Delegation Management Modeling in a Security Policy based Environment

Abstract

Security Policies (SP) constitute the core of communication networks protection infrastructures. It offers a set of rules allowing differentiating between legitimate actions and prohibited ones and consequently, associates each entity in the network with a set of permissions and privileges. Moreover, in today's technological society and to allow applications perpetuity, communication networks must support the collaboration between entities to face up any unavailability or flinching. This collaboration must be governed by security mechanisms according to the established permissions and privileges. Delegation is a common practice that is used to simplify the sharing of responsibilities and privileges. The delegation process in a SP environment can be implanted through the use of adequate formalisms and modeling. The main contribution of this paper is then, the proposition of a generic and formal modeling of delegation process. This modeling is based on three steps composing the delegation life cycle: negotiation used for delegation initiation, verification of the SP respect while delegating and revocation of an established delegation. Hence, we propose to deal with each step according to the main delegation characteristics and extend them by some new specificities

Verification of Authorization Policies Modified by Delegation

“…• condition [1]:When to optionally specify conditions for the authorization rules. -Subject is the metaclass that is used to specify the role with granted access.…”

“…• allowedAction [1]:Action, to specify the category of actions which the subject has access to; • domain [1]:Target, to specify the domain which the subject has access to; formed. This metaclass is linked to:…”

“…• authSubject [1]:Subject, to specify the subject that is authorized to access this domain; • onAction [1]:Action, to declare the category of actions that can be performed on this domain; -Action, is the metaclass that is used as an action holder, to group action items;…”

“…The delegation of rights from one subject to another needs to be controlled since not always a subject is allowed to delegate them. These controls are called in the literature delegation legitimacy conditions [1]. Who and when can delegate certain permissions to another subject is a critical issue in systems allowing cascade delegation of access rights.…”

“…In this chapter we focus on Ponder authorization and delegation policies. 1 Ponder authorization policies are essentially access control policies to protect resources from unauthorized access. A positive authorization policy (indicated by the header inst auth+, see Fig.…”