Auto-revocation in Attribute-based Delegation Model

Abstract:

In attribute-based extended delegation model(ABDMA),delegatee must satisfy both delegation prerequisite condition(CR) and delegation attribute expression(DAE) when assigned to a delegation role.We extended ABDMA to make delegation more safe and easy to revoke delegation role form delegateee.This paper first defines user revocations,by which delegator can revoke delegate role from delegate.Then an auto-revocation mechanism is introduced and four types of auto-revocations are defined as revocation caused by delegation duration,the change of delegatee’s CR,the change of user’s DAE and the changed of delegation role’s DAE.System cost and security in multi-step delegation caused by auto revocation are also discussed.An auto revocation algorithm and a system architecture are proposed in this paper.