1 Reasoning about Joint Administration of Access Policies for Coalition Resources

We argue that joint administration of access polic ies for a dynamic coalition formed by autonomous domains requires that these domains set up a central author ity that distributes threshold attribute certificat es authorizing access to policy objects (e.g., ACLs). Joint author ity over the issuance of such certificates is retai ned by member domains separately holding shares of the central au thority's private key with which they sign the thre shold attribute certificates. Hence, neither the central authority nor any (proper) subset of the member domains need be trusted to protect the private key. However, application serve rs that implement joint administration of access po licies based on threshold attribute certificates must trust all the signers of those certificates, namely all member d omains of the coalition. To capture these trust relations we ext end existing access control logics and show that th e extensions are sound. To reason about joint administration of acce ss policies, we illustrate an authorization protoco l in our logic for accessing policy objects using threshold attrib ute certificates.