Authorization by Documents

• Sato Hiroyuki

  The University of Tokyo

Abstract

These days, ICT service environments have dramatically changed in their complexity. Accordingly, related business logics for business processes such as provisioning, resource limit, conditional authorization and delegation have grown in its complexity. In this paper, we generalize the idea of access tokens of OAuth, and propose “authorization by documents.” In our model, a user submits a document as evidence of privilege claim, and a server verifies the document to prove the appropriateness of the user's privilege. A document can be complicated, reflecting some business flow in an institution. If the process and result of business flow are expressed by using documents, the evidence as documents can reflect arbitrarily complex business flow. For this purpose, we formalize documents, and define document tree logic (DTL) as a variant of CTL* to express the policies associated with documents. Typical business processes including request and approval, delegation, and approval by document circular are expressed in DTL, and verified by using documents as evidence.

Journal

• Journal of Information Processing

  Journal of Information Processing 25 (0), 766-774, 2017

  Information Processing Society of Japan

Keywords

• documents
• policies
• authorization
• verification
• document tree logic
• provisioning
• delegation

Details

• CRID: 1390282680270849536
• NII Article ID: 130005990934
• DOI: 10.2197/ipsjjip.25.766
• ISSN: 18826652
• Web Site: https://www.jstage.jst.go.jp/article/ipsjjip/25/0/25_766/_pdf
• Text Lang: en
• Data Source:
  • JaLC
  • Crossref
  • CiNii Articles
  • KAKEN
• Abstract License Flag: Disallowed