A Survey of Delegation from an RBAC Perspective <s> A. Characteristics of Delegation <s> The basic idea behind delegation is that some active entity in a system delegates authority to another active entity to carry out some functions on behalf of the former. Delegation in computer systems can take many forms: human to human, human to machine, machine to machine, and perhaps even machine to human. We focuses on the human to human form of delegation using roles. As we show, there are many different ways in which role-based human-to-human delegation can occur. We develop a framework for identifying interesting cases that can be used for building role-based delegation models. This is accomplished by identifying the characteristics related to delegation, using these characteristics to generate possible delegation cases, and using a systematic approach to reduce the large number of cases into few useful cases which can be used to build delegation models. <s> BIB001 </s> A Survey of Delegation from an RBAC Perspective <s> A. Characteristics of Delegation <s> Access control is a mechanism to secure resources from unauthorized use. Securing a grid resource imposes a distinctive set of challenges to access control policies and mechanisms. As the grid resources are distributed in space and time, direct authorization methods are not always sufficient. Delegation is a way of indirect authorization whereby an active entity in a grid system can access a resource or act on behalf of another active entity. Access to resources in grids can be broadly categorized as full, nil or partial implying a degree of fuzziness. Conventional security models are rigid and the tasks that need to be performed by an active grid entity, require a more flexible form of access. A fuzzy logic based scheme provides more flexibility to resource access and access control in grids. The delegated rights have to be granted in a dynamic environment where the entities of a grid do not have prior information about each other. We propose a new scheme for this, which uses a two-stage fuzzy inference process based on trust relationships among the grid entities <s> BIB002 </s> A Survey of Delegation from an RBAC Perspective <s> A. Characteristics of Delegation <s> We present a model for delegation that is based on our decentralized administrative role graph model. We use a combination of user/group assignment and user-role assignment to support user to user,permission to user and role to role delegation. A powerful source-dependent revocation algorithm is described. We separate our delegation model into static and dynamic models, then discuss the static model and its operations. We provide detailed partial revocation algorithms. We also give details concerning changes to the role hierarchy, user/group structure and RBAC operations that are affected by delegation. <s> BIB003 </s> A Survey of Delegation from an RBAC Perspective <s> A. Characteristics of Delegation <s> User delegation is a mechanism for assigning access rights available to a user to another user. A delegation operation can either be a grant or transfer operation. Delegation for role-based access control models have extensively studied grant delegations. However, transfer delegations for role-based access control have largely been ignored. This is largely because enforcing transfer delegation policies is more complex than grant delegation policies. This paper, primarily, studies transfer delegations for role-based access control models. We also include grant delegations in our model for completeness. We present various mechanisms that authorise delegations in our model. In particular, we show that the use of administrative scope for authorising delegations is more efficient than using relations. We also discuss the enforcement and revocation of delegations. Finally, we compare our work with relevant work in the literature. <s> BIB004
In BIB001 , Barka and Sandhu list the following characteristics of delegation: PERMANENCE: According to Barka and Sandhu BIB001 , permanent delegation describes the situation where a user in a role permanently delegates this role to another user. Temporary delegation is limited by time. According to Definition 1, what they call permanent delegation we are calling administration of access rights; in this paper we only consider temporary delegation. MONOTONICITY: Monotonic delegation means that the delegator still holds their rights after delegation and can perform this task regularly. Non-monotonic delegation means that, after the delegator transfers the rights to the delegatee, they no longer have these rights. However this delegation is not permanent; the delegator can revoke the delegation and get back the rights. TOTALITY: Total delegation occurs when the delegator delegates all permissions of a role to the delegatee, whereas with partial delegation, the delegator delegates a proper subset of the permissions of the delegated role to the delegatee. ADMINISTRATION: The delegation can be performed by the user who is the delegator, in which case this is called selfacted, or by an agent, which can be software or another user, which is called agent acted. The latter might be necessary if the delegator is unable to access the system on which the delegation is to be performed. LEVEL OF DELEGATION: Single step delegation does not permit the delegatee to further delegate the permission received. Two-or multi-step delegation does allow the delegatee to further delegate. This is analogous to the "with grant option" in relational databases, except that here we are dealing only with delegation, and not with administration of rights. MULTIPLE DELEGATION: Multiple delegation refers to the number of delegatees who can receive the delegation at the same time, i.e. either a single delegatee or multiple ones. AGREEMENTS: Agreements are the protocols between delegator and delegatee. A bilateral agreement is one that both parties of a delegation agree to. Unilateral agreement is a oneway decision made by the delegator. In this case, the delegatee has no choice but to accept the delegation. REVOCATION: Revocation is further classified two different ways: Cascading revocation occurs when there is a delegation chain, and the original delegation being revoked causes all delegations along the dependent chain also to be revoked. The other classification is whether or not revocation is grant dependent or grant independent. The former means that only the original delegator can revoke the delegation, whereas the latter means that any user in a position to be a potential delegator can revoke the delegation. In addition to these characteristics given by Barka and Sandhu, we can add the following: STATIC VS. DYNAMIC DELEGATION: Static delegation is delegation which can be designed in advance, at design time, whereas dynamic delegation is constructed at run time when an unanticipated need arises. The need for this distinction has been independently discussed for Grids in BIB002 , and for role-based access control in BIB003 ,  . With static delegation, referring back to our example, Alice could decide that, if she is ever away, any member of the AccountantsGr could perform the SAccnting role. If it occurs at run time that no such person is available, and the role is essential, then someone else could be delegated to the SAccnting role with dynamic delegation. Having delegation designed ahead of time, with static delegation, allows consistency checks to be performed in advance BIB003 ,  . TRANSFER DELEGATION: After a transfer delegation, as defined by BIB004 , the delegator can no longer use the delegated permissions. This property is contrary to the assumption we made in Section I, that the responsibility remains with the delegator. Thus, we will not consider transfer delegation further in this paper. With the exception of totality, all of these properties deal with how the delegation is managed and carried out. Totality can be described in terms of one of the basic building blocks of RBAC, the role, and whether or not we delegate a whole role or just part of a role.