Constrained delegation

Abstract

Sometimes it is useful to be able to separate between the management of a set of resources, and the access to the resources themselves. Current accounts of delegation do not allow such distinctions to be easily made, however. We introduce a new model for delegation to address this issue. The approach is based on the idea of controlling the possible shapes of delegation chains. We use constraints to restrict the capabilities at each step of delegation. Constraints may reflect e.g. group memberships, timing constraints, or dependencies on external data. Regular expressions are used to describe chained constraints. We present a number of example delegation structures, based on a scenario of collaborating organisations.

Adding Support to XACML for Dynamic Delegation of Authority in Multiple Domains

“…This delegation policy component describes how the CVS can determine if a chain of delegated credentials and/or policies falls within a trusted tree or not. This is a rather complex policy component, and there are various ways of describing delegation trees [3,9] with no widely accepted standard way. The essential elements should specify who is allowed to be in the tree (both as an issuer and/or a subject), what constraints apply, and what properties (attributes) they can validly have (assert) and delegate.…”

“…Another constraint that we place on a delegation tree is that the same attribute (or its subordinate) must be propagated down the tree, and new unrelated attributes cannot be introduced in the middle of a delegation tree. We recognise that a more flexible approach will be to define delegation trees by referring to the attributes of the members rather than their distinguished names, as for example is used by Bandmann et al [9]. Their delegation tree model allows a policy writer to specify delegation trees such as "anyone with a head of department attribute may delegate a project manager attribute to any member of staff in the department".…”

Discretionary Overriding of Access Control in the Privilege Calculus

“…It is a modified version of the framework presented in Bandmann et al, 2002;Firozabadi et al, 2001, extended to include possibility-with-override. We have chosen this particular framework since it provides information about the source of authorisations.…”

“…He can also permit g to delegate the authority in several steps by appointing intermediary managers chosen from G. This allows p to let subordinates organise their own sub-organisations within G. For instance we could have p delegate to g who will delegate to g f who will in turn create the access level permission. The use of the auth*() construct is explained in more detail in Bandmann et al, 2002. Definition 6.. We define a certificate database to be a tuple V -(So A, D+, D" where SoA C $ is a finite set oiSource ofAuthority privileges, D + C E + is a finite set of declaration certificates and D~ C E~ is a finite set of revocation certificates. It is the combined contents of this certificate database that will decide which accesses are permitted.…”

“…Cycles are not possible in Firozabadi et al, 2001, but together with the auth* form from Bandmann et al, 2002 cycles become possible unless prevented with this extra constraint. Although cycles are not a problem in principle, the authority resolution algorithm later on becomes more complicated to explain for a cyclic graph, so we make this simplification.…”