Delegation of access rights in multi-domain service compositions

Abstract

Today, it becomes more and more common to combine services from different providers into one application. Service composition is however difficult and cumbersome when there is no common trust anchor. Hence, delegation of access rights across trust domains will become essential in service composition scenarios. This article specifies abstract delegation, discusses theoretical aspects of the concept, and provides technical details of a validation implementation supporting a variety of access controls and associated delegation mechanisms. Abstract delegation allows to harmonize the management of heterogeneous access control mechanisms and to offer a unified user experience. The authors observe standardization efforts to reduce application and domainspecific delegation mechanisms, but this variety is very unlikely to completely disappear.

Taxonomy of Delegation Model

“…Machine to Machine: This form of delegation is performed between two software applications (or agents), where one application delegate its gained privileges to another application. This form may be performed for authentication in service composition scenario [15] as shown in Fig. 3, where Facebook delegate subset of rights to Skype, on user data with the consent of user.…”

“…"Revocation" is used to take away delegated rights from delegatee in two ways namely; forced revocation or auto revocation [15]. In forced revocation, delegator can revoke delegated privileges any time he wants.…”

“…Delegation of access rights in multi-domain service compositions: Laurent et al [15] focused on delegation in service composition scenarios. In this model, delegation can be driven by delegatee and delegator to provide Human to Human and Human to Machine delegation, respectively.…”

An information flow control approach in composite services

“…Distributed approaches usually introduce sophisticated architecture layers and coordinative protocols that service providers must implement to establish integrated interaction [3,12,18]. The information flow control in distributed approach is enforced in a distributed manner.…”

Abstract Privacy Policy Framework: Addressing Privacy Problems in SOA

“…A common principle is to dynamically bind services hosted in different security domains and by different legal entities. We refer to this as "cross-domain service composition" [7]. In many cases, a distributed system might involve the processing of personal data and thus requires privacy-enhancing technologies [16].…”