Non-delegatable authorities in capability systems

Article type: Research Article

Authors: Murray, Toby | Grove, Duncan

Affiliations: Command, Control, Communications and Intelligence Division, Defence Science and Technology Organisation, P.O. Box 1500, Edinburgh, 5111 South Australia. E-mails: [email protected], [email protected]

Abstract: We present a novel technique, known as the non-delegatable authority (NDA), for distributing authority to unconfined subjects in capability systems that prevents them from sharing the exact same authority that they have been given with anyone else. This feature is present in common systems based on access control lists (ACLs) in which one may hand out a permission without handing out the associated “grant” right, but has been thought to be impossible to express in capability systems until now. Consequently, we demonstrate that NDAs may be used to express ACL-like constructs and their basic pattern is directly applicable for implementing multi-level security and identity-based access controls in the object-capability model. The extra complexity introduced by our NDA implementation can be hidden behind constructs that allow NDAs to be wielded as if they were ordinary capabilities to the target resource. These constructs cannot break the non-delegatability constraint and allow NDAs to be used effectively, although with less efficiency than delegatable authorities.

Keywords: Controlling delegation, capability systems, identity-based access control, multi-level security

DOI: 10.3233/JCS-2008-0314

Journal: Journal of Computer Security, vol. 16, no. 6, pp. 743-759, 2008