various conferences and workshops (including the International Symposium on Programming Languages: Implementations, Logics and Programs (PLILP), Static Analysis Symposium (SAS), IEEE International Workshop on Policies for Distributed Systems and Networks) and as a reviewer for many journals. Two patents have been awarded based on Dr. Winsborough\'s research, and he received a DARPA award for Excellence in Industrial Research in 2003. Dr. Winsborough will be an invited speaker at the 2003 International Logic Programming Conference in Mumbay, India.

Ways to Watch


Watch Now!

Over 500 videos of our weekly seminar and symposia keynotes are available on our YouTube Channel. Also check out Spaf's YouTube Channel. Subscribe today!