动态授权的类型化模型
A Typed Model for Dynamic Authorizations
摘要：
分布式软件系统中的安全需求是动态的。在授权策略的情况下，资源意味着仅由授权方访问，但是访问资源的授权可以动态地授予/放弃。我们描述了正在进行的工作，指定通信和动态授权处理的模型。我们建立在π演算，以丰富基于通信的系统与授权规范和委托，这里授权考虑通道的使用和委托是指产生授权给另一方的行为。我们的模型包括：（i）用于授权的新颖的范围构造，其允许指定授权边界，以及（ii）用于授权的通信原语，其允许传递授权以在给定信道上动作。授权错误可能包括，例如，使用不在适当授权范围内的名称执行操作。我们引入了一个类型的纪律，确保流程永远不会减少到授权错误，即使授权是动态委托。
英文摘要：
Security requirements in distributed software systems are inherently dynamic. In the case of authorization policies, resources are meant to be accessed only by authorized parties, but the authorization to access a resource may be dynamically granted/yielded. We describe ongoing work on a model for specifying communication and dynamic authorization handling. We build upon the pi-calculus so as to enrich communication-based systems with authorization specification and delegation; here authorizations regard channel usage and delegation refers to the act of yielding an authorization to another party. Our model includes: (i) a novel scoping construct for authorization, which allows to specify authorization boundaries, and (ii) communication primitives for authorizations, which allow to pass around authorizations to act on a given channel. An authorization error may consist in, e.g., performing an action along a name which is not under an appropriate authorization scope. We introduce a typing discipline that ensures that processes never reduce to authorization errors, even when authorizations are dynamically delegated.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
