Abstract

Delegation certificates (e.g. SPKI) support the decentralized management of access rights in organizations without the need for a centralized server to mediate every delegation operation. However, it does not allow the access rights to be delegated in a flexible way. For instance, a user cannot be granted the authorization to perform delegation of permission without granting himself/herself the authorization to exercise the associated permission at the same time. In this paper, we propose an improved delegation model, where the various users in a delegation chain may perform supervision on the delegate to exercise the delegated permission. We describe the way to support the model using SPKI as an example. Also, we describe how to support efficient authorization in delegation with supervision using proxy signature techniques.

Keywords: Delegation certificate; Access control; Security management; Proxy signature

Article Outline

1. Introduction

2. Related research

2.1. Simple public-key infrastructure (SPKI)

2.2. Proxy signature

3. Limitations of the delegation certificate approach

4. A model for supporting flexible delegation of access rights

5. Supporting fine-grained delegation of access rights using SPKI

5.1. The scheme

5.2. Discussion

6. A more efficient scheme for delegation with supervision

6.1. Proxy signature scheme by Kim et al.

6.2. Proxy signature scheme for chained delegation

6.3. Supporting supervision in delegation

6.4. The proposed delegation protocol

6.5. Security analysis

6.6. Efficiency

7. An architecture to support delegation with supervision

7.1. An overview

7.2. Delegation and authorization process

8. Summary and future research directions

Acknowledgements

References