Abstract
Delegation is essential to the flexibility and scalability of trust management systems. But unrestricted delegation may result in privilege proliferation and breach the privacy of information systems. The delegation models of existing trust management systems can not avoid privilege transition, and being lack of effective constraints on delegation propagation, which may easily lead to privilege proliferation. In this paper, we propose a generalized constrained delegation model (GCDM), which uses typed privileges to control potential privilege transition, and restricts the propagation scope of delegation trees by a novel delegation constraint mechanism named spacial constraints. This paper also designs a rule-based trust management language named REAL05 to express the policies and semantics for GCDM. REAL05 supports flexible delegation policies while can control the potential privilege proliferation in subsequent delegations. Comprehensive samples and simulation results show that our approach is more controllable and practical.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
References
Neumann, B.C.: Proxy-Based Authorization and Accounting for Distributed Systems. In: Proceedings of the 13th International Conference on Distributed Computing Systems, Pittsburgh, PA (May 1993)
Lampson, B., Abadi, M., Burrows, M., Wobber, E.: Authentication in distributed systems: Theory and practice. ACM Transactions on Computer Systems 10(4), 265–310 (1992)
Firozabadi, B.S., Sergot, M., Bandmann, O.: Using Authority Certificates to Create Management Structures. In: Proceeding of Security Protocols, 9th International Workshop, Cambridge, April 2001. Springer, Heidelberg (2001) (in press)
Ellison, C.M., Frantz, B., Lampson, B., Rivest, R., Thomas, B.M., Ylonen, T.: SPKI Certificate Theory. IETF RFC 2693 (1998)
Intelligent Systems Laboratory, Swedish Institute of Computer Science, SICStus Prolog User’s Manual, Release 3.11.1 (February 2004)
Sollins, K.R.: Cascaded Authentication. In: Proceedings of the 1988 IEEE Symposium on Research in Security and Privacy, pp. 156–163 (April 1988)
Blaze, M., Feigenbaum, J., Lacy, J.: Decentralized trust management. In: Proceedings of 17th Symposium on Security and Privacy, Oakland, pp. 164–173. IEEE, Los Alamitos (1996)
Blaze, M., Feigenbaum, J., loannidis, J., Keromytis, A.D.: The KeyNote trust management system, version 2. IETF RFC 2704 (September 1999)
Schroeder, M.D., Saltzer, J.H.: The protection of information in computer systems. IEEE 63(9), 1278–1308 (1975)
Becker, M.Y., Sewell, P.: Cassandra: Flexible Trust Management. In: Applied to Electronic Health Records Proceedings of the 17th IEEE Computer Security Foundations Workshop (CSFW 2004) (2004)
Li, N., Grosof, B.N., Feigenbaum, J.: Delegation logic: A logic-based approach to distributed authorization. ACM Transaction on Information and System Security (TISSEC) (2003)
Li, N., Mitchell, J.C., Winsborough, W.H.: Design of a role-based trust management framework. In: Proceedings of the 2002 IEEE Symposium on Security and Privacy, pp. 114–130. IEEE Computer Society Press, Los Alamitos (2002)
Li, N., Mitchell, J.C.: Datalog with constraints: A foundation for trust management languages. In: Proceedings of the 5th International Symposium on Practical Aspects of Declarative Languages, pp. 58–73 (2003)
Bandmann, O., Damy, M., Firozabadi, B.S.: Constrained Delegation. In: Proceedings of the 2002 IEEE Symposium on Security and Privacy (S&P 2002) (2002)
Kanellakis, P.C., Kuper, G.M., Revesz, P.Z.: Constraint query languages. Journal of Computer and System Sciences 51(1), 26–52 (1995)
Star middleware site, http://www.starmiddleware.net
Varadharajan, V., Allen, P., Black, S.: An Analysis of the Proxy Problem in Distributed systems. In: IEEE Symposium on Research in Security and Privacy, Oakland, CA (1991)
Gang, Y., Meng, T., Huai-min, W., et al.: An Authorization Framework Based on Constrained Delegation. In: Cao, J., Yang, L.T., Guo, M., Lau, F. (eds.) ISPA 2004. LNCS, vol. 3358, pp. 845–857. Springer, Heidelberg (2004)
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2005 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Yin, G., Wang, H., Shi, D., Gu, H. (2005). Towards More Controllable and Practical Delegation. In: Gorodetsky, V., Kotenko, I., Skormin, V. (eds) Computer Network Security. MMM-ACNS 2005. Lecture Notes in Computer Science, vol 3685. Springer, Berlin, Heidelberg. https://doi.org/10.1007/11560326_19
Download citation
DOI: https://doi.org/10.1007/11560326_19
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-540-29113-8
Online ISBN: 978-3-540-31998-6
eBook Packages: Computer ScienceComputer Science (R0)