Meng Teng

A rule-based framework for role-based constrained delegation

In this paper, we concentrate on the delegation problem in trust management (TM) systems. One key point for delegation models is to find the balance between flexibility and controllability. Delegation models in existing TM systems usually have no effective control over delegated privileges or try to enforce too strict constraint on delegation that raises difficulty in policy definition and computational-model constructing. We propose a role-based constrained delegation Model called RCDM04, which is a constrained extension of current role-based trust management systems. RCDM04 comprises a novel delegation framework for multi-centric authorization and proxy-based authentication, proposing to use trusted scope and delegation depth to control the propagation of delegated privileges. This paper also introduces a rule-based language for specifying and enforcing the policies in the model.

An authorization framework based on constrained delegation

In this paper, we distinguish between authorization problems at management level and request level in open decentralized systems, using delegation for flexible and scalable authorization management. The delegation models in existing approaches are limited within one level or only provide basic delegation schemes, and have no effective control over the propagation scope of delegated privileges. We propose REAL, a Role-based Extensible Authorization Language framework for open decentralized systems. REAL covers delegation models at both two levels and provides more flexible and scalable authorization and delegation policies while capable of restricting the propagation scope of delegations. We formally define the semantics of credentials in REAL by presenting a translation algorithm from credentials to Datalog rules (with negation-as-failure). This translation also shows that the semantics can be computed in polynomial time.