Gilles Olive
email: gilles.olive@excite.com

Antal Rockenbauer

Xavier Rozanska

Alain Jacques

Daniel Peeters

Anton German

Synthesis of New Tetraethyl(N-alkyl-1-aminoethan-1,1diyl)bisphosphonates and ESR Analysis of Chemical Exchange of Derived Nitroxides of Acyclic Aminobisphosphonates

Keywords: Bisphosphonates, diphosphorylation, ESR, nitroxide, theoretical calculations, McConnell equation

come

INTRODUCTION

The radical polymerization has interesting property as it is more tolerant towards trace impurities than ionic or coordination polymerization. [START_REF] Moad | The chemistry of Free Radical Polymerization[END_REF] It requires absence of oxygen but can be carried out in the presence of water. [START_REF] Matyjaszewski | [END_REF] Unfortunately, the control over the macromolecules is worse in radical polymerization than in ionic polymerization. [START_REF] Matyjaszewski | [END_REF] To increase the polymerization control, the use of nitroxides has been suggested. [START_REF] Moad | The chemistry of Free Radical Polymerization[END_REF] Nitroxyl radicals are observed to result in a better control of the molecular weight, polydispersity and termination processes. The action of a nitroxyl radical occurs through a reversible coupling between the nitroxide and the growing polymeric chain. (Scheme 1)

Insert scheme 1

To clarify the role of nitroxyl radical in the polymerization process, some information about its conformational behavior needs to be known. We have already demonstrated it for geminally diphosphorylated pyrrolidinoxyl radicals [3] where the combination of ring pseudorotation with the internal rotation of phosphoryl groups produces at least four nonequivalent sites.

In this paper, we describe the synthesis of two new bisphosphonates, namely the tetraethyl(Ntertbutyl-1-aminoethan-1,1-diyl)bisphosphonate 1 and the tetraethyl(N-secbutyl-1aminoethan-1,1-diyl)bisphosphonate 2 molecules (Scheme 2) and perform the full ESR [START_REF] Weil | Electron Paramagnetic Resonance -Elementary Theory and Practical Applications[END_REF] analysis of the chemical exchange of various nitroxides formed from the oxidation of 1 and 2.

(Scheme 2)

Insert Scheme 2

RESULTS AND DISCUSSION

Synthesis

The synthesis of 1 and 2 is described in Scheme 3. It uses a one step reaction that has been described elsewhere. [START_REF] Olive | [END_REF][6][START_REF] Olive | Phosphorus, Sulfur[END_REF] At -7.5 °C under nitrogen atmosphere POCl3 (2 mol.) is slowly added to a mixture of the corresponding amide (1 mol. eq) and triethylphosphite (2 mol. eq).

After stirring the mixture for one hour at room temperature, it is poured over a cold aqueous solution saturated with NH4OH. After work-up, the corresponding aminobisphosphonates are obtained with several yields. (Table I) Compounds 3 and 4 are prepared using the procedure of Lessard [8] and of Sagar [9] , respectively.

Insert Scheme 3

Insert Table I Using the same procedure, Grimaldi [10] prepared the tetraethyl N-tertbutyl aminomethylene bisphosphonate 5 with a yield of 56%. Compared to 1 and 2, which have one additional methyl group on the carbon bearing the two phosphonate groups, the yield is twice higher with 5.

ESR Study

Analysis of the radical derived from 1

The main lines of the spectra can be interpreted as a doublet of a triplet (AP = 53.2 G, AN = 13.8 G) and all lines show a further small doublet with a AX=1.7 G coupling (Figure 1). Even at high temperature, there is no sign of line width alternation (LWA). In principle, this lack and the very small second phosphorus coupling could be explained by a rigid geometry.

However, this contradicts our observations for other geminally diphosphorylated nitroxide radicals where a chemical exchange always occurs. No other example with the phosphorus in beta position can be found in the literature where the coupling is smaller than 20 G, which fact is caused by the anomeric effect stabilizing the axial preference of the CP bond. Furthermore, the spectra contain additional satellites of low intensity that can be attributed to a radical with two phosphorus couplings of 40 G on average; the lines reveal the usual LWA.

The major product is thus assigned to a mono-phosphorylated radical (1aNO), whereas the satellites are interpreted as the lines of the radical (1bNO). The assignment of 1aNO is supported by the small coupling of 1.7 G typical for N-methin hydrogen. This attribution is sustained by the appearance of the impurity lines present in the spectra of the nitroxide obtained by the oxidation of 5 in pentane, which have parameters similar to the major product in the spectra of 1. A computer simulation of the alternating lines [11] from 1bNO gives data as A N = 14.1 G, A P ' = 55.2 G, A P " = 14.5 G, τ = 0.525 ns (exchange time at 293 K) and ∆E = 15 kJ/mol (potential barrier computed from the slope on the Arrhenius plot (not shown)).

Using the simplified McConnell equation [12] (A p = B p cos 2 θ (Scheme 4) and A H = B H cos 2 θ, with B p = 56 G and B H = 24 G for linear nitroxide [13] ) we found θ P = 12.9° and θ H = 72.9° for 1aNO, θ P ' < 6° and θ P " = 59.4° for 1bNO.

Insert Scheme 4

Insert Figure 1 A more elaborate study of this thermal evolution and a discussion of the coalescences and the frozen states will be published elsewhere.

Analysis of the radical derived from 2 [14] Above room temperature, the ESR spectra show nine major lines (See Figure 9 in ref [14] and Insert Figure 2 A significant line broadening is noticed at lower temperatures; the corresponding two coalescences happen below 333 K and at 293 K in toluene, below 343 K and at 283 K in dichloromethane (Figure 2). Starting from 213 K in toluene and 203 K in dichloromethane, the spectra have an anisotropic behavior due to the presence of frozen conformers.

In order to see small coupling, new experiments using pump-freeze cycle instead bubbling helium, as well as new oxidants reagents (like lead dioxide or silver dioxide) will be carried out.

Theoretical calculations

Many simulations were performed to analyze the ESR spectra. All simulated spectra show a perfect fit with the experimental ones. However their interpretation is more complicated.

The presence of two different phosphorus atoms allows to determine separately B 0 and B 2 in the dihedral relation of McConnell [12] by analysis of P-hfs couplings, if the Θ PCP angle is known [14] B 0 and B 2 are estimated to be 25 and 35 G, respectively if Θ = 120°. B 0 describes direct and indirect polarization, and B 2 describes hyperconjugation. [15] This contradicts the values of B 0 = 0 and B 2 = 60 G that were proposed by Tordo et al. indicating a significant angular distortion of the PCP group. [14] According to quantum chemical computations, B 0 should actually be small, i.e., never larger than 6 G. [16] To investigate an alternative possibility causing anomalous B 0 and B 2 values, we performed several ab initio calculations on model molecules similar to 1bNO and 2NO using the Gaussian 98 [17] software. Model molecules are CH 3 -NO-CH 2 -PO 3 H 2 6, CH 3 -NO-CH 2 -PO 3 (CH 3 ) 2 7 for monophosphonated species and CH 3 -NO-CH-(PO 3 H 2 ) 2 8 for diphosphonated species. All results were obtained after full optimization at UHF(6-31G) level but constraining the value of the dihedral angle θ. [18,19] In 6, the PO 3 H 2 hydrogen atoms were oriented to avoid hydrogen bonding with the NO oxygen. This configuration was maintained in all the compounds. The second molecule was studied in order to establish that the previous results are independent of the nature of the substituents.

The preliminary results show that i) B 0 is generally small, ii) the values of the energy or of the spin density at 0° and 180° and at 90° and 270° are slightly different, iii) the results for 6 and 7 are very similar, and iv) in case of two (PO 3 H 2 ) groups (compound 8), result ii) is more important (Figure 3) and the behavior of the two groups is sensibly different, leading to different B 0 and B 2 in the McConell relation (compared to monophosphonated species).

Insert Figure 3 These results are in agreement with a model in which B 2 is different for the angles larger than 90 °. This model can explain the discrepancies of P coupling for the diphosphorus compound even if small B 0 is assumed. Since the B 2 asymmetry is supposed to be related to the level of pyramidal distortion, it was interesting to look into this property. Three angles -the valence angles (C(H 3 )-N-O (A 1 ) and C(P)-N-O (A 2 ) completed by the elevation angle at the O atom above the CNC plane (B) -are reported here for the most stable structures: The model we developed [14] is now supported by the quantum chemical calculations.

Ab initio calculations on 1bNO and 2NO are under way and all relevant results will be published in a forthcoming paper.

CONCLUSION

In this paper we have described the synthesis and the full characterization of two new linear bisphosphonates and the preliminary results of the analysis of the ESR spectra of the corresponding nitroxides. We also report the results of theoretical calculations on model compounds. With this approach we can claim that B 0 is generally small and that the results of bisphosphonate ester and bisphosphonic acid are similar. Because of the asymmetry, at 0° and 180° for example, the constants in the McConnell relation are different in the case of mono and diphosphorylated species. For diphosphonate molecules, the constant for the simplified relation must be determined. The discrepancies of P coupling for the diphosphorus compound stems from B 2 that is different when the sign of dihedral angle is changed.

EXPERIMENTAL

NMR spectra were acquired on a Bruker AM 400 ( 1 H, 400 MHz; 13 C, 100.61 MHz; 31 P, 161.98 MHz) spectrometer. The chemical shifts (δ) are given in ppm and referred to internal TMS for 1 H and 13 C and to external 85 % H3PO4 for 31 P. 15 N NMR spectra were recorded on a Varian Inova 500 at 50.649 MHz (Inverse gated method) and the δ values in ppm are referred to external CD3NO2. All J values are given in Hz. Elemental analyses were performed at the Eindhoven University of Technology. UV spectra were acquired on a HP 8453 UV-Vis spectrophotometer. IR spectra were acquired on a Mattson Polaris spectrophotometer. Raman spectra were acquired on a Labram Dilor spectrophotometer. Index of refraction were determined on an Atago refractometer at 20 °C. ESR measurements were performed on a Bruker ESP 300E spectrometer equipped with a X-band resonator (9.41 GHz). All ESR spectra were recorded at 100 kHz magnetic field modulation. Solvents were purchased from Biosolve. Phosphorus oxychloride, ammonia solution (ca. 28-30 %), hydrochloric solution (ca 32 %), triethyl phosphite and all compounds for the synthesis of 3 and 4 were used as purchased from Aldrich. m-CPBA (m-chloroperbenzoic acid) (70-75 %) was used as purchased from Acros. Sodium hydroxide was used as purchased from Fluka.

General procedure

In a double walled flask, under nitrogen, phosphorus oxychloride (20 mL, 0.22 mol) was added during 1 h to a mixture at -7.5 °C of amide 3 or 4 (0.11 mol) and triethylphosphite (34.9 g, 0.21 mol). The reaction mixture was stirred for 1 h at room temperature and then poured over a mixture of ice (200 g) and ammonia 30 % (400 mL). The aqueous layer was extracted with methylene chloride (3 x 100 mL) and then the latter was removed to obtain a yellow oil. The oil was dissolved in 100 mL of methylene chloride. An aqueous solution of hydrochloric acid (10 mL of 32 % HCl solution, 190 mL of water) was added (pH 1) and the aqueous layer was washed with methylene chloride (3 x 100 mL). A solution of sodium hydroxide (20 g of NaOH in 200 mL of water) was added up to pH 10 and the aqueous layer was extracted with methylene chloride (4 x 100 mL). The organic layer was dried over sodium sulfate and filtered. Removal of the solvent afforded 1 or 2.

Tetraethyl(N-tertbutyl-1-aminoethan-1,1-diyl)bisphosphonate 1 (11.3 g, 29 %). [START_REF] Moad | The chemistry of Free Radical Polymerization[END_REF] H NMR (CDCl3): δ 1.24 (s, 9H, CH3C), 1.33 (t, J = 7.0, 12H, CH3CH2O), 1.74 (t, J = 18.4, 3H, CH3CP2), 2.70 (s, 1H, NH), 4.1-4.3 (m, 8H, CH3CH2O). 13 C NMR (CDCl3): δ 15.8 (t, J = 5.5, CH3CP2), 16.3 (t, J = 3.5, CH3CH2O), 32.4 (CH3C), 52.6 (t, J = 5.7, CH3C), 58.9 (t, J = 145.0, CP2), 62.5 (t, J = 4.1, CH3CH2O), 64.0 (t, J = 3.7, CH3CH2O). 31 P NMR (CDCl3): δ 22.5. 15 Tetraethyl(N-secbutyl-1-aminoethan-1,1-diyl)bisphosphonate 2 (9.0 g, 23 %). [START_REF] Moad | The chemistry of Free Radical Polymerization[END_REF] H NMR (CDCl3): δ 0.68 (t, J = 7.4, 3H, CH3CH2CH), 0.87 (d, J = 6.4, 3H, CH3CH), 1.05 (m, 1H, CH3CHaHbCH), 1.15 (t, J = 7.2, 12H, CH3CH2O), 1.35 (m, 1H, CH3CHaHbCH), 1.41 (t, J = 17.4, 3H, CH3CP2), 2.9 (m, 1H, CHN), 4.02 (m, 8H, CH3CH2O). 13 C NMR (CDCl3): δ 10.1 (CH3CH), 15.6 (t, J = 4.2, CH3CP2), 16.2 (t, J = 3.0, CH3CH2O), 22.3 (CH3CH2CH), 32.1 (CH3CH2CH), 48.4 (t, J = 6.1, CHN), 57.5 (t, J = 143.0, CP2), 62.3 (t, J = 3.8, CH3CH2O), 63.2 (t, J = 3.8, CH3CH2O). 31 P NMR (CDCl3): δ 23.3. 15

ESR Study of Nitroxides 1aNO, 1bNO and 2NO

Compounds 1 or 2 (0.03 mmol) were dissolved in 100 µL of solvent (dichloromethane or toluene). m-CPBA (7.2 mg, 0.03 mmol) was added and the spectrum was recorded immediately after helium bubbling.

Captions

Figure 2

 2 Figure 2 in this paper). The phosphorus central lines have smaller amplitudes than the outer

6 A 1 2 7 6 8

 126 = 119.0, A 2 = 117.2, B = 13.A 1 = 119.0, A 2 = 117.3, B = 13.A 1 = 119.8, A 2 = 117.0, B = 12.0

  13. MRExp 88.1.

Scheme 1 :

 1 Scheme 1: Controlled radical polymerization involving nitroxides

Figure 1 :Figure 2 :Figure 3 : 1 G

 1231 Figure 1: Experimental ESR spectra of radical obtained during the oxidation of 1 in toluene at

2 G

 2 SCHEME 2

17

 17

Figure 2 Figure 3

 23 SCHEME 3

  N NMR (C6D6): δ -324.3 (t, JP-N = 6.1). IR (CCl4): 3466 (νNH), Ethanol, 25 °C, 10 -3 M): λmax 207 (εmax 492 mol -1 .dm 3 .cm -1 ), 260 (εmax 309 mol -1 .dm 3 .cm -1 )

	1251 (P=O), 1164 (POC2H5) cm -1 . Raman: 2978 (νCH3 As.); 2934 (νCH2 As.); 2908 (νCH3
	Sym.); 2875 (νCH2 Sym.); 2776; 2726; 1479; 1456 (δCHsp3 As.); 1446; 1396 or 1369 (δCHsp3
	Sym.); 1288; 1239 (P=O); 1099 (νC-N); 1028; 923; 767; 686; 639; 537; 313; 213 cm -1 . Anal.
	Calcd for C14H33NO6P2: C, 45.04; H, 8.91; N, 3.75. Found: C, 44.80; H, 8.49; N, 3.55. UV
	(nm. 20 D n 1.4463. 21 21 d 1.12. MRExp 88.9.

Table 1 :

 1 Yields and 31 P chemical shifts for some aminobisphosphonates

ACKNOWLEDGEMENTS

We thank the Hungarian Scientific Research Fund OTKA T-046953 for the financial support.

We also thank M. David Riffont from EICVN for his help.

See ref [6] or [10] G. Olive


Stefano Bistarelli

Fabio Martinelli
email: fabio.martinelli@iit.cnr.it

Francesco Santini
email: f.santini@cwi.nl

A Semiring-based Framework for the Deduction/Abduction Reasoning in Access Control with Weighted Credentials

Keywords: Role-based Trust-management Languages, Abduction, Deduction, Soft Constraint

We present a variant of the Datalog language (we call it Datalog W ), which is able to deal with weights on ground facts. The weights are chosen from a semiring algebraic structure. Our goal is to use this language as a semantic foundation for trust-management languages, in order to express trust relationships associated with a preference (e.g., a cost, an uncertainty, a trust or a fuzzy value). We apply Datalog W as the basis to give a uniform semantics to a weighted extension of the RT language family, called RT W . Moreover, we show that we can model the deduction and abduction reasoning with semiring-based soft constraints: deduction can validate or not the access request, while abduction can be used to compute the missing credentials if the access is denied and the level of preference that would grant the access.

Introduction and Motivations

In this work we extend the Role-based Trust-management language family (RT ) [START_REF] Li | Design of a role-based trust-management framework[END_REF] with weighted credentials, in order to enrich the access authorization decision with a value that represents an access degree level. The weights set and operations are modeled within a semiring-based framework [START_REF] Bistarelli | Semirings for Soft Constraint Solving and Programming[END_REF][START_REF] Bistarelli | Semiring-based constraint satisfaction and optimization[END_REF]. These weights can represent a cost, a trust or an uncertainty score, or in general, a preference associated with each credential. As a second step, we show how, by using semiring-based soft constraints [START_REF] Bistarelli | Semirings for Soft Constraint Solving and Programming[END_REF][START_REF] Bistarelli | Semiring-based constraint satisfaction and optimization[END_REF] and a policy written in the weighted version of RT (i.e., RT W ), we can model the deduction and abduction processes [START_REF] Koshutanski | A negotiation scheme for access rights establishment in autonomic communication[END_REF][START_REF] Menzies | Applications of abduction: knowledge-level modelling[END_REF], which can be respectively used to deduce if the access can be granted and to compute the missing credentials if it cannot be deduced.

A trust-management language is needed to have the expressivity power to represent the trust-related facts of the considered dominion and a method to derive new assessments and decision starting from these base facts. Current trust-management languages based on credentials (for both expressing facts and access policy rules) uses several foundational approaches. However, facts and access rules are not so crisp in the real complex world. For example, each piece of information could have a confidence value associated with it and representing a reliability estimation, or a fuzzy preference level or a cost to be taken in account. The feedback final value, obtained by aggregating all the ground facts together, can be then used to improve the decision support system by basing on this preference level instead of a plain "yes or no" result (e.g, see [START_REF] Martinelli | A uniform approach for the modeling of security and trust on protocols and services[END_REF][START_REF] Chakraborty | Trustbac: integrating trust relationships into the rbac model for access control in open systems[END_REF][START_REF] Bonatti | An integration of reputation-based and policy-based trust management[END_REF]). In this scenario, a credential could state that the referred entity is a "student" or a "bright student" with a probability of 80% because her/his identity of student is based on what an acquaintance asserts (thus, it is not as certain as declared in IDs). In literature there are many examples where trust or reputation are computed by aggregating some values together [START_REF] Jøsang | A survey of trust and reputation systems for online service provision[END_REF], for example in PGP systems, or for generic trust propagation inside social networks. We think that similar quantitative measurements are useful also for trust languages, in order to have a more informative result on the authorization decision process.

For this reason, in this paper we describe a weighted version of Datalog (we call it Datalog W ) where the rules are enhanced with values taken from a proper semiring structure [START_REF] Bistarelli | Semirings for Soft Constraint Solving and Programming[END_REF][START_REF] Bistarelli | Semiring-based constraint satisfaction and optimization[END_REF], in order to model the preference/cost system.

We use Datalog W as the basis to give declarative semantics to a weighted version of the RT family of languages [START_REF] Li | Design of a role-based trust-management framework[END_REF], used to describe policies and credentials. We called our weighted family RT W and, according to the guidelines given in [START_REF] Li | Design of a role-based trust-management framework[END_REF], it comprehends the languages RT W 0 , RT W 1 , RT W 2 , RT W T and RT W D , where the statements are "soft" in the sense that each credential is associated to a semiring value.

Indeed, there are good reasons to prefer a language, as Datalog W , that is declarative and has a formal foundation. In this sense, we are following a similar approach as done in [START_REF] Li | Datalog with constraints: A foundation for trust management languages[END_REF] for the RT family, where classical Datalog with crisp constraints has been proposed for the RT languages. Since trust is not necessarily crisp, Datalog W can be used to give a formal "weighted" semantics to the same family of languages instead. Moreover, other languages in literature can benefit from the underlying semantics provided by Datalog W : several trustmanagement languages are based on Datalog, e.g., Delegation Logic [START_REF] Li | Delegation logic: A logic-based approach to distributed authorization[END_REF], the RT [START_REF] Li | Design of a role-based trust-management framework[END_REF] (as already stated), KeyNote [START_REF] Blaze | The keynote trust-management system[END_REF] and RBAC [START_REF] Sandhu | Role-based access control models[END_REF].

Our systematic approach to give weights to facts and rules, contributes also towards bridging the gap between "rule-based" trust management (i.e., crisp security mechanisms) and "reputation based" trust management [START_REF] Jøsang | A survey of trust and reputation systems for online service provision[END_REF] (i.e., weighted security mechanisms).

Having defined the language, then we need to formally (and then in practice) define the fundamental reasoning processes used to control the access for RT W policies and credentials. Two basic services can be used inside access control systems: deduction and abduction [START_REF] Koshutanski | A negotiation scheme for access rights establishment in autonomic communication[END_REF][START_REF] Menzies | Applications of abduction: knowledge-level modelling[END_REF].

In deduction [START_REF] Koshutanski | A negotiation scheme for access rights establishment in autonomic communication[END_REF][START_REF] Menzies | Applications of abduction: knowledge-level modelling[END_REF], given a policy and a set of additional facts and events, the service finds out all consequences (actions or obligations) of the policy and the facts, i.e., whether granting the access can be deduced from the policy and the current facts. Since we are considering RT W , deduction is improved with a t threshold score, thus allowing the access only if the presented weighted credentials can provide a level better than t (where "better" depends on the chosen semiring).

The second service in access control, requested for more complex reasoning, is abduction [START_REF] Koshutanski | A negotiation scheme for access rights establishment in autonomic communication[END_REF][START_REF] Menzies | Applications of abduction: knowledge-level modelling[END_REF]. Loosely speaking in reverse, given a policy and a request of access, abduction consists in finding the credentials/events that would grant access, i.e., a (possibly minimal) set of facts that added to the policy would make the request a logical consequence. The intuition behind an interactive (client-server) access control system is the following: i) initially a client submits a set of credentials and a service request then, ii) the server checks whether the request is granted by the access policy according to the client's set of credentials. If the check fails, iii) by using abductive reasoning the server finds a (minimal) solution set of (disclosable) missing credentials that unlocks the desired resource and iv) returns them to the client, so that v) he can provide them in the second round (however, this kind of negotiation protocol is outside the scope of this paper). Together with the missing credentials, our abduction process returns also the (minimal) missing level of preference that would grant the access, in order to reach the imposed t threshold.

To propose a practical example, access control for autonomic communication needs the abduction reasoning service [START_REF] Shanahan | Prediction is deduction but explanation is abduction[END_REF]. The key idea is that in an autonomic network a client may have the right credentials but may not know them and thus an autonomic communication server needs a way to avoid leaving the client stranded.

The deduction and abduction operations on RT W policies have been implemented by semiring-based soft constraints operators (see Section 2), keeping the underlying machinery of our work within the same framework defined in [START_REF] Bistarelli | Semirings for Soft Constraint Solving and Programming[END_REF][START_REF] Bistarelli | Semiring-based constraint satisfaction and optimization[END_REF][START_REF] Bistarelli | Deduction and abduction with soft constraints[END_REF].

In order to show a real implementation of the deduction/abduction procedures over RT W policies, finally we have used the Constraint Handling Rules language (CHR) [START_REF] Frühwirth | Constraint Handling Rules[END_REF]. CHR is a high-level language designed for writing userdefined constraint systems. It is a committed-choice language consisting of guarded rules that rewrite constraints into simpler ones until they are solved.

This paper integrates a polished revision of [START_REF] Bistarelli | A semantic foundation for trust management languages with weights: An application to the rtfamily[END_REF][START_REF] Bistarelli | Deduction and abduction with soft constraints[END_REF][START_REF] Bistarelli | Weighted datalog and levels of trust[END_REF]. In Section 2 we describe the background about semirings and semiring-based soft constraints. In Section 3 we present a weighted version of Datalog, i.e., Datalog W , while Section 4 features RT W 0 , RT W 1 and RT W 2 , based on Datalog W ; Section 4 also describes the semantics inclusions between these three "brick" languages. Then, Section 5 and Section 6 respectively present other two languages of the family, RT W T and RT W D , which can be used, together or separately, with each of RT W 0 , RT W 1 , or RT W 2 . Section 7 provides how the deduction reasoning can be modeled with soft constraint operators and presents a CHR implementation; Section 8 shows the same for the abduction reasoning. Section 9 reports the related work in literature and, finally, in Section 10 we draw the final conclusions and ideas about future work.

Background on Semiring-based Soft Constraints

Semirings. An absorptive semiring [START_REF] Bistarelli | Enhancing constraints manipulation in semiring-based formalisms[END_REF] S can be represented as a A, +, ×, 0, 1 tuple such that: i) A is a set and 0, 1 ∈ A; ii) + is commutative, associative and 0 is its unit element; iii) × is associative, distributes over +, 1 is its unit element and 0 is its absorbing element. Moreover, + is idempotent, 1 is its absorbing element and × is commutative. Let us consider the relation ≤ S over A such that a ≤ S b iff a + b = b. Then it is possible to prove that (see [START_REF] Bistarelli | Semiring-based constraint satisfaction and optimization[END_REF]): i) ≤ S is a partial order; ii) + and × are monotonic on ≤ S ; iii) 0 is its minimum and 1 its maximum; iv) A, ≤ S is a complete lattice and, for all a, b ∈ A, a+b = lub(a, b) (where lub is the least upper bound). Informally, the relation ≤ S gives us a way to compare semiring values and constraints. In fact, when we have a ≤ S b (or simply a ≤ b when the semiring will be clear from the context), we will say that b is better than a.

In [START_REF] Bistarelli | Enhancing constraints manipulation in semiring-based formalisms[END_REF] the authors extended the semiring structure by adding the notion of division, i.e., ÷, as a weak inverse operation of ×. An absorptive semiring S is invertible if, for all the elements a, b ∈ A such that a ≤ b, there exists an element c ∈ A such that b × c = a [START_REF] Bistarelli | Enhancing constraints manipulation in semiring-based formalisms[END_REF]. If S is absorptive and invertible, then, S is invertible by residuation if the set {x ∈ A | b × x = a} admits a maximum for all elements a, b ∈ A such that a ≤ b [START_REF] Bistarelli | Enhancing constraints manipulation in semiring-based formalisms[END_REF]. Moreover, an absorptive S is residuated if the set {x ∈ A | b × x ≤ a} admits a maximum for all elements a, b ∈ A: with an abuse of notation, the maximal element among solutions is denoted a ÷ b.

The notion of semiring division can be applied to all the classical semirings instances [START_REF] Bistarelli | Semiring-based constraint satisfaction and optimization[END_REF], as the Boolean {false, true}, ∨, ∧, false, true , Fuzzy [0, 1], max, min, 0, 1 , Probabilistic [0, 1], max, ×, 0, 1 ( × is the arithmetic multiplication) and Weighted R + ∪ {+∞}, min, +, ∞, 0 semiring ( + is the arithmetic plus operation): the reason is that all these semirings are complete and consequently residuated [START_REF] Bistarelli | Enhancing constraints manipulation in semiring-based formalisms[END_REF]. Therefore, for all these semirings it is possible to use the ÷ operation as a "particular" inverse of ×.

A further (residuated) semiring that will be used in Ex. 3 (see Section 4) is the path semiring [START_REF] Theodorakopoulos | Trust evaluation in ad-hoc networks[END_REF]: S trust = [0, 1], [0, 1] , + p , × p , 0, 0 , 1, 1 to compute the trust level, where

t i , c i + p t j , c j =      t i , c i if c i > c j , t j , c j if c i < c j , max(t i , t j ), c i if c i = c j . t i , c i × p t j , c j = t i ×t j , c i ×c j
In this case, trust information is represented by a couple of values t, c : the first component represents a trust value in the range [0, 1], while the second component represents the accuracy of the trust value assignment (i.e., a confidence value), and it is still in the range [0, 1]. This parameter can be assumed as a quality of the opinion represented instead by the trust value; for example, a high confidence could mean that the trustor has interacted with the target for a long time and then the correlated trust value is estimated with precision. According to the definition of × p , the trust and confidence values are respectively multiplied together (i.e., × is the arithmetic multiplication), and with + p we prefer the couple with the higher confidence values; the two confidence values are equal, we choose the couple with the higher trust value. Soft Constraints. A soft constraint [START_REF] Bistarelli | Semiring-based constraint satisfaction and optimization[END_REF][START_REF] Bistarelli | Semirings for Soft Constraint Solving and Programming[END_REF] may be seen as a constraint where each instantiation of its variables has an associated preference. Given S = A, +, ×, 0, 1 and an ordered set of variables V over a (finite) domain D, a soft constraint is a function which, given an assignment η : V → D of the variables, returns a value of the semiring. Using this notation C = η → A is the set of all possible constraints that can be built starting from S, D and V . 0 and 1 respectively represent the constraints associating the 0 and 1 of the semiring to all assignments of domain values; in general, the ā function returns the semiring value a.

Any function in C involves all the variables in V , but we impose that it depends on the assignment of only a finite subset of them. So, for instance, a binary constraint c x,y over variables x and y, is a function c x,y : (V → D) → A, but it depends only on the assignment of variables {x, y} ⊆ V (the support, or scope, of the constraint). Note that cη[v := d 1 ] means cη ′ where η ′ is η modified with the assignment v := d 1 . Notice also that, with cη, the result we obtain is a semiring value, i.e., cη = a with a ∈ A.

Given the set C, the combination function of constraints

⊗ : C × C → C is defined as (c 1 ⊗ c 2 )η = c 1 η × c 2 η.
The the constraint division function ⊖ ÷ : C × C → C (which subtracts the second constraint from the first one) is instead defined as (c For this reason, the ⊖ ÷ operator is able to find the minimal explanation (see Section 8), since m is the maximum we can remove with ÷. It is worth to notice that our ⊖ ÷ operation can be considered as a "relaxation", and not a strict removal of a constraint. For example, considering the five soft constraints reported in Figure 1 and the Weighted semiring S Weighted = R + ∪ {+∞}, min, +, +∞, 0 , we have that c 1 ⊗ c 2 = c 3 . Since the ⊖ ÷ operator consists in a relaxation, we can also remove c 4 from c 3 (i.e., not only

1 ⊖ ÷ c 2 )η = c 1 η ÷ c 2 η [4]: given S = A, +, ×, 0, 1 , a ÷ b is defined as the m maximal element of the set {x ∈ A | b × x ≤ a}.
c 1 : ({x} → N) → R + ∪ {+∞} s.t. c 1 (x) = x + 3 c 2 : ({x} → N) → R + ∪ {+∞} s.t. c 2 (x) = x + 5 c 3 : ({x} → N) → R + ∪ {+∞} s.t. c 3 (x) = 2x + 8 c 4 : ({x} → N) → R + ∪ {+∞} s.t. c 4 (x) = x + 1 c 5 : ({x} → N) → R + ∪ {+∞} s.t. c 5 (x) = x + 7
c 1 or c 2 ), that is c 3 ⊖ ÷ c 4 = c 5 , even if c 4 is different from both c 1 and c 2 .
Informally, performing the ⊗ or the ⊖ ÷ between two constraints means building a new constraint whose support involves all the variables of the original ones, and which associates with each tuple of domain values for such variables a semiring element which is obtained by multiplying or, respectively, dividing the elements associated by the original constraints to the appropriate sub-tuples. The partial order ≤ S over C can be easily extended among constraints by defining c 1 ⊑ c 2 ⇐⇒ c 1 η ≤ c 2 η. Moreover, consider the set C (and its power-set ℘(C)) and the partial order ⊑. Then, an entailment relation ⊢⊆ ℘(C) × C is defined s.t. for each C ∈ ℘(C) and c ∈ C, we have C ⊢ c ⇐⇒ C ⊑ c. Given two constraints c 1 and c 2 , if we have c 1 ⊢ c 2 then we can say that c 2 is a logical consequence of c 1 : we will use this operator in order to abduce the missing credentials in Section 8.

Given a constraint c ∈ C and a variable v ∈ V , the projection of c over

V -{v}, written c ⇓ (V \{v}) is the constraint c ′ such that c ′ η = d∈D cη[v := d].
Informally, projecting means eliminating some variables from the support.

A Soft Constraint Satisfaction Problem (SCSP ) [START_REF] Bistarelli | Semirings for Soft Constraint Solving and Programming[END_REF] is defined as P = C, con (C is the set of constraints and con ⊆ V , i.e., the subset of interest among the problem variables). The best level of consistency notion defined as blevel(P ) = Sol(P ) ⇓ ∅ , where Sol(P ) = ( C) ⇓ con [START_REF] Bistarelli | Semirings for Soft Constraint Solving and Programming[END_REF].

A problem P is α-consistent if blevel(P ) = α [2]; if P is α 1 -consistent then it is also α 2 -consistent if α 1 ≤ S α 2 .
P is instead simply "consistent" iff there exists α > S 0 such that P is αconsistent [START_REF] Bistarelli | Semirings for Soft Constraint Solving and Programming[END_REF]. P is inconsistent if it is not consistent. of the CSP in Figure 2 associates a semiring element to every domain value of variables X and Y by combining all the constraints together, i.e., Sol(P ) = C. For instance, for the tuple a, a (that is, X = Y = a), we have to compute the sum of 1 (which is the value assigned to X = a in constraint c 1 ), 5 (which is the value assigned to X = a, Y = a in c 2 ) and 5 (which is the value for Y = a in c 3 ). Hence, the resulting value for this tuple is 11.

A Weighted Extension of Datalog

Datalog [START_REF] Ceri | What you always wanted to know about datalog (and never dared to ask)[END_REF] is a restricted form of logic programming with variables, predicates, and constants, but without function symbols. Facts and rules are represented as Horn clauses in the generic form R 0 :-R 1 , . . . , R n . A Datalog rule has the form: R 0 (t 0,1 , . . . , t 0,k0 ) : -R 1 (t 1,1 , . . . , t 1,k1 ), . . . , R n (t n,1 , . . . , t n,kn ) where R 0 , . . . , R n are predicate (relation) symbols and each term t i,j is either a constant or a variable (0 ≤ i ≤ n and 1 ≤ j ≤ k i ). The formula R 0 (t 0,1 , . . . , t 0,k0 ) is called the head of the rule and the sequence R 1 (t 1,1 , . . . , t 1,k1 ), . . . , R n (t n,1 , . . . , t n,kn ) the body. If the body is empty, the rule is called a fact. A program in Datalog is a set of rules; a program P must satisfy two safety conditions: i) all variables occurring in the head of a rule also have to appear in the body, and ii) every fact in P must be a ground fact.

We can now define our Weighted Datalog, or Datalog W based on classical Datalog. While rules have the same form as in classical Datalog, a fact in Datalog W has the form: R i (x i,1 , . . . , x i,ki ) :s Therefore, the extension is obtained by associating to ground facts a value s ∈ A taken from the semiring A, +, ×, 0, 1 . This value describes some properties of the fact, depending on the chosen semiring: for example, we can add together all these values by using the Weighted semiring R + ∪ {+∞}, min, +, ∞, 0 , trying to minimize the overall sum at the same time. Otherwise, we can find the best s(X) :-p(X,Y). p(a,b) :-q(a). p(a,c) :-r(a). q(a) :-t(a). t(a) :-2. r(a) :-3. global preference level by using the Fuzzy semiring [0, 1], max, min, 0, 1 or we can retrieve the highest resulting probability when we compose all the ground facts, by using the Probabilistic semiring [0, 1], max, ×, 0, 1 . Figure 3 shows an example of Datalog W program, for which we suppose to use the Weighted semiring. The intuitive meaning of a semiring value like 3 associated to the atom r(a) (in Figure 3) is that r(a) costs 3 units. Thus the set N contains all possible costs, and the choice of the two operations min and + implies that we intend to minimize the sum of the costs. This gives us the possibility to select the atom instantiation which gives the minimum cost overall. Given a goal like s(X) to this program, the operational semantics collects both a substitution for X (in this case, X = a) and also a semiring value (in this case, 2) which represents the minimum cost among the costs for all derivations for s(X). To find one of these solutions, it starts from the goal and uses the clauses as usual in logic programming, except that at each step two items are accumulated and combined with the current state: a substitution and a semiring value (both provided by the used clause). The combination of these two items with what is contained in the current goal is done via the usual combination of substitutions (for the substitution part) and via the multiplicative operation of the semiring (for the semiring value part), which in this example is the arithmetic +. Thus, in the example of goal s(X), we get two possible solutions, both with substitution X = a but with two different semiring values: 2 and 3. Then, the combination of such two solutions via the min operation give us the semiring value 2.

Finite Computation Time. Being the Datalog W language a subset of the Soft Constraint Logic Programming language [START_REF] Bistarelli | Semiring-based constraint logic programming: syntax and semantics[END_REF] with no functions, we can can use the results in [START_REF] Bistarelli | Semiring-based constraint logic programming: syntax and semantics[END_REF] to prove that, considering a given Datalog W program, the time for computing the value of any goal for this program is finite and bounded by a constant, as Theorem 1 states: Theorem 1 (Finite Set of Simple Refutations). Given a Datalog W program P and a goal C, consider the set SR(C) of simple refutations starting from C and building the empty substitution. Then SR(C) is finite. Moreover, each refutation in SR(C) has length at most N , where N = c i=1 b i , c is the number of all clauses with head instantiated in all possible ways, and b is the greatest number of atoms in the body of a clause in program P .

Proof. The proof of the theorem is identical to the one given in [START_REF] Bistarelli | Semiring-based constraint logic programming: syntax and semantics[END_REF]. Each simple refutation tree has the property that no two labels in a path from the root to a leaf are the same. Since such labels are clauses plus head instantiations, each path is long at most as the number of all possible clause head instantiations, say c. Furthermore, the branching factor of a simple refutation tree depends on the number of atoms in the bodies of the clauses used in the refutation. Thus, the number of nodes of a simple refutation tree, and, consequently, of steps in a simple refutation, is bounded by

c i=1 b i . Therefore, solving a goal C takes O(SR(C) • c i=1 b i ) steps.
4. Extending RT 0 , RT 1 and RT 2 with Weights

We describe four kinds of credentials for defining roles in a TM language family, here called RT W , which is based on Datalog W (see Section 3). This family uniformly extends the classical RT family [START_REF] Li | Design of a role-based trust-management framework[END_REF] by associating a semiring value to the basic role definition. Therefore, all the following credentials must be parameterized with a chosen A, +, ×, 0, 1 semiring in order represent preference/cost or fuzzy information associated to the statements. For every following RT W 0 credential, we describe how it can be translated in a corresponding Datalog W rule.

Rule 1 A.R ←-B, s where A and B are (possibly the same) entities, and R is a role name. This means that A defines B to be a member of A's R role. This statement can be translated to Datalog W with the rule r(A, B) :s, where s is the semiring value associated with the related ground fact, i.e., s ∈ A.

Rule 2 A.R ←-B.R 1 This statement means that A defines its R role to include (all members of) B's R 1 role. The corresponding Datalog W rule is r(A, x) :-r 1 (B, x).

Rule 3 A.R ←-A.R 1 .R 2 , where A.R 1 .
R 2 is defined as linked role [START_REF] Li | Design of a role-based trust-management framework[END_REF] and it means that A defines its R role to include (the members of) every role B.R 2 in which B is a member of A.R 1 role. The mapping to Datalog W is r(A, x) :-r 1 (A, y), r 2 (y, x).

Rule 4 A.R ←-B 1 .R 1 ∩ B 2 .R 2 ∩ • • • ∩ B n .R n .
In this way, A defines its R role to include the intersection of the n roles. It can be translated to

Datalog W with r(A, x) :-r 1 (B 1 , x), r 2 (B 2 , x), . . . , r n (B n , x).
The semantics of a program using these rules will find the best credential chain according to the + operator of the chosen semiring, which defines a partial order ≤ S . Notice that only the basic role definition statement (i.e., Rule 1) is enhanced with the semiring value s ∈ S, since the other three rules are used to include one role into another or to obtain the intersection of different roles.

Since Datalog is a subset of first-order logic, the semantics of a TM language based on it is declarative and unambiguous. While the × operator of the semiring is used to compose the preference/cost values associated to the statements, the + is used to let the framework select the best derivation chain with more chances to authorize the requester (among all the credentials revealed by her/him).

A credential, in a general definition, is an attestation of qualification, competence, or authority issued to an individual by a third party with the authority or the competence to do so. A policy describes the rules that grant the authorization. As an example, consider the first four rows in Figure 4 as policy rules, and the other rows as (weighted) credential definition.

Example 2. In Figure 4 we show an example of RT W 0 , extending the example presented in [START_REF] Li | Design of a role-based trust-management framework[END_REF] with weights. To solve the example in Figure 4, we use a Weighted semiring R + ∪{+∞}, min, +, ∞, 0 , where the elements in R + ∪{+∞} represents the number of negative feedbacks the credential has received: for example, StateU.highMarks ←-Alice, 4 in Figure 4 certifies that Alice has obtained high marks for the exams completed at the StateU university (the credential is issued by StateU) and that this credential has received 4 negative feedbacks by a system that collects a reputation value for the statements contained in the credentials. Feedbacks can be given by different kinds of entities: e.g., for the considered credential, students, professors, academic tutors. How these values are collected are outside the scope of the presentation.

This example is focused on bridging the gap between "rule-based" trust management (i.e., crisp security mechanisms) and "reputation based" trust management [START_REF] Jøsang | A survey of trust and reputation systems for online service provision[END_REF] (i.e., weighted security mechanisms). However, weights can be used in our framework to represent also other kinds of preference, as (money) costs, fuzzy or certainty degrees and all that can be modeled as semiring (see Section 2). The example in Figure 4 describes a fictitious Web publishing service, EPub, which offers a discount to anyone who is both a preferred customer and a bright student. EPub delegates the authority over the identification of preferred customers to its parent organization, EOrg. In order to be evaluated as a preferred customer, EOrg must issues two different types of credentials stating that the customer is not new (i.e., EOrg.oldCustomer ) and has already spent some money in the past (i.e., EOrg.highBudget). EOrg assigns a score to both these two credentials to quantify the money cost of these certificates. EPub delegates the authority over the identification of bright students to the entities that are accredited universities. To identify such universities, EPub accepts accrediting credentials issued by the fictitious Accrediting Board for Universities (ABU ). ABU evaluates a university with a score and each university evaluates its enrolled students. A student is bright if she/he is both enrolled in a good university and has high marks. By composing the reputation values of all the credentials in order to be authorized for the discount, we know that the credentials have received a total of 2 +4 +3 +2 = 11 negative feedbacks. If the access system imposes a threshold of, e.g., 12 negative feedbacks, we can access to the discount since 12 ≤ S 11, where S = R + ∪ {+∞}, min, +, ∞, 0 in this case.

EPub.disct

Example 3. In Figure 5 we extend the example of Figure 4 in order to represent also a case where the access to the system is granted by following different subsets of credentials (i.e., following several refutation paths). With respect to Figure 4, in Figure 5 a customer receives the discount even if she/he presents a good recommendation letter (i.e., EPub.famousProf.goodRecLetter).

In this example we use the path semiring presented in Section 2, thus a semiring value consists in a couple of trust, conf idence feedbacks. The best derivation chain corresponds to the criteria defined by the + p : between two couples, we prefer the one with the higher confidence value or, if the confidence values are equal, the couple with the higher trust value. Confidence and trust values are both in the [0..1] interval and are composed by using the arithmetic multiplication. Therefore, with the program in Figure 5 we obtain two solution with costs 0.3, 0.25 and 0.81, 0.72 respectively. By using + p we prefer the solution with cost 0.81, 0.72 . In the next subsections we suggest how to extend RT W 0 with parameterized roles (thus obtaining RT W 1 ), and how to further extend the language with logical rights (obtaining RT W 2 ). In Section 4.3 we finally show a theorem explaining the inclusion relationships among RT W 0 , RT W 1 , RT W 2 and their original (i.e., not weighted) versions.

RT W

1 : Parametrized Roles It is easy to extend RT W 0 in order to enhance it with parameterized roles, thus obtaining a RT W 1 language following the hierarchy presented in [START_REF] Li | Design of a role-based trust-management framework[END_REF]. This parametrization can be used to represent the relationships among entities, e.g., University.professorOf(student) to name the professor of a student. Parametrization can also be used to represent attributes that have fields, e.g., the number of exams or the enrollment academic year and so on. With respect to the previous four rules, in RT W 1 the head of a credential has the form A.R(h 1 , . . . , h n ), in which A is an entity, and R(h 1 , . . . , h n ) is a role name (R is a role identifier). For each i ∈ 1 . . . n, h i is a data term having the type of the ith parameter of R. For example, Rule 1 can be rewritten in RT W 1 as A.R(h 1 , . . . , h n ), s ←-B, and mapped to Datalog W as r(A, B, h 1 , . . . , h n ) :s. Our intention is to extend the RT W family according to the guidelines explained in [START_REF] Li | Design of a role-based trust-management framework[END_REF] (see Section 10).

A variable that appears in an RT 1 [START_REF] Li | Design of a role-based trust-management framework[END_REF], and consequently RT W 1 , credential can be either named or anonymous. A named variable takes the form of a question mark "?" followed by an alpha-numeric string. If a variable appears only once in a credential, it does not need to have a name and can be anonymous. An anonymous variable is represented by the question mark alone. Note that two different appearances of "?" in a credential represent two distinct variables [START_REF] Li | Design of a role-based trust-management framework[END_REF].

Example 4. In the example in Figure 8 we show an example where Alice may receive the discount because StateU released a diploma with her name in 1962 and the discount is offered to all the alumni enrolled in the years 1960-1965. Moreover, a proof from a professor of Alice must be collected as a credential. Credentials are weighted with negative feedbacks as in Ex. 4. Notice that we can express some constraints on the values of the attributes, that is ": [1960..1965]" [START_REF] Li | Design of a role-based trust-management framework[END_REF].

EPub.disct ←-EOrg.specYear. EOrg.specYear ←-StateU.oldAlumni(?X) ∩ StateU.profOf(?X). StateU.oldAlumni(?X) ←-StateU.diploma(?X, ?Year: [1960..1965].

StateU.profOf(Alice) ←-ProfX, 3 . StateU.diploma(Alice, 1962) ←-Alice, 2 . 4.2. RT W 2 : Logical Rights Trust languages can be used to grant some permissions, i.e., to represent access modes over some specific objects. For this reason it useful to group logically related objects (e.g., the files inside the same directory) and access modes, and to give permissions about them in a correlated manner. RT W 2 extends RT W 1 with logical rights.

As proposed in [START_REF] Li | Design of a role-based trust-management framework[END_REF], we introduce in our language the notion of o-sets, which are used to group together this kind of objects: o-sets names are created by associating an o-set identifier to a tuple of data terms. Moreover, an o-set identifier has a base type τ , and o-set names/o-sets created by using an o-set identifier have the same base type as the o-set identifier. Finally, the value of an o-set is a set of values in τ [START_REF] Li | Design of a role-based trust-management framework[END_REF]. An o-set-definition credential is similar to the role definition credential that we have defined in Section 4.1 for RT W 1 : the difference is that the members of o-sets are objects that are not entities. For example, StateURegistrar.cv(modify) ←-studyPlan, 0.3 states that the registrar's office of StateU university grants to the studyPlan of a student the permission to be modified only for the 30% of it.

O-set-definition credentials can be translated in Datalog exactly as proposed for RT W 0 and RT W 1 in Section 4: the head of a credential has the form A.O(h 1 , . . . , h n ), where O(h 1 , . . . , h n ) is an o-set name of type τ , while the body can be a value of base type τ , another o-set B.O(s 1 , . . . , s m ) of base type τ , a linked o-set A.R(t 1 , . . . , t l ).O(s 1 , . . . , s m ), in which R(t 1 , ..., t l ) is a role name and O(s 1 , . . . , s m ) is an o-set name of base type τ , or an intersection of k o-sets of the base type τ , i.e., O 1 (. . .

) ∩ O 2 (. . . ) ∩ • • • ∩ O k (. .

. ) (see Section 5 for the intersection of roles and o-sets).

Therefore, a credential in RT W 2 is either a role-definition credential or an o-set-definition credential. For more details on types and properties of RT W 2 credentials (w.r.t. RT W 1 ones), please refer to [START_REF] Li | Design of a role-based trust-management framework[END_REF].

Example 5. In the example in Figure 9, we suppose that the plan of study (i.e., StudyPlan) in Computer Science ( cs) of a given student, part of her/his cv, can be modified for its 30%. Moreover, the registrar's office of the StateU university (i.e., StudentRegistrar) states that Alice is at her first year at StateU and, therefore, she can modify her plan of study in Computer Science ( cs) for its 10% only, since she is a freshwoman. In this way it is possible to combine the general and more specific rights together; we suppose to use a fuzzy composition of rights by using the Fuzzy semiring [0, 1], max, min, 0, 1 . From the RT W 2 in Figure 9 we derive StudentRegistrar.studyP(modify, studyPlan) ←-Alice, 0.1 : Alice can modify her StudyPlan for a a percentage of min(0.3, 0.1) = 0.1.

StudentRegistrar.studyP(modify, ?F : StudentRegistrar.cv(?X)) ←-StudentRegistrar.firstYear(?X).

StudentRegistrar.cv(cs) ←-StudyPlan, 0.3 .

StudentRegistrar.firstYear(cs) ←-Alice, 0.1 .

Language Family Inclusion

In the next theorem we claim that our weighted language family can be used to represent also classical RT credentials [START_REF] Li | Design of a role-based trust-management framework[END_REF]. In this sense, the RT W languages can be considered as a foundation layer for all the classical RT languages.

Theorem 2 (Language Family Inclusion). For each set of statements in the RT 0 , RT 1 or RT 2 language, we can find an equivalent set of statements respectively represented in RT W 0 , RT W 1 or RT W 2 , whose semantics is the same.

Proof. In Figure 10 we show the theorem result, i.e., the vertical inclusions; the horizontal ones are explained in [START_REF] Li | Design of a role-based trust-management framework[END_REF]. The proof of the theorem comes from using the Boolean semiring {false, true}, ∨, ∧, false, true and by assigning a weight of 1 (i.e., the true value) to all the ground facts. In this way we obtain a set of crisp statements and the semantics returns all the possible derivation paths, as the corresponding RT set of statements would do. Therefore, the original "crisp" version of the RT languages can be modeled with RT W languages based on the semiring structure. By using other types of semiring (e.g., the Weighted semiring) we clearly become more expressive, since we can take decisions based on different preferences.

In Section 5 and Section 6 we respectively introduce other two RT -based languages: RT W T and RT W D can be used, together or separately, with each of RT W 0 , RT W 1 , or RT W 2 . The resulting combinations are written as RT W i , RT W T i and RT W D i for i = 0, 1, 2.

RT W T : Threshold and Separation-of-Duty Policies

RT W T can be used, together or separately, with each of RT W 0 , RT W 1 , or RT W 2 . The resulting combinations are written RT W T 0 , RT W T 1 and RT W T 2 . Threshold structures are satisfied by the agreement of k out of a set of entities that satisfy a specified condition, while separation of duty that two or more different people be responsible for the completion of a sensitive task, such deciding the result of an exam. With Rule 4 (see Section 4) it is possible to implement simple threshold structures by using the intersection of roles; for example, the policy stating that a student is considered bright only if two out of three professors confirm this, can be represented by the three rules U ni.bS ←-P 1 .bS ∩ P 2 .bS, U ni.bS ←-P 1 .bS ∩ P 3 .bS and U ni.bS ←-P 2 .bS ∩ P 3.bS (where P i is the ith professor and bS means "bright student").

However, with the intersection operator we are not able to express complex policies, for example we can represent the fact that A states that an entity b has attribute R if two different entities having attribute R 1 state that b has attribute R; for this reason we introduce the new RT W T language. In order to attain this, we need to work with sets of entities. More specifically, RT W T adds to the "unweighted" RT W language the notion of manifold roles, which generalizes the notion of roles [START_REF] Li | Design of a role-based trust-management framework[END_REF]. A manifold role has a value that is a set of entity collections. An entity collection is either an entity, which can be viewed as a singleton set, or a set of two or more entities.

In RT W T we introduce two more types of credentials w.r.t. Section 4:

Rule 5 A.R ←-B 1 .R 1 ⊙• • •⊙B k .R k .
As we have introduced before with words, the meaning of this credential is

members(A.R) ⊇ members(B 1 .R 1 ⊙ • • • ⊙ B k .R k ) = {s 1 ∪ • • • ∪ s k |s i ∈ members(B i .R i ) for 1 ≤ i ≤ k}.
Given w 1 , . . . w k as the actual weights of the derivations respectively rooted in B 1 .R 1 , . . . B k .R k , the global weight of the clause is then composed as

w 1 × w 2 × • • • × w k ,
where × depends from the chosen S semiring.

Rule 6 A.R ←-B 1 .R 1 ⊗ • • • ⊗ B k .R k .
The formal meaning of this credential is instead given by members(A.R)

⊇ members(B 1 .R 1 ⊗ • • • ⊗ B k .R k ) = {s 1 ∪ • • • ∪ s k |(s i ∈ members(B i .R i ) ∧s i ∩ s j = ∅) for 1 ≤ i = j ≤ k}.
Given w 1 , . . . w k as the actual weights of the derivations respectively rooted in B 1 .R 1 , . . . B k .R k , the global weight of the clause is then composed as

w 1 × w 2 × • • • × w k .
As usual, the Datalog W engine selects the best derivation chain according to the + operator of the semiring. Considering RT W T , the translation to Datalog W rules for Rule 1, Rule 2 and Rule 4 credentials is the same as the one presented in Section 4. Considering Rule 3, Rule 5 and Rule 6, the translation is instead the following one:

Rule 3 A.R ←-A.R 1 .R 2 can
be translated to r(A, x) :-r 1 (A, y), r 2 (y, x) when size(r 1 ) = 1, or can be translated to r(A, y) :-r 1 (A, x), r 2 (y, x 1 ), . . . r 2 (y, x k ), set k (x, x 1 , . . . , x k ) when size(r 1 ) = k > 1. Each role identifier has no a size: the size of a role limits the maximum size of each of its member entity set (see [START_REF] Li | Design of a role-based trust-management framework[END_REF] for further details). The new set k predicate takes k + 1 entity collections as arguments, and Example 6. Suppose that for a university office a student is "bright" (i.e., StateU.bS) if one member of StateU.evalExtAdvisor (i.e., an external advisor, as A and B) and two different members of StateU.EvalP rof (i.e., a professor who teaches in that university, as A (again), C and D), confirm this. This can be represented using the RT W T program in Figure 11.

set k (s, s 1 , . . . , s k ) is true if and only if s = s 1 ∪ • • • ∪ s k ; if s i is a entity, it is treated as a single-set element. Rule 5 A.R ←-B 1 .R 1 ⊙ • • • ⊙ B k .R k can be translated to r(A, x) :-r 1 (B 1 , x 1 ), r 2 (B 2 , x 2 ), . . . , r k (B k , x k ), set k (x, x 1 , . . . x k ). Rule 6 A.R ←-B 1 .R 1 ⊗ • • • ⊗ B k .R k can be translated to r(A, x) :-r 1 (B 1 , x 1 ), r 2 (B 2 , x 2 ), . . . , r k (B k , x k ), nset k (x,
If we adopt the Fuzzy semiring [0, 1], max, min, 0, 1 representing a fuzzy truth score of the credentials, the best authorization corresponds to the set {A, C} with a value of 0.8 (i.e., the min between 0.9 and 0.8): we remind that A is both a professor (i.e., A teaches at the university) and an external advisor (i.e., A can be a visiting professor) and therefore only two entities can satisfy the request. Therefore, with this program we retrieve the best combination of evaluators for a student: the student is supposed to present her/his signed credentials and to request how much she/he is considered bright: the evaluations of different evaluators are composed by selecting the worst score (with the min operation of the semiring), but at the end the best chain is selected (by using the max operator).

RT W D : Delegation of Role Activations

As RT W T (see Section 5), also RT W D can be used, together or separately, with each of RT W 0 , RT W 1 , or RT W 2 . The resulting combinations are written

RT W D 0 , RT W D 1 and RT W D 2 .
RT W D is finally added to our weighted language family in order to handle delegation of the capacity to exercise role memberships. The motivations are that in many scenarios, an entity prefers not to exercise all his rights. For example, a professor could want to log as a simple university employee, thus not having the rights to insert or change new exam results of students, but only having the rights to see her/his number of tickets for. With a weighted extension we are now able to state "how much" can be delegated to another entity, for example a session or a process. This quantitative delegation can be used, for example, to add a numerical information on TM systems as KeyNote [START_REF] Foley | Aggregating trust using triangular norms in the keynote trust management system[END_REF].

Therefore it is possible to quantify the "amount" of delegated rights, e.g., to modify a document, but only for the 80% of it, which is, for example, less RGroup.projectAccepted ←-RGroup.submit ⊗ RGroup.approve.

RGroup.submit ←-RGroup.member. RGroup.approve ←-RGroup.senior. RGroup.member ←-RGroup.senior. than the rights held by the delegating entity (e.g., 100%); this is the considerable improvement obtained by adding a semantic sublayer of weights. The delegation takes the following form: B 1 D as A.R ------→ B 2 , which means that B 1 delegates to B 2 the ability to act on behalf of D in D's capacity as a member of A.R.

For the definition of the RT W D rules we introduce the forRole predicate as in [START_REF] Li | Design of a role-based trust-management framework[END_REF]: forRole(B, D, A.R) can be read as B is acting for "D as A.R" and it means that B is acting for the role activation in which D activates A.R. The delegation rules can be translated in the following way:

B 1 D as A.R ------→ B 2 forRole(B 2 , D, A.R) ←-forRole(B 1 , D, A.R).
This rule means that B 2 is acting for "D as A.R" if B 1 is doing so. Other kinds of delegation rules that can be formulated are presented in [START_REF] Li | Design of a role-based trust-management framework[END_REF].

Clearly, even the other rules presented in Section 4 and Section 5 (since RT W D could be see as an extension of RT W T ) must be modified according to the introduction of the forRole predicate. For example, A.R ←-D, s becomes forRole(D, D, A.R), rule weight, where rule weight :s and s is the associated semiring value. Therefore we have presented only the Rule 1 translation and, for sake of brevity, we omit all the other rules translation with the forRole predicate (from Rule 2 to Rule 6); however the translation is similar to the one proposed in the RT D design in [START_REF] Li | Design of a role-based trust-management framework[END_REF], and Rule 1 is the most important rule since it is the "directly weighted" one. A request is translated in the same way as a delegation credential; the request is replaced by the dummy entity corresponding to it. For example, the B 1

D as A.R ------→ req request is translated to forRole(ReqID, D, A.R) ←-forRole(B 1 , D, A.R),
where ReqID is the dummy entity for req.

Example 7. In this example we show an example of delegation. We use the Weighted semiring R + ∪ {+∞}, min, +, ∞, 0 with the same meaning used in Ex. 2: weights represent negative feedbacks collected for a credential.

In Figure 12 we have a research group ( RGroup) in which we can find members ( RGroup.member) and senior members ( RGroup.senior). Each member can submit a research proposal for the group ( RGroup.submit), but the request can be accepted ( RGroup.approve) only by a senior member. Clearly, a senior member is also a member of the group. The RT W D program avoid the acceptance of a project approved by the same senior member who submitted it.

Suppose now that A and B are both senior members of the group and have the following credentials: RGroup.senior ←-A, 0 and RGroup.senior ←-B, 0

No negative feedbacks have been received for these credentials.

Therefore, A can submit a project of the group (variable projectID) by issuing A

A as RGroup.member --------------→ proj(projID), 2 , and B can accept it by issuing B B as RGroup.approve --------------→ proj(projID), 1 . We can prove that forRole(ReqID, {A, B}, RGroup.projectAccepted), where ReqID is the dummy principal representing proj (projID). If B does not issue the above approval and A proves the order by also issuing A A as RGroup.approve --------------→ proj(projID), 2 , we cannot prove forRole(ReqID, {A, B}, RGroup.projectAccepted ).

Deduction with Soft Constraints in Access Control Systems

In this section we show how the RT W languages, defined with the help of the semiring-based framework presented in Section 2, can be used to add quantitative information to the access control decision.

Deductive reasoning constructs or evaluates deductive arguments. Deductive arguments are attempts to show that a conclusion necessarily follows from a set of premises or hypotheses. Deduction is the basic reasoning in access control system [START_REF] Koshutanski | A negotiation scheme for access rights establishment in autonomic communication[END_REF], since it checks, from the credentials and the access policy (the premises) if the access authorization can be granted or not (the conclusion). The deduction process [START_REF] Koshutanski | A negotiation scheme for access rights establishment in autonomic communication[END_REF][START_REF] Menzies | Applications of abduction: knowledge-level modelling[END_REF] can be defined by using the constraint operators shown in Section 2.

Definition 1. [Deduction with soft constraints] Given a soft constraint σ which represents the current knowledge and a soft constraint c, if σ ⊢ r then σ entails (i.e., deduces) r.

With respect to Definition 1, σ represents the policy p and the collected credentials c, i.e., σ = p ⊗ c, and σ entails (i.e., deduces) the access request r if σ ⊢ r. Deduction in CHR. CHR [START_REF] Frühwirth | Constraint Handling Rules[END_REF] is a high-level language designed for writing userdefined constraint systems. It is essentially a committed-choice language consisting of guarded rules that rewrite constraints into simpler ones until they are solved. There are three kinds of CHR rules: simplification, propagation and simpagation. Simplification rules replace user-defined constraints by simpler ones. Propagation rules add new redundant constraints that may be necessary to do further simplifications. A simpagation rule is equivalent to a simplification rule with some of the heads repeated in the body. On a simpagation rule only the heads after the \ sign are removed. CHR libraries are available in most Prolog implementations: in particular, for the following examples we have used SWI-Prolog [START_REF] Wielemaker | An overview of the SWI-Prolog programming environment[END_REF].

In Figure 13 we implement the deduction process by translating the RT W 0 program in Figure 4. Given the five simplification rules (i.e., policy1, . . . , policy4), which represent the policy, and the first query, (i.e., 1 ?-in Figure 13), that is accredited(aBU, stateU, 2), highMarks(stateU, alice, 4), highBudget(eOrg, alice, 3), oldCustomer(eOrg, alice, 2), discount(alice, 12)) which represents the set of presented weighted credentials and the access request (i.e., discount(alice, 12)), we are able to deduce that Alice can access to the discount. In fact the system answers with access(alice). The solver can fire the first rule (i.e., policyrule1 ) because the sum of the negative feedbacks of the credentials, which is 11, is lower than the requested threshold in the discount request, which is 12. Notice that lower means better in this case, since in Ex. 2 we consider the Weighted semiring S = R + ∪ {+∞}, min, +, ∞, 0 . The implementation in Figure 13 finds if the corresponding SCSP problem is T -consistent (T is in policyrule1, see Section 2 for α-consistency), where T is represented by the access threshold, determined by discount. For query 1 ?-in Figure 13 we find out that the problem is 12-consistent, since the sum of the credentials is 11 and 12 ≤ S 11.

The second query, that is 2 ?-in Figure 13, is presented to show what happens when some necessary credentials are not presented to the authorization system: without the oldCustomer(eOrg, alice, 2) credential missing in the query, the CHR rules in Figure 13 are not able to fire policyrule2 rule. The query returns what can be computed with policyrule3 and policyrule4 rule.

Abduction of Weighted Credentials with Soft Constraints

In this Section we define the abduction process [START_REF] Menzies | Applications of abduction: knowledge-level modelling[END_REF] by using the semiringbased framework presented in Section 2. In particular, we adopt the ⊖ ÷ and ⊢ operators (see Section 2 for their formal definitions).

Abduction allows inferring a as an explanation of b. Because of this, abduction allows the precondition a to be abduced from the consequence b [START_REF] Thomas | The complexity of logic-based abduction[END_REF][START_REF] Menzies | Applications of abduction: knowledge-level modelling[END_REF]. For example suppose that, "I received a bad review for my paper on a Chemistryrelated topic"; but if "I have no background on Chemistry" then the first statement would not be so surprising. Therefore, by abductive reasoning, the possibility that "I have no background on Chemistry" is reasonable and a good explanation for "I received a bad review for my paper on a Chemistry-related topic". Formally, in logic explanation is done from a logical theory T representing a domain and a set of observations O [START_REF] Thomas | The complexity of logic-based abduction[END_REF]. Abduction is the process of deriving a set of explanations of O according to T and choosing one of those explanations. For E to be an explanation of O according to T , it should satisfy two conditions: i) O follows from E and T , and ii) E is consistent with T [START_REF] Thomas | The complexity of logic-based abduction[END_REF].

Therefore, if σ does not store enough information to satisfy c (i.e., the c conclusion cannot be obtained with deduction), it is interesting to automatically obtain the missing information that would allow to satisfy c. In Definition 2 we define abduction by using the ⊖ ÷ operation presented in Section 2: Definition 2. [Abduction with soft constraints] Given two soft constraints σ and r, the abduction process is aimed at finding a constraint d, such that (σ⊗d) ⊢ r, i.e., d = r ⊖ ÷ σ.

Notice that the division operator we are adopting is a deterministic operator (see Section 2) and provides a single solution d (which is also the minimal solution, as explained in the following of this section). Considering Definition 2, the trivial case is when σ ⊢ r since r ⊖ ÷ σ = 1, that is nothing must be added to σ in order to satisfy r, because it is already implied. If we consider our access control scenario with policies and credentials written in RT W , σ = p ⊗ c represents the policy p and the c set of credentials, and the abduced d constraint is such that (σ ⊗ d) ⊢ r, i.e., d = r ⊖ ÷ σ, where d is the abduced credential for the access request r.

An explanation is an input which can explain the result (via the given the inference rules). A minimal explanation, is one which makes just as many assumptions as needed to obtain an explanation [START_REF] Codognet | Abduction and concurrent logic languages[END_REF]. The concept of minimal explanation is important because it consists in the minimal amount of information needed to obtain the desired consequence: disclosing more credentials could lead to privacy problems since more than enough information is revealed. The abduction operation in Definition 2 finds the minimal explanation as proposed in [START_REF] Codognet | Abduction and concurrent logic languages[END_REF] for the crisp version, according to the definition of ÷ and ⊖ ÷ given in Section 2. Therefore, the d constraint in Definition 2 is the minimal explanation of r.

Suppose to have three constraints Student(x), HighMarks(x) and Access(x) which define a preference for a given x student: the support of these three constraints is {x}. If we use the S Fuzzy = [0, 1], max, min, 0, 1 semiring, if Student(Alice) = 0.9 and Access(Alice) = 0.7, then HighMarks(Alice) = 0.7. Thus Alice needs to attest the fact that she has high marks with a trust score 0.7 or greater. In the Fuzzy semiring, when σ(x) ≤ r(x), then d(x) = 1, otherwise d(x) = r(x), according to the definition of ÷ given in [START_REF] Bistarelli | Enhancing constraints manipulation in semiring-based formalisms[END_REF]:

a ÷ b = max{x | min{b, x} ≤ a} = 1 if b ≤ a a if a < b
Now suppose to consider the S Weighted = R + ∪ {+∞}, min, +, +∞, 0 semiring. If σ = Student(Alice) = 7 and r = Access(Alice) = 10, then r ⊖ ÷ σ = d = HighMarks(Alice) = 3. Therefore, this abduction operation suggests Alice to provide a credential attesting that she has HighMarks with a preference of 3 (e.g. votes) at least. The definition of ÷ (i.e., the arithmetic subtraction -) is: Notice that the credentials can be seen as partially ordered: assistant professor < associate professor < full professor, that is the full professor credential provides higher access capabilities w.r.t. assistant professor. This partial order can be easily represented with semiring (see Sec 2). This role hierarchy, where higher the role in the hierarchy, more powerful it is, is adopted also in [START_REF] Koshutanski | A negotiation scheme for access rights establishment in autonomic communication[END_REF]. A role dominates another role if it is higher in the hierarchy and there is a direct path between them in the lattice representing the hierarchy of roles. For example, fullProf (x ) ⊢ dateExam(x ) ⊗ roomExam(x ), but assProf (x ) ⊢ roomExam(x ) only, i.e., the assistant professor has less rights. The complete lattice of roles is shown in Figure 14. Abduction in CHR. In Figure 15 we implement in CHR the abduction procedure for the RT W 0 example presented in Figure 4. When the access constraint is produced by the program in Figure 13, in that case we deduce that the access is not granted. At this point, the rules in Figure 15 can be used to abduce the missing credentials with the maximum level possible of negative feedbacks. The query is now represented by the output obtained at the end of the failed deduction procedure in Figure 13, i.e., brightStudent(alice, 6 ), highBudget(eOrg, alice, 3 ), discount(alice, 12 ). The answer to this query (i.e., 1 ?-in Figure 15) is that we need the oldCustomer credential with a number of negative feedbacks less or equal than 2 in order to receive the access permission: the sum of the weights of the two statements (i.e., brightStudent(alice, 6), highBudget(eOrg, alice, 3)) is 9 and the discount is granted below a threshold of 12.

a ÷ b = min{x | b +x ≥ a} = 0 if b ≥ a a -b if a > b fullProf assProf roomExam dateExam roomExam dateExam
Notice that, w.r.t. the policy in Figure 4, in Figure 15 we show only the subset of the abduction rules necessary to compute an answer to query 1 ?-in Figure 15: this subset is able to deal with the branch under EPub.preferred, thus the EPub.brightStudent branch misses from Figure 15. These rules are not necessary four our sake, because the brightStudent has been already deduced by the program in Figure 13. This can be practically seen from the the second query in Figure 15 (i.e., 2 ?-), where, providing only discount(alice, 12), the program abduces only oldCustomer and highBudget. Moreover, it replays with a further constraint stating that the sum of negative feedbacks for these credentials must be 12 at most (i.e., comb(12)).

Related Work

Similar variations for RT family languages are defined and implemented in [START_REF] Martinelli | A uniform approach for the modeling of security and trust on protocols and services[END_REF] by using different formal tools. There, an initial comparison (and integration) between role-based trust-management (e.g., RT ) and reputation-based trust systems has been performed and a preliminary (ad-hoc) implementation of the weighted RT language is presented in [START_REF] Colombo | Fine grained access control with trust and reputation management for globus[END_REF] for GRID systems. However, having a uniform semantics approach, as the weighted datalog we are advocating here, to model these languages could be very useful to provide a common understanding as well as a basis for systematic comparison and uniform implementation.

An important extension that significantly enhances the expressivity of RT is represented by RT C [START_REF] Li | Datalog with constraints: A foundation for trust management languages[END_REF]. In that work, the authors present Datalog extended with constraints (denoted by Datalog C ) in order to define access permissions over structured resources as trees. Our aim is instead the representation of trust levels modeling preferences for credentials. Therefore, our extension is completely orthogonal w.r.t. RT C . Some TM systems, such as KeyNote [START_REF] Blaze | The keynote trust-management system[END_REF] and SPKI/SDI [START_REF] Clarke | Certificate chain discovery in SPKI/SDSI[END_REF], use credentials to delegate permissions, but their delegation structure is too limited. Each credential delegates certain permissions from its issuer to its subject, acting like a capability, and therefore they do not address the distributed nature of authority in distributed systems. For instance, it is not possible to express the statement that anyone who is a student is entitled to a discount.

Datalog was originally developed as a query/rule language for deductive databases and is syntactically equivalent to a subset of the Prolog language. Several TM languages are based on Datalog, e.g., Delegation Logic [START_REF] Li | Delegation logic: A logic-based approach to distributed authorization[END_REF], the RT framework [START_REF] Li | Design of a role-based trust-management framework[END_REF] (as discussed in this paper), SD3 (Secure Dynamically Distributed Datalog) [START_REF] Jim | SD3: A trust management system with certified evaluation[END_REF] and Binder [START_REF] Detreville | Binder, a logic-based security language[END_REF]. These are some of the languages that can benefit from the semantic basis presented in this paper, even if we will focus only in the RT language family.

Several approaches advocated the usage of trust levels w.r.t. attributes, also stated directly in digital credentials. In [START_REF] Bonatti | An integration of reputation-based and policy-based trust management[END_REF], the PROTUNE policy language is extended to deal with trust and reputation levels. Also role based access control has been extended with trust levels in [START_REF] Chakraborty | Trustbac: integrating trust relationships into the rbac model for access control in open systems[END_REF]. All these works use specific logics and approaches.

In [START_REF] Barker | Flexible access control policy specification with constraint logic programming[END_REF] the authors represent access policies as (crisp) constraint logic programs and apply this model to the Role-Based Access Control language [START_REF] Sandhu | Role-based access control models[END_REF] (RBAC), which is clearly related to RT . In that work, temporal forms of authorization are used to specify with constraints an interval of time for which an authorization is to hold. Our approach considers instead "weighted" credentials to represent uncertainty or fuzziness (for instance), instead of crisp intervals of values.

As far as we know, deduction and abduction operations has never been tied to the use of weighted credentials. The importance of crisp deduction/abduction reasoning for policy-based management of autonomic networks is highlighted in [START_REF] Koshutanski | A negotiation scheme for access rights establishment in autonomic communication[END_REF]. An Autonomic Network [START_REF] Koshutanski | A negotiation scheme for access rights establishment in autonomic communication[END_REF] crosses organizational boundaries and is provided by entities that see each other just as business partners. Policy-based network management already requires a paradigm shift in the access control mechanism, from identity-based access control to trust management and negotiation. In [START_REF] Koshutanski | A negotiation scheme for access rights establishment in autonomic communication[END_REF] the authors present an algorithm whose operations are expressed with logic, and so the access authorization procedure is not directly implemented with a tool in the paper.

Among the most noticeable works concerning logical reasoning and (crisp) constraints, we need to cite Maher, e.g., [START_REF] Maher | Abduction of linear arithmetic constraints[END_REF] where he investigates abduction applied to fully-defined predicates, specifically linear arithmetic constraints over the real numbers. In [START_REF] Maher | On computing constraint abduction answers[END_REF], Maher and Huang address the problem of computing and representing answers of constraint abduction problems over the Herbrand domain. This problem is of interest when performing type inference involving generalized algebraic data types. Notice that in [START_REF] Ribeiro | Security policy consistency[END_REF] the authors present a CHRbased tool for detecting security policy inconsistencies, where (not-weighted) policies are represented by CHR rules.

Concerning instead systems to implement abduction and deduction processes, abduction reasoning has been already realized in HYPROLOG [START_REF] Christiansen | Hyprolog: A new logic programming language with assumptions and abduction[END_REF] (available also in SWI-Prolog), which is an extension of Prolog and CHR with abduction and assumptions. The system is basically implemented by a compiler that translates the HYPROLOG syntax in a rather direct way into Prolog and CHR.

A different implementation is represented by ACLP [START_REF] Kakas | ACLP: Integrating abduction and constraint solving[END_REF]; ACLP is a system which combines abductive reasoning and constraint solving by integrating the frameworks of Abductive Logic Programming and Constraint Logic Programming (CLP). The ACLP system is currently implemented on top of the CLP language of ECLiPSe as a meta-interpreter exploiting its underlying constraint solver for finite domains.

Conclusion and Future Work

We have proposed an extension of the RT family languages called RT W , whose semantics is based on a weighted extension of Datalog (i.e., Datalog W ), obtained by representing weights with semiring algebraic structures (see Section 2). These languages can be used to deal also with vague and imprecise trust level of credentials during the access control decision: in general, a preference or a cost can be associated to each credential. In practice, we can manage and combine together different levels of truth, costs or (in general) preferences and finally have a more informative feedback value on to authorize the access request or not.

We have extended the RT family of languages [START_REF] Li | Design of a role-based trust-management framework[END_REF] and we have shown that classical RT 0 and RT 1 , RT 2 are respectively included in our RT W 0 , RT W 1 and RT W 2 extensions. Moreover, we have extended other two languages of the RT family, consequently obtaining RT W T and RT W D . After that, we have shown how both deduction and abduction reasoning over RT W policies can be modeled with semiring-based soft constraint operators (see Sec 2); in this way, within the same semiring-based framework, it is possible to deduce if a given set of weighted credentials has enough cost/trust/preference to allow the access (i.e., better than threshold t) and, if not, what the missing credentials are and what the missing level of cost/trust/preference is. The combination of these weighted procedures leads to a more informative decision, which is necessary, for example, when information is not "crisp".

Notice that other languages can benefit from the underlying semantics provided by Datalog W : we are able to define a weighted version of other trustmanagement languages based on Datalog: for example, Delegation Logic [START_REF] Li | Delegation logic: A logic-based approach to distributed authorization[END_REF], KeyNote [START_REF] Blaze | The keynote trust-management system[END_REF] and RBAC [START_REF] Sandhu | Role-based access control models[END_REF].

Our systematic approach to give weights to facts and rules, contributes also towards bridging the gap between "rule-based" trust management (i.e., hard security mechanisms) and "reputation based" trust management [START_REF] Jøsang | A survey of trust and reputation systems for online service provision[END_REF] (i.e., soft security mechanisms).

In the future, we plan to investigate the complexity of tractable soft constraints classes [START_REF] Cohen | The complexity of soft constraint satisfaction[END_REF] in order to cast them in a tractable Datalog-based language. Therefore, we want to extend also the RT C language [START_REF] Li | Datalog with constraints: A foundation for trust management languages[END_REF] (based on Datalog enhanced with crisp constraints) in its RT W C soft version.

We want also to study the feasibility of using Soft Concurrent Constraint Programming-like languages [START_REF] Bistarelli | Semirings for Soft Constraint Solving and Programming[END_REF] to represent the same authorization process: the soft constraints, added to the σ constraint store by the participating parties, will represent the credentials and the access rules proposed for the request, each statement with its own preference value. In fact, soft constraints [START_REF] Bistarelli | Semirings for Soft Constraint Solving and Programming[END_REF] extend classical constraints to represent multiple consistency levels, and thus provide a way to express preferences, fuzziness, and uncertainty. Then, a query can be modelled with a simple ask(c) -→ a action [START_REF] Bistarelli | Semirings for Soft Constraint Solving and Programming[END_REF], where the c constraint represents the fact that we want to check if it is implied by the store: the ask succeeds (i.e., the request is accepted) if the store σ entails the constraint c and also if the store is "consistent enough" w.r.t. the threshold a on the transition arrow, which represents the minimum requested consistency (or preference) level to be satisfied by the query.

At last, we plan to extend in SWI-Prolog the existent CHR module implementing soft constraints [START_REF] Bistarelli | Soft constraint propagation and solving in CHRs[END_REF], by adding the ÷ operator inside the soft module. In this way we could implement a stand-alone policy-based authorization system based on constraint programming.

  Therefore, n ≤ S m for every other element n in the set and, extended to constraints, c n ⊑ S c m ⇐⇒ c n (x = n) ≤ S c m (x = m), i.e., the other possible constraints obtained by choosing a different x in {x ∈ A | b × x ≤ S a} imply the one obtained by choosing the m maximal element.

Figure 1 :

 1 Figure 1: Five weighted soft constraints; notice that c 3 = c 1 ⊗ c 2 and c 5 = c 3 ⊖ ÷ c 4 .

Example 1 .

 1

Figure 2

 2 shows a weighted SCSP P = C = {c 1 , c 2 , c 2 }, con = {X, Y } as a graph: the used semiring is the Weighted semiring, i.e., R + ∪ {+∞}, min, +, ∞, 0 . Variables and constraints are represented respectively by nodes and by arcs (unary for c 1 and c 3 , and binary for c 2 ), and semiring values are written to the right of each tuple. V = {X, Y } and D = {a, b}. The solution

Figure 2 :

 2 Figure 2: A soft CSP based on a Weighted semiring.

  For the other tuples, a, b → 7, b, a → 16 and b, b → 16. The blevel for the example in Figure 2 is 7 (related to the solution X = a, Y = b), which represents the solution with the best preference.

Figure 3 :

 3 Figure 3: A simple Datalog W program.

Figure 4 :

 4 Figure 4: An example in RT W 0 , with fuzzy values associated to the credentials.

Figure 5 :

 5 Figure 5: An extension of the example in Figure 4, by using the path semiring.

Figures 6 and

 6 Figures 6 and Figure7 show the two Datalog refutation paths for the RT W 0

Figure 7 :

 7 Figure 7: The trust/confidence value for this set of credentials is 0.81, 0.72 by using the path semiring in Section 3.

Figure 8 :

 8 Figure 8: An example in RT W 1 .

Figure 9 :Figure 10 :

 910 Figure 9: An example in RT W 2 .

Figure 11 :

 11 Figure 11: An example in RT W T .

Figure 12 :

 12 Figure 12: An example in RT W D .

Figure 13 :

 13 Figure 13: Deduction with CHR rules: solving the example in Figure 4.

  If we have that σ = Student(Alice) r = Access(Alice) and Student(Alice) ⊗ HighMarks(Alice) ⊢ Access(Alice) then d = r ⊖ ÷ σ = HighMarks(Alice).

Figure 14 :

 14 Figure 14: A lattice representing the strength of roles: fullProf entails all the other roles.

Figure 15 :

 15 Figure 15: Abduction with CHR rules.

  ←-EPub.preferred ∩ EPub.brightStudent. EPub.preferred ←-EOrg.highBudget ∩ EOrg.oldCustomer. EPub.brightStudent ←-EPub.goodUniversity.highMarks.

EPub.goodUniversity ←-ABU.accredited. ABU.accredited ←-StateU, 2 . StateU.highMarks ←-Alice, 4 . EOrg.highBudget ←-Alice, 3 . EOrg.oldCustomer ←-Alice, 2 .

  x 1 , . . . x k ). The nset k predicate takes k+1 entity collections as arguments and it is true only when s = s 1 ∪• • •∪s

	StateU.bS ←-StateU.evaluators.bS.
	StateU.evaluators ←-StateU.evalProfs ⊙ StateU.evalExtAdvisor.
	StateU.evalProfs ←-StateU.evalProf ⊗ StateU.evalProf.
	StateU.evalExtAdvisor ←-A, 0.9 . StateU.evalExtAdvisor ←-B, 0.7 .
	StateU.evalProf ←-A, 0.8 . StateU.evalProf ←-C, 0.8 .
	StateU.evalProf ←-D, 0.6 .

k and for any 1

≤ i = j ≤ k, s i ∩ s j = ∅

Research partially supported by MIUR PRIN 20089M932N project: "Innovative and multi-disciplinary approaches for constraint and preference reasoning", by CCOS FLOSS project "Software open source per la gestione dell'epigrafia dei corpus di lingue antiche", and by INDAM GNCS project "Fairness, Equità e Linguaggi".

2 Work partially supported by the FP7 EU projects Aniketos, CONNECT and NESSoS. 3 This work was carried out during the tenure of an ERCIM "Alain Bensoussan" Fellowship Programme. This Programme is supported by the Marie Curie Co-funding of Regional, National and International Programmes (COFUND) of the European Commission.