A Survey of Delegation from an RBAC Perspective <s> C. Delegation with Rules <s> In recent years, workflow management systems (WFMSs) have gained popularity in both research and commercial sectors. WFMSs are used to coordinate and streamline business processes. Very large WFMSs are often used in organizations with users in the range of several thousands and process instances in the range of tens and thousands. To simplify the complexity of security administration, it is common practice in many businesses to allocate a role for each activity in the process and then assign one or more users to each role—granting an authorization to roles rather than to users. Typically, security policies are expressed as constraints (or rules) on users and roles; separation of duties is a well-known constraint. Unfortunately, current role-based access control models are not adequate to model such constraints. To address this issue we (1) present a language to express both static and dynamic authorization constraints as clauses in a logic program; (2) provide formal notions of constraint consistency; and (3) propose algorithms to check the consistency of constraints and assign users and roles to tasks that constitute the workflow in such a way that no constraints are violated. <s> BIB001 </s> A Survey of Delegation from an RBAC Perspective <s> C. Delegation with Rules <s> In current role-based systems, security officers handle assignments of users to roles. However, fully depending on this functionality may increase management efforts in a distributed environment because of the continuous involvement from security officers. The emerging technology of role-based delegation provides a means for implementing RBAC in a distributed environment with empowerment of individual users. The basic idea behind a role-based delegation is that users themselves may delegate role authorities to other users to carry out some functions on behalf of the former. This paper presents a role-based delegation model called RDM2000 (role-based delegation model 2000), which is an extension of RBDM0 by supporting hierarchical roles and multi-step delegation. The paper explores different approaches for delegation and revocation. Also, a rule-based language for specifying and enforcing the policies based on RDM2000 is introduced. <s> BIB002 </s> A Survey of Delegation from an RBAC Perspective <s> C. Delegation with Rules <s> OASIS is a role-based access control architecture for achieving secure interoperation of services in an open, distributed environment. The aim of OASIS is to allow autonomous management domains to specify their own access control policies and to interoperate subject to service level agreements (SLAs). Services define roles and implement formally specified policy to control role activation and service use; users must present the required credentials, in an appropriate context, in order to activate a role or invoke a service. All privileges are derived from roles, which are activated for the duration of a session only. In addition, a role is deactivated immediately if any of the conditions of the membership rule associated with its activation becomes false. These conditions can test the context, thus ensuring active monitoring of security.To support the management of privileges, OASIS introduces appointment. Users in certain roles are authorized to issue other users with appointment certificates, which may be a prerequisite for activating one or more roles. The conditions for activating a role at a service may include appointment certificates as well as prerequisite roles and constraints on the context. An appointment certificate does not therefore convey privileges directly but can be used as a credential for role activation. The lifetime of appointment certificates is not restricted to the issuing session, so they can be used as long-lived credentials to represent academic and professional qualification, or membership of an organization.Role-based access control (RBAC), in associating privileges with roles, provides a means of expressing access control that is scalable to large numbers of principals. However, pure RBAC associates privileges only with roles, whereas applications often require more fine-grained access control. Parametrized roles extend the functionality to meet this need.We motivate our approach and formalise OASIS. We first present the overall architecture through a basic model, followed by an extended model that includes parametrization. <s> BIB003 </s> A Survey of Delegation from an RBAC Perspective <s> C. Delegation with Rules <s> Sometimes it is useful to be able to separate management of a set of resources, and access to the resources themselves. However, current accounts of delegation do not allow such distinctions to be easily made. We introduce a new model for delegation to address this issue. The approach is based on the idea of controlling the possible shapes of delegation chains. We use constraints to restrict the capabilities at each step of delegation. Constraints may reflect e.g. group memberships, timing constraints, or dependencies on external data. Regular expressions are used to describe chained constraints. We present a number of example delegation structures, based on a scenario of collaborating organisations. <s> BIB004 </s> A Survey of Delegation from an RBAC Perspective <s> C. Delegation with Rules <s> Information sharing among collaborating organizations usually occurs in broad, highly dynamic network-based environments, and formally accessing the resources in a secure manner poses a difficult challenge. The mechanisms must be provided to protect the resources from adversaries. The proposed delegation framework addresses the issue of how to advocate selective information sharing among collaborating organizations. We introduce a systematic approach to manage delegated privileges with the specification of delegation and revocation policies using a set of rules. We demonstrate the feasibility of our approach by providing a proof-of-concept implementation. We also briefly discuss several issues from our experiment including future directions. <s> BIB005 </s> A Survey of Delegation from an RBAC Perspective <s> C. Delegation with Rules <s> Authorization delegations and negations are two important features of a flexible access control model. When a system allows both authorization delegation and negation, conflict problems can become crucial since multiple administrators greatly increase the chance of conflicts. However the problem of handling conflicts in authorization delegations has not been explored by researchers. The existing conflict resolution methods seem limited for certain applications and cyclic authorizations can even lead to undesirable situations. This paper presents an authorization framework that can support authorization delegation for both positive and negative authorizations. A conflict resolution method based on the underlying grant-connectivity relation is proposed, which gives higher priorities to the predecessors to achieve controlled delegation. For conflicts where grantors are not grant-connected, our model supports multiple resolution policies so that users can select the specific one that best suits their requirements. In addition, cyclic authorizations are avoided and cascade overriding is supported when an administrative privilege is overridden. We give a formal description of our model and describe in detail the algorithms to implement the model. Our model is represented using labeled digraphs that provide a formal basis for proving the semantic correctness of our model. <s> BIB006 </s> A Survey of Delegation from an RBAC Perspective <s> C. Delegation with Rules <s> The basic idea behind delegation is that some active entity in a system delegates authority to another active entity in order to carry out some functions on behalf of the former. User delegation in RBAC is the ability of one user (called the delegating user) who is a member of the delegated role to authorize another user (called the delegate user) to become a member of the delegated role. This paper introduces a new model, which we consider it to be an extension of REDM0 [BS2000]. The central contribution of this paper is to introduce a new model, referred to as RBDM1 (role-based delegation model/ hierarchical roles), that uses the details from RBDM0, which was described in the literature by Barka and Sandhu [BS2000] to address the temporary delegation based on hierarchical roles. We formally defined a role-based delegation model based on hierarchical relationship between the roles involved. We also identified the different semantics that impact the can-delegate relation, we analyzed these semantics to determine which ones we consider as more appropriate in business today, thus allowed in our model, and provided a justification to why those selections are made. <s> BIB007 </s> A Survey of Delegation from an RBAC Perspective <s> C. Delegation with Rules <s> In this paper, we distinguish between authorization problems at management level and request level in open decentralized systems, using delegation for flexible and scalable authorization management. The delegation models in existing approaches are limited within one level or only provide basic delegation schemes, and have no effective control over the propagation scope of delegated privileges. We propose REAL, a Role-based Extensible Authorization Language framework for open decentralized systems. REAL covers delegation models at both two levels and provides more flexible and scalable authorization and delegation policies while capable of restricting the propagation scope of delegations. We formally define the semantics of credentials in REAL by presenting a translation algorithm from credentials to Datalog rules (with negation-as-failure). This translation also shows that the semantics can be computed in polynomial time. <s> BIB008 </s> A Survey of Delegation from an RBAC Perspective <s> C. Delegation with Rules <s> Workflows model and control the execution of business processes in an organization. A workflow typically comprises of a set of coordinated activities, known as tasks. Typically, organizations establish a set of security policies, that regulate how the business process and resources should be managed. While a simple policy may specify which user (or role) can be assigned to execute a task, a complex policy may specify authorization constraints, such as separation of duties. Users may delegate the tasks assigned to them. Often such delegations are short-lived and come into play when certain conditions are satisfied. For example, a user may want to delegate his task of check approval only when going on vacation, when a check amount is less than a certain amount, or when his workload exceeds a certain limit.In this paper, we extend the notion of delegation to allow for such conditional delegation, where the delegation conditions can be based on time, workload and task attributes. When workflow systems entertain conditional delegation, different types of constraints come into play, which include authorization constraints, role activation constraints and workflow dependency requirements. We address the problem of assigning users to tasks in a consistent manner such that none of the constraints are violated. <s> BIB009 </s> A Survey of Delegation from an RBAC Perspective <s> C. Delegation with Rules <s> This paper addresses the issues surrounding user-to-user delegation in RBAC. We show how delegations can be incorporated into the RBAC model in a simple and straightforward manner. A special feature of the model is that it allows fine-grained control over what rights a user wishes to delegate as opposed to delegation at the role level where all the rights of a role must be delegated. In addition, the model provides a rich set of controls regarding further delegations of a right, generic constraints that further control delegations, and an innovative model for revocations. Properties of both delegation and revocation are discussed, and our work is compared with other related research. <s> BIB010 </s> A Survey of Delegation from an RBAC Perspective <s> C. Delegation with Rules <s> Role-based access control (RBAC) models have generated a great interest in the security community as a powerful and generalized approach to security management. In many practical scenarios, users may be restricted to assume roles only at predefined time periods. Furthermore, roles may only be invoked on prespecified intervals of time depending upon when certain actions are permitted. To capture such dynamic aspects of a role, a temporal RBAC (TRBAC) model has been recently proposed. However, the TRBAC model addresses the role enabling constraints only. In This work, we propose a generalized temporal role-based access control (GTRBAC) model capable of expressing a wider range of temporal constraints. In particular, the model allows expressing periodic as well as duration constraints on roles, user-role assignments, and role-permission assignments. In an interval, activation of a role can further be restricted as a result of numerous activation constraints including cardinality constraints and maximum active duration constraints. The GTRBAC model extends the syntactic structure of the TRBAC model and its event and trigger expressions subsume those of TRBAC. Furthermore, GTRBAC allows expressing role hierarchies and separation of duty (SoD) constraints for specifying fine-grained temporal semantics. <s> BIB011 </s> A Survey of Delegation from an RBAC Perspective <s> C. Delegation with Rules <s> Users of Web and grid services often must temporarily delegate some or all of their rights to a software entity to perform actions on their behalf. The problem with the typical grid services approach (X. 509 proxy certificates) is that commercial Web services tooling fails to recognize these certificates or process them properly. The security assertion markup language (SAML) is a standardized XML-based framework for exchanging authentication, authorization and attribute information. SAML has broadening commercial support but lacks delegation capabilities. To address this shortcoming, we exploit SAML's inherent extensibility to create a delegation framework for Web and grid services that supports both direct and indirect delegation. We develop a set of verification rules for delegation tokens that rely on WS-Security X.509 signatures, but do not force any trust relationship between the delegatee and the target service. We have implemented the framework on two common Web service hosting environments: Java/Tomcat and .NET. By leveraging existing Web services standards, we make it easier for Grid practitioners to build and consume Web and grid services without resorting to grid-specific protocols. <s> BIB012 </s> A Survey of Delegation from an RBAC Perspective <s> C. Delegation with Rules <s> In this paper we present a system permitting controlled policy administration and delegation using the XACML access control system. The need for these capabilities stems from the use of XACML in the SweGrid Accounting System, which is used to enforce resource allocations to Swedish research projects. Our solution uses a second access control system Delegent, which has powerful delegation capabilities. We have implemented limited XML access control in Delegent, in order to supervise modifications of the XML-encoded XACML policies. This allows us to use the delegation capabilities of Delegent together with the expressive access level permissions of XACML. <s> BIB013 </s> A Survey of Delegation from an RBAC Perspective <s> C. Delegation with Rules <s> Security requirements engineering is emerging as a branch of software engineering, spurred by the realization that security must be dealt with early on during the requirements phase. Methodologies in this field are challenging, as they must take into account subtle notions such as trust (or lack thereof), delegation, and permission; they must also model entire organizations and not only systems-to-be. In our previous work we introduced Secure Tropos, a formal framework for modeling and analyzing security requirements. Secure Tropos is founded on three main notions: ownership, trust, and delegation. In this paper, we refine Secure Tropos introducing the notions of at-least delegation and trust of execution; also, at-most delegation and trust of permission. We also propose monitoring as a security design pattern intended to overcome the problem of lack of trust between actors. The paper presents a semantic for these notions, and describes an implemented formal reasoning tool based on Datalog. <s> BIB014 </s> A Survey of Delegation from an RBAC Perspective <s> C. Delegation with Rules <s> We present a model for delegation that is based on our decentralized administrative role graph model. We use a combination of user/group assignment and user-role assignment to support user to user,permission to user and role to role delegation. A powerful source-dependent revocation algorithm is described. We separate our delegation model into static and dynamic models, then discuss the static model and its operations. We provide detailed partial revocation algorithms. We also give details concerning changes to the role hierarchy, user/group structure and RBAC operations that are affected by delegation. <s> BIB015 </s> A Survey of Delegation from an RBAC Perspective <s> C. Delegation with Rules <s> In existing delegation models, delegation security entirely depends on delegators and security administrators, for delegation constraint in these models is only a prerequisite condition. This paper proposes an Attribute-Based Delegation Model (ABDM) with an extended delegation constraint consisting of both delegation attribute expression (DAE) and delegation prerequisite condition (CR). In ABDM, a delegatee must satisfy delegation constraint (especially DAE) when assigned to a delegation role. With delegation constraint, a delegator can restrict the delegatee candidates more strictly. ABDM relieves delegators and security administrators of security management work in delegation. In ABDM, a delegator is not allowed to temporarily delegate permissions to a person who does not satisfy the delegation constraint. To guarantee its flexibility and security, an extension of ABDM named ABDMX is proposed. In ABDMX, a delegator can delegate some high level permissions to low level delegatee candidates temporarily, but not permanently. <s> BIB016 </s> A Survey of Delegation from an RBAC Perspective <s> C. Delegation with Rules <s> Trust Management is increasingly playing a major role especially with the growing need for security in decentralized, unsecured networks like peer-to-peer networks. Effective trust management solutions especially one geared towards handling trust in peer groups within peer communities are the key to handle the emerging security threats and scalability issues. Using a delegation infrastructure can provide a tremendous boost in terms of autonomy and division of labor in group based peer-to-peer communities.In our work we propose an effective trust system built on top of a peer group infrastructure that not only manages trust within communities but also between different communities. We also propose a delegation infrastructure that can be applied effectively to any grouped peer-to-peer community. <s> BIB017
Rules or constraints can be specified for all aspects of RBAC, and can be expressed using many languages and mechanisms. The most common constraints mentioned in terms of RBAC are separation of duty constraints (SOD), which express the fact that one user should not be able to have simultaneous access to certain pairs of roles, objects, etc. because this would allow some fraud to be perpetrated. SOD constraints are also a potential issue for delegation, although other types of rules or constraints are more directly related to the act of delegation. In this section, we will briefly highlight some aspects of delegation that can be governed by rules, without going into detail concerning syntax for them. Examples of rule specification languages can be found in BIB003 , BIB001 . Borrowing from Bacon et al. BIB003 , we can classify constraints as being environmental or prerequisite. Environmental constraints deal with such things as time, or the location of the users or services. Prerequisite constraints deal with things such as membership in another role or group being a prerequisite to being a delegator or delegatee. SOD constraints involving delegation roles are the negative form of prerequisite constraints: a user's membership in another role negates their ability to become a member of a delegation role. Further examples of environmental constraints from BIB015 are the Absence Constraint, which says that a user can be a delegator only if they are absent from work, and the Workload Constraint (also discussed in BIB009 ) which allows the delegation only when the workload of the delegator exceeds some level. Orthogonal to this classification, constraints can be based on some value, or can be structural. We use the term structural constraint to describe a constraint based on the characteristics of the delegation mechanism itself, such as the depth of a delegation chain, or the cardinality of the user set for a delegation role. A value-based constraint is a constraint based on a comparison with some value, which might be an attribute of the user, like the age of the user, or the fact that a certain role is in the delegator's user-role assignment list. An example of a value-based, prerequisite constraint was given in BIB016 where comparing attributes of users and attributes of permissions is used to decide on delegatees, in a situation where the delegator may not know which delegatees might satisfy the condition. Examples of structural constraints specifying the maximum depth of a delegation chain can be found in BIB005 , BIB004 , BIB010 and BIB015 . Other examples of structural, prerequisite constraints from BIB015 are the Delegatee constraint, which specifies the group to which the delegatee must belong, the Delegated Role Constraint, which specifies a user-role assignment for the delegatee, the Delegation role constraint, which controls which roles can be delegated, and the Maximum Privilege Set Constraint which gives a set of permissions which must not be exceeded for the delegatee for a series of delegations (so that the delegatee does not get too much power). Rules involving time (which are environmental constraints) can be used in many aspects of RBAC (see for example BIB011 ). As far as delegation is concerned, time constraints can be used to specify the duration of a delegation, i.e. to provide a timeout, or to constrain when delegation can take place, say to limit the time when Alice can be a delegatee to those hours when she is normally at work. Timeouts are mentioned in RBDM0  , RBDM1 BIB007 , and BIB002 , BIB010 and BIB005 . BIB012 mentions time predicates that constrain start and end times, with semantics of "not before" and "not after". In the context of workflow, Atluri and Warner BIB009 use a time interval to constrain delegation of a task to, for example, the two hours that a delegator is at a meeting. V. OTHER USES OF THE TERM "DELEGATION" In some parts of the literature on access control, it is common to use the term delegation to refer to what we are calling administration in this paper. In discretionary access control, administration of access rights can become very decentralized if the original owner of an object grants rights to other users "with grant option", to use the relational database term. This does not mean that the further granting of rights has anything to do with the motivations for delegation given in Section I, nor with the finer points of our Definition 1. There is no implication that the "delegation" being described is temporary; it is the permanent delegation mentioned by Barka and Sandhu  (which we prefer to call administration). Often the word "administration" is used, but instead of saying that the permissions are granted, the authors say the permission is delegated. Some examples of this use of the word delegation can be found in BIB006 , BIB013 . In a distributed system, furthermore, the whole point is that there is not a centralized authority but that all aspects of the computing environment are decentralized and have decentralized control. Here again is it is common to use the term delegation to refer to granting of permissions, which we would call administration. Examples of this can be found in BIB014 , BIB017 . On the other hand, in decentralized or distributed systems, a great deal takes place at run time. There is not a concept of design time, but rather users are requesting services from systems they have not previously accessed, in a dynamic environment. In this context, one can talk about the services delegating their administrative functions to another system or agent on the one hand, and, on the other hand, users delegating their capability list in the form of credentials to another service or agent BIB008 . In the latter case, the delegation that takes place on the user side can deal with identity management as well as capabilities, and is thus often done with the motivation of maintaining the privacy of the user. VI. SUMMARY We began this paper by distinguishing between design time and run time, emphasizing that the transfer of access rights through delegation takes place at run time. Several interpretations of the word "delegation" in the computing literature were examined, yielding the definition for the use of the word in this paper. We highlighted the difference between administration of access control and delegation of roles or permissions. Properties of delegation discussed previously in the literature were presented. Using the components of rolebased access control, we classified many forms of delegation which have appeared in the literature. This classification is very helpful in exposing the nuances possible in the design of delegation. Various ways in which rules can be used were summarized. Finally, we observed that sometimes, in the literature, the word "delegation" is used to describe what we would call administration of access rights.