A Logic Model for Temporal Authorization Delegation with Negation

In this paper, we present a logic based approach to temporal decentralized authorization administration that supports time constrained authorization delegations, both positive and negative authorizations, and implicit authorizations. A set of domain-independent rules are given to capture the features of temporal delegation correctness, temporal conflict resolution and temporal authorization propagation along the hierarchies of subjects, objects and access rights. The basic idea is to combine these general rules with a set of domain-specific rules defined by users to derive the authorizations holding at any time in the system. In addition, some important semantic properties including the unique answer set property are further investigated.