Séminaire Zenith: vendredi 2 déc. 10h30, salle 3/124 bat. 5
A Formal Study of Collaborative Access Control in Distributed Datalog
Pierre Bourhis
CNRS et Inria Lille
We formalize and study a declaratively specified collaborative access control mechanism for data
dissemination in a distributed environment. Data dissemination is specified using distributed
datalog. Access control is also defined by datalog-style rules, at the relation level for extensional
relations, and at the tuple level for intensional ones, based on the derivation of tuples. The model
also includes a mechanism for “declassifying” data, that allows circumventing overly restrictive
access control. We consider the complexity of determining whether a peer is allowed to access
a given fact, and address the problem of achieving the goal of disseminating certain information
under some access control policy. We also investigate the problem of information leakage, which
occurs when a peer is able to infer facts to which the peer is not allowed access by the policy.
Finally, we consider access control extended to facts equipped with provenance information,
motivated by the many applications where such information is required. We provide semantics
for access control with provenance, and establish the complexity of determining whether a peer
may access a given fact together with its provenance. This work is motivated by the access
control of the Webdamlog system, whose core features it formalizes.
