Adding Support to XACML for Dynamic Delegation of Authority in Multiple Domains Export

@incollection{citeulike:2964501, abstract = {In this paper we describe how we have added support for dynamic delegation of authority that is enacted via the issuing of credentials from one user to another, to the XACML model for authorisation decision making. Initially we present the problems and requirements that such a model demands, considering that multiple domains will typically be involved. We then describe our architected solution based on the XACML conceptual and data flow models. We also present at a conceptual level the policy elements that are necessary to support this model of dynamic delegation of authority. Given that these policy elements are significantly different to those of the existing XACML policy, we propose a new conceptual entity called the Credential Validation Service (CVS), to work alongside the XACML PDP in the authorisation decision making. Finally we present an overview of our first specification of such a policy and its implementation in the corresponding CVS. Keywords: XACML, Delegation of Authority, Credentials, Attributes, Policies, PDP.}, author = {Chadwick, David and Otenko, Sassa and Nguyen, Tuan}, citeulike-article-id = {2964501}, citeulike-linkout-0 = {http://dx.doi.org/10.1007/11909033_7}, doi = {10.1007/11909033_7}, journal = {Communications and Multimedia Security}, keywords = {accesscontrol, delegation, security}, pages = {67--86}, posted-at = {2008-07-04 18:17:42}, priority = {2}, title = {Adding Support to XACML for Dynamic Delegation of Authority in Multiple Domains}, url = {http://dx.doi.org/10.1007/11909033_7}, year = {2006} }

TY - CHAP ID - citeulike:2964501 L3 - citeulike-article-id:2964501 N2 - In this paper we describe how we have added support for dynamic delegation of authority that is enacted via the issuing of credentials from one user to another, to the XACML model for authorisation decision making. Initially we present the problems and requirements that such a model demands, considering that multiple domains will typically be involved. We then describe our architected solution based on the XACML conceptual and data flow models. We also present at a conceptual level the policy elements that are necessary to support this model of dynamic delegation of authority. Given that these policy elements are significantly different to those of the existing XACML policy, we propose a new conceptual entity called the Credential Validation Service (CVS), to work alongside the XACML PDP in the authorisation decision making. Finally we present an overview of our first specification of such a policy and its implementation in the corresponding CVS. Keywords: XACML, Delegation of Authority, Credentials, Attributes, Policies, PDP. JF - Communications and Multimedia Security EP - 86 TI - Adding Support to XACML for Dynamic Delegation of Authority in Multiple Domains SP - 67 KW - accesscontrol KW - delegation KW - security AU - Chadwick, David AU - Otenko, Sassa AU - Nguyen, Tuan PY - 2006/// UR - http://dx.doi.org/10.1007/11909033_7 ER -