BIB-VERSION:: CS-TR-v2.0
ID:: ncstrl.dartmouthcs//TR99-361
ENTRY:: November 22, 1999
ORGANIZATION:: Dartmouth College, Computer Science
TITLE:: An Access-Control Calculus for Spanning Administrative Domains
TYPE:: Technical Report (paper)
REVISION:: 3
AUTHOR:: Howell, Jon
AUTHOR:: Kotz, David
DATE:: November 1999
RETRIEVAL:: For a paper copy, email <reports@cs.dartmouth.edu>
RETRIEVAL:: For a paper copy, write to
       Technical Report Librarian
       Department of Computer Science
       Dartmouth College
       6211 Sudikoff Laboratory
       Hanover, NH 03755-3510
       USA
RETRIEVAL:: Compressed Postscript at http://www.cs.dartmouth.edu/reports/TR99-361.ps.Z
RETRIEVAL:: PDF at http://www.cs.dartmouth.edu/reports/TR99-361.pdf
ABSTRACT:: 
 In our quest to give users uniform access to resources
unimpeded by administrative boundaries, we discovered that we
needed transitive sharing among users, with the possibility of
restricted access along each sharing link.  To achieve that
goal, we extend Lampson et al.'s calculus for access control to
support restricted delegations.
 We discuss the advantages of our extension, including the
simplification of constructs like ACLs and statement
expiration. We also apply our extension to model the Simple
Public Key Infrastructure and make suggestions about its future
development.  Our extended calculus exposes some surprising
consequences in such systems that use restricted delegation.
NOTE::
Superceded by TR2000-363.
END:: ncstrl.dartmouthcs//TR99-361