Adding support to XACML for multi-domain user to user dynamic delegation of authority

摘要

We describe adding support for dynamic delegation of authority (DOA) between users in multiple administrative domains, to the XACML model for authorisa_tion decision making. DOA is enacted via the issuing of cre_dentials from one user to another, and follows the role based access control model. We present the problems and require_ments that such a delegation model demands, the policy ele_ments that are necessary to control the delegation chains and a description of the architected solution. We propose a new conceptual entity called the credential validation service (CVS) to work alongside the XACML PDP. We describe our implementation of the CVS and present performance mea_surements for validating delegated chains of credentials.