Digital Systems Laboratory Series A: Research Reports on the Structure of Delegation Networks on the Structure of Delegation Networks

In new distributed, key-oriented access control systems access rights are delegated by a freely formed network of certiicates. For example, the SPKI public-key infrastructure is being designed for this kind of distributed trust management on the Internet. We formalize the concept of a delegation network and present a formal semantics for the delegation of access rights with certiicates. The certiicates can have multiple subjects who must jointly use the authority. Some fundamental properties of the system are proven, alternative techniques for authorization decisions are compared and their equivalence is shown rigorously. In particular, we prove that certiicate reduction is a sound and complete decision technique. We also suggest a new type of threshold certiicates and prove its properties. The formal model is used to develop eecient algorithms for access control decisions from a database of certiicates. Rank Xerox Oy:n rahasto, Telecom Finland Oy:n tutkimus-ja koulutussss-tii, and Kaupallisten ja teknisten tieteiden tukissstii are gratefully acknowledged .