Postulates for Revocation Schemes

Abstract

Abstract. In access control frameworks with the possibility of delegating permissions and administrative rights, delegation chains can form. There are different ways to treat these delegation chains when revoking rights, which give rise to different revocation schemes. Hagström et al. [11] proposed a framework for classifying revocation schemes, in which the different revocation schemes are defined graph-theoretically. At the outset, we identify multiple problems with Hagström et al.'s definitions of the revocation schemes, which can pose security risks. This paper is centered around the question how one can systematically ensure that improved definitions of the revocation schemes do not lead to similar problems. For this we propose to apply the axiomatic method originating in social choice theory to revocation schemes. Our use of the axiomatic method resembles its use in belief revision theory. This means that we define postulates that describe the desirable behaviour of revocation schemes, study which existing revocation frameworks satisfy which postulates, and show how all defined postulates can be satisfied by defining the revocation schemes in a novel way.

Technical report of "The Knowledge Base Paradigm Applied to Delegation Revocation"

“…The main author of the current paper has defined a modified version of Hagström et al's delegation revocation framework [25] as well as Trust Delegation Logic, a logic of trust designed for studying the reasons for performing different revocation schemes defined [8]. This work was motivated by problems we encountered with Hagström et al's delegation revocation framework when we produced the first FO(•) specification of the framework; these problems are documented in [25], [8] and [26]. In general, it should be noted that formally specifying something in FO(•) can help understanding it better and uncovering problematic features.…”