Method and apparatus for compliance checking in a trust-management system

A method of compliance checking in a trust-management system, comprising:

• a) receiving a request;
• b) receiving a policy associated with the request;
• c) receiving a number of credentials, the policies and credentials comprising a number of monotonic, authentic, and locally bounded assertions;
• and
• d) deciding whether the credentials prove that the request complies with the policy.

A method of compliance checking in a trust-management system, comprising:

• receiving (i) a request r to perform an action R and (ii) assertions (ƒ0, POLICY), (ƒ1, si), . . . , (ƒn-1, sn-1);
• executing, mn times, assertion (ƒi, si) for each integer i from n−1 to 0, the execution being performed using any information generated by previously executed assertions, m representing a number greater than 1;
• and
• determining if (0, POLICY, R) has been generated.

A trust management platform, comprising:

• an input port configured to receive a request, a policy assertion (ƒ0, POLICY), and credential assertions (ƒ1, s1), . . . , (ƒn-1, sn-1), each credential assertion comprising a credential function ƒi and a credential source si;
• and
• a compliance checking unit coupled to said input port and configured to:
• a) initialize an acceptance record set S to {(Λ, Λ, R)}, where Λ represents a distinguished null string and R represents information corresponding with the request,
• b) run assertion (ƒi, si) on the acceptance set S for each integer i from n−1 to 0 and add the result of each assertion (ƒi, si) to the acceptance record set S,
• c) repeat step (b) mn times, where m represents a number greater than 1, and
• d) determine if acceptance record set S includes an acceptance record (0, POLICY, R).

A medium storing instructions adapted to be executed by a processor to perform steps including:

• a) receiving a request r, a policy assertion (ƒ0, POLICY) associated with the request r, and n−1 credential assertions (ƒ1, s1), . . . , (ƒn-1, sn-1) each credential assertion comprising a credential function ƒi and a credential source si;
• b) initializing an acceptance record set S to {(Λ, Λ, R)}, where Λ represents a distinguished null string and R represents the request r,
• c) running assertion (fi, si) on the acceptance set S for each integer i from n−1 to 0 and adding the result of each assertion (ƒi, si) to the acceptance record set S;
• d) repeating step (c) mn times, where m represents a number greater than 1;
• and
• e) determining whether the acceptance record set S includes (0, POLICY, R).

A method of compliance checking in a trust-management system, comprising:

• a) receiving a request r, a policy assertion (ƒ0, POLICY) associated with the request r, and n−1 credential assertions (ƒ1, s1), . . . , (ƒn-1, sn-1), each credential assertion comprising a credential function ƒi and a credential source si;
• b) initializing an acceptance record set S to {(Λ, Λ, R)}, where Λ represents a distinguished null string and R represents the request r;
• c) for each integer i from n−1 to 0:
• running assertion (ƒi, si) against the acceptance set S and adding the result to the acceptance record set S,
• determining if the acceptance record set includes (0, POLICY, R), and
• if the acceptance record set includes (0, POLICY, R), then stopping said method;
• and
• d) repeating step (c) mn times, where m represents a number greater than 1.

A method of compliance checking in a trust-management system, comprising:

• a) receiving credential assertions (ƒ1, s1), . . . , (ƒn-1, sn-1), each credential assertion comprising a credential function ƒi and a credential source si;
• b) initializing an acceptance record set S to {(Λ, R) }, where Λ represents an empty portion of the acceptance record set S, and R represents a request;
• c) running assertion (ƒi, si) on the acceptance set S for each integer i from n−1 to 0 and adding the result of each assertion (ƒi, si) to the acceptance record set S;
• d) repeating step (c) mn times, where m represents a number greater than 1.