Abstract:Role-Based Access Control (RBAC) has been recognized as a strategy which reduces the cost and complexity of security administration in large-scale networked applications. A general family of RBAC models called RBAC96 was proposed by Sandhu et al. [1], which formally deflnes the relations among user, role and permission using the notion of set membership. Constraints is an important aspect of RBAC, which impose restrictions on acceptable conflgurations of the difierent components of RBAC. Nevertheless, it was discussed informally in the RBAC96 model. There has been some efiorts to present a logical framework for the access control models. Most of these works are based on flrst-order logic or its extensions. However, excessively rich expressiveness may bring on complex computation and confusion. We present a novel formalization of RBAC using a description logic approach. Compared with flrst-order logic, DLs achieve a better tradeofi between the computational complexity of reasoning and the expressiveness of the language. We choose the DL language ALC to represent core and hierarchical RBAC, and ALCQ that extends ALC by qualifled number restrictions to express RBAC constraints, including separation of duty and role cardinality. Based on our logical framework it is feasible to reason about RBAC and check the consistency of RBAC with constraints via a DL reasoner(e.g. RACER).

Alc(P)(U): An Integration Of Description Logic And General Rules

The expressive language ALCNHR+K(D) for knowledge reasoning

Product Knowledge Reasoning

The Datalog(Dl) Combination Of Deduction Rules And Description Logics

DatalogDL: Datalog Rules Parameterized by Description Logics

Non-distributive description logic

An extended description logic system with knowledge element based on ALC

A Fuzzy Extension of ALC with Fuzzy Modifiers

The completeness of reasoning algorithms for clause sets in description logic ALC

Paraconsistent Reasoning With Quasi-Classical Semantic In Alc

Query answering in lattice-based description logic

Using Description Logic to Formalize Role-Based Access Control Model.

Description Logics with Abstraction and Refinement

Integrating Logic Rules with Everything Else, Seamlessly

Rule Extraction in Combining Description Logics with DL-safe Rules

A connection method for a defeasible extension of $\mathcal{ALCH}$

Reasoning with Very Expressive Fuzzy Description Logics

Nominals, Inverses, Counting, and Conjunctive Queries or: Why Infinity is your Friend!

A set-theoretical approach for ABox reasoning services (Extended Version)

Combining Proofs for Description Logic and Concrete Domain Reasoning (Technical Report)

Reasoner = Logical Calculus + Rule Engine