Marcos Cramer, Zohreh Baniasadi, Pieter Van Hertum
In ownership-based access control frameworks with the possibility of delegating permissions and administrative rights, delegation chains will form. There are different ways to treat delegation chains when revoking rights, which give rise to different revocation schemes. In this paper, we investigate the problem of delegation revocation from the perspective of the knowledge base paradigm. A knowledge base is a formal specification of domain knowledge in a rich formal language. Multiple forms of inference can be applied to this formal specification in order to solve various problems and tasks that arise in the domain. In other words, the paradigm proposes a strict separation of concerns between information and problem solving. The knowledge base that we use in this paper specifies the effects of the various revocation schemes. By applying different inferences to this knowledge base, we can solve the following tasks: to determine the state of the system after a certain delegation or revocation; to interactively simulate the progression of the system state through time; to determine whether a user has a certain permission or administrative right given a certain state of the system; to verify invariants of the system; and to determine which revocation schemes give rise to a certain specified set of desired outcomes.