Efficient proving for distributed access-control systems

We present a new algorithm for generating a formal proof that an access request satisfies access-control policy, for use in logic-based access-control frameworks. Our algorithm is tailored to settingswhere credentials needed to complete a proof might need to be obtained from, or reactively createdby, distant components in a distributed system. In such contexts, our algorithm substantially improvesupon previous proposals in both computation and communication costs, and better guides users to createthe most appropriate credentials in those cases where needed credentials do not yet exist. At the sametime, our algorithm offers strictly superior proving ability, in the sense that it finds a proof in everycase that previous approaches would (and more). We detail our algorithm and empirically evaluate animplementation of it using policies in active use in a testbed at our institution for experimenting withaccess-control technologies.