基于属性委托模型中的自动委托撤销

Auto-revocation in Attribute-based Delegation Model

摘要:

基于属性的扩展委托模型中(ABDMA),受托者必须同时满足委托先决条件和委托属性表达式才能被委托权限或角色.为提高委托的安全性,方便撤销操作,对该模型进行了扩展.首先定义了用户委托撤销类型,委托者可由此自行撤销委托出去的角色.然后为了支持自动撤销,在模型中引入了自动撤销机制,提出了4种自动撤销类型:由委托有效时间区间、用户先决角色变化、用户属性表达式变化和委托角色属性表达式变化引起的自动委托撤销.接着讨论了自动撤消的系统开销和自动撤销引起的多步委托安全性问题.最后给出了自动撤销算法和系统实现框架.

Abstract:

In attribute-based extended delegation model(ABDMA),delegatee must satisfy both delegation prerequisite condition(CR) and delegation attribute expression(DAE) when assigned to a delegation role.We extended ABDMA to make delegation more safe and easy to revoke delegation role form delegateee.This paper first defines user revocations,by which delegator can revoke delegate role from delegate.Then an auto-revocation mechanism is introduced and four types of auto-revocations are defined as revocation caused by delegation duration,the change of delegatee’s CR,the change of user’s DAE and the changed of delegation role’s DAE.System cost and security in multi-step delegation caused by auto revocation are also discussed.An auto revocation algorithm and a system architecture are proposed in this paper.