Distributed System Security via Logical Frameworks

We describe a project to advance security in distributed systems via the application of logical frameworks. At the heart of the effort lies an authorization logic which plays a triple role: (1) to specify an access-control policy as a logical theory, (2) to enforce the policy by mechanically verifying proofs in the logic, and (3) to reason about the policy by characterizing the space of all possible proofs. We are deploying a security infrastructure based on these ideas using mobile phones as a universal access-control device at Carnegie Mellon University. ACM subject classifiers: C.2.0 General—Security and protection; D.4.6 Security and Protection—Access controls; F.4.1 Mathematical Logic—Computational Logic; K.6.5 Security and Protection—Authentication