Skip to main content
SpringerLink
Log in

Efficient and flexible access control via Jones-optimal logic program specialisation

  • Published:
Higher-Order and Symbolic Computation

Abstract

We describe the use of a flexible meta-interpreter for performing access control checks on deductive databases. The meta-program is implemented in Prolog and takes as input a database and an access policy specification. For processing access control requests we specialise the meta-program for a given access policy and database by using the logen partial evaluation system. The resulting specialised control checking program is dependent solely upon dynamic information that can only be known at the time of actual access request evaluation. In addition to describing our approach, we give a number of performance measures for our implementation of an access control checker. In particular, we show that by using our approach we get flexible access control with virtually no overhead, satisfying the Jones optimality criterion. The paper also shows how to satisfy the Jones optimality criterion more generally for interpreters written in the non-ground representation.

This is a preview of subscription content, log in via an institution to check access.

Access this article

Log in via an institution

Price excludes VAT (USA)
Tax calculation will be finalised during checkout.

Instant access to the full article PDF.

Institutional subscriptions

Similar content being viewed by others

References

  1. Apt, K.R., Turini, F.: Meta-logics and Logic Programming. MIT Press, Cambridge (1995)

    Google Scholar 

  2. Baral, C., Gelfond, M.: Logic programming and knowledge representation. JLP 19/20, 73–148 (1994)

    Article  MathSciNet  Google Scholar 

  3. Barker, S.: Web usage control in RSCLP. In: Proc. 18th IFIP WG Conf. on Database Security (2004)

  4. Barker, S., Stuckey, P.: Flexible access control policy specification with constraint logic programming. ACM TISSEC 6(4), 501–546 (2003)

    Article  Google Scholar 

  5. Barker, S., Leuschel, M., Varea, M.: Efficient and flexible access control via logic program specialisation. In: PEPM’04: Proceedings of the 2004 ACM SIGPLAN Symposium on Partial Evaluation and Semantics-based Program Manipulation, New York, NY, USA, 2004, pp. 190–199. ACM Press, New York (2004)

    Chapter  Google Scholar 

  6. Bertino, E., Bettini, C., Ferrari, E., Samarati, P.: An access control model supporting periodicity constraints and temporal reasoning. ACM TODS 23(3), 231–285 (1998)

    Article  Google Scholar 

  7. Bertino, E., Catania, B., Ferrari, E., Perlasca, P.: A system to specify and manage multipolicy access control models. In: Proc. IEEE 3rd International Workshop on Policies for Distributed Systems and Networks (POLICY 2002) (2002)

  8. Bondorf, A., Palsberg, J.: Generating action compilers by partial evaluation. J. Funct. Program. 6(2) (1996)

  9. Briney, A.: Information security 2000. In: Information Security, pp. 40–68 (2000)

  10. Clark, K.: Negation as failure. In: Gallaire, H., Minker, J. (eds.) Logic and Databases, pp. 293–322. Plenum, New York (1978)

    Google Scholar 

  11. Date, C.: An Introduction to Database Systems. Addison–Wesley, Reading (2003)

    MATH  Google Scholar 

  12. Ferraiolo, D., Cugini, J., Kuhn, R.: Role-based access control (RBAC): features and motivations. In: Proc. of the 11th Annual Computer Security Applications Conf., pp. 241–248 (1995)

  13. Futamura, Y.: Partial evaluation of computation process—an approach to a compiler-compiler. Higher-Order Symb. Comput. 12(4), 381–391 (1999). Reprinted from Systems ⋅ Computers ⋅ Controls 2(5), 1971, with a foreword

    Article  MATH  Google Scholar 

  14. Gallagher, J.: Tutorial on specialisation of logic programs. In: Proceedings of PEPM’93, the ACM Sigplan Symposium on Partial Evaluation and Semantics-Based Program Manipulation, pp. 88–98. ACM Press, New York (1993)

    Chapter  Google Scholar 

  15. Gallagher, J., Bruynooghe, M.: Some low-level transformations for logic programs. In: Bruynooghe, M. (ed.) Proceedings of Meta90 Workshop on Meta Programming in Logic, Leuven, Belgium, pp. 229–244 (1990)

    Google Scholar 

  16. Grosof, B., Poon, T.: Representing agent contracts with exceptions using XML rules, ontologies and process descriptions. In: WWW 2003, pp. 340–349 (2003)

  17. Hill, P., Gallagher, J.: Meta-programming in logic programming. In: Gabbay, D.M., Hogger, C.J., Robinson, J.A. (eds.) Handbook of Logic in Artificial Intelligence and Logic Programming. Oxford Science Publications, vol. 5, pp. 421–497. Oxford University Press, London (1998)

    Google Scholar 

  18. Jajodia, S., Samarati, P., Sapino, M., Subrahmanian, V.: Flexible support for multiple access control policies. ACM TODS 26(2), 214–260 (2001)

    Article  MATH  Google Scholar 

  19. Jones, N.D.: Partial evaluation, self-application and types. In: Paterson, M.S. (ed.) Automata, Languages and Programming. LNCS, vol. 443, pp. 639–659. Springer, Berlin (1990)

    Chapter  Google Scholar 

  20. Jones, N.D., Gomard, C.K., Sestoft, P.: Partial Evaluation and Automatic Program Generation. Prentice Hall, New York (1993)

    MATH  Google Scholar 

  21. Kunen, K.: Signed data dependencies in logic programs. J. Log. Program. 7(3), 231–245 (1989)

    Article  MathSciNet  Google Scholar 

  22. Lakhotia, A., Sterling, L.: How to control unfolding when specializing interpreters. New Gener. Comput. 8, 61–70 (1990)

    Article  MATH  Google Scholar 

  23. Leuschel, M.: Homeomorphic embedding for online termination of symbolic methods. In: Mogensen, T.Æ., Schmidt, D., Sudborough, I.H. (eds.) The Essence of Computation—Essays Dedicated to Neil Jones. LNCS, vol. 2566, pp. 379–403. Springer, Berlin (2002)

    Google Scholar 

  24. Leuschel, M., Bruynooghe, M.: Logic program specialisation through partial deduction: Control issues. Theory Practice Log. Program. 2(4–5), 461–515 (2002)

    Article  MATH  MathSciNet  Google Scholar 

  25. Leuschel, M., Schreye, D.D.: Creating specialised integrity checks through partial evaluation of meta-interpreters. JLP 36(1), 149–193 (1998)

    Article  MATH  Google Scholar 

  26. Leuschel, M., Martens, B., De Schreye, D.: Controlling generalisation and polyvariance in partial deduction of normal logic programs. ACM Trans. Program. Lang. Syst. 20(1), 208–258 (1998)

    Article  Google Scholar 

  27. Leuschel, M., Craig, S., Bruynooghe, M., Vanhoof, W.: Specializing interpreters using offline partial deduction. In: Bruynooghe, M., Lau, K.-K. (eds.) Program Development in Computational Logic. LNCS, vol. 3049, pp. 341–376. Springer, Berlin (2004)

    Google Scholar 

  28. Leuschel, M., Jørgensen, J., VanHoof, W., Bruynooghe, M.: Offline specialisation in Prolog using a hand-written compiler generator. TPLP 4(1), 139–191 (2004)

    MATH  Google Scholar 

  29. Lloyd, J.W.: Foundations of Logic Programming. Springer, Berlin (1987)

    MATH  Google Scholar 

  30. Makholm, H.: On Jones-optimal specialization for strongly typed languages. In: Taha, W. (ed.) Semantics, Applications, and Implementation of Program Generation. LNCS, vol. 1924, pp. 129–148. Springer, Berlin (2000)

    Chapter  Google Scholar 

  31. Martens, B.: On the semantics of meta-programming and the control of partial deduction in logic programming. PhD thesis, K.U. Leuven (February 1994)

  32. Martens, B., Gallagher, J.: Ensuring global termination of partial deduction while allowing flexible polyvariance. In: Sterling, L. (ed.) Proceedings ICLP’95, Kanagawa Japan, June 1995, pp. 597–613. MIT Press, Cambridge (1995)

    Google Scholar 

  33. NIST: The economic impact of role-based access control. NIST Planning Report 02-01 (2002)

  34. Przymusinski, T.: On the declarative semantics of deductive databases and logic programming. In: Minker, J. (ed.) Foundations of Deductive Databases and Logic Programming, pp. 193–216. Morgan Kaufmann, San Mateo (1988)

    Google Scholar 

  35. Sagonas, K., Swift, T., Warren, D.S.: XSB as an efficient deductive database engine. In: Proceedings of the ACM SIGMOD International Conference on the Management of Data, Minneapolis, Minnesota, May 1994, pp. 442–453. ACM Press, New York (1994)

    Google Scholar 

  36. Sahlin, D.: Mixtus: an automatic partial evaluator for full prolog. New Gener. Comput. 12(1), 7–51 (1993)

    MATH  Google Scholar 

  37. Sandhu, R., Ferraiolo, D., Kuhn, R.: The NIST model for role-based access control: towards a unified standard. In: Proc. 4th ACM Workshop on Role-Based Access Control, pp. 47–61 (2000)

  38. SETA: A marketing survey of civil federal government organizations to determine the need for RBAC security product. SETA Corporation (1996)

  39. Vanhoof, W., Martens, B.: To parse or not to parse. In: Fuchs, N. (ed.) Logic Program Synthesis and Transformation, Proceedings of LOPSTR’97, Leuven, Belgium, July 1997. LNCS, vol. 1463, pp. 322–342. Springer, Berlin (1997)

    Chapter  Google Scholar 

Download references

Author information

Authors and Affiliations

  1. Department of Computer Science, King’s College, London, WC2R 2LS, UK

    Steve Barker

  2. Institut für Informatik, Heinrich-Heine-Universität Düsseldorf, Universitätsstr. 1, 40225, Düsseldorf, Germany

    Michael Leuschel

  3. School of Electronics and Computer Science, University of Southampton, Highfield, SO17 1BJ, UK

    Mauricio Varea

Authors
  1. Steve Barker
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Michael Leuschel
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Mauricio Varea
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Michael Leuschel.

Additional information

Work partially supported by European Framework 5 Project ASAP (IST-2001-38059). This paper is revised and extended version of [5], incorporating some material from [27].

Rights and permissions

Reprints and permissions

About this article

Cite this article

Barker, S., Leuschel, M. & Varea, M. Efficient and flexible access control via Jones-optimal logic program specialisation. Higher-Order Symb Comput 21, 5–35 (2008). https://doi.org/10.1007/s10990-008-9030-8

Download citation

  • Published:

  • Issue Date:

  • DOI: https://doi.org/10.1007/s10990-008-9030-8

Keywords

Search

Navigation