Symmetric Delegation Mechanism for Authorization Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Authorization languages that support delegation of authority are vulnerable to probing attacks, where attackers can infer secret facts by submitting credentials and observing responses, due to an asymmetry in delegation mechanisms where the delegator consents to import but not export facts, allowing unauthorized access to confidential information.
Innovation Solution
A modified delegation mechanism is introduced, requiring three assertions: the delegator's consent to import, the delegatee's consent to export, and the actual fact assertion, restoring symmetry and preventing probing attacks by ensuring the delegatee's consent is necessary for fact export.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If authorization languages allow submitted credentials to contain conditions (delegation of authority), then the expressiveness and flexibility of the authorization language is improved, but the system becomes vulnerable to probing attacks where attackers can infer secret facts
Solution Approach 1:
The patent applies asymmetry by introducing a directional consent mechanism where the delegator's consent to import facts is asymmetrically paired with the delegatee's consent to export facts. This creates a controlled asymmetry that allows expressive delegation while preventing unauthorized information flow. The asymmetric consent structure ensures that facts can only flow from delegatee to delegator when both parties explicitly consent, thereby preventing probing attacks while maintaining language expressiveness.
2Adaptability or versatility
If the authorization policy allows credentials with conditions about other entities' credentials, then the trust management capability is improved, but attackers can infer knowledge about secret facts by observing query responses
Solution Approach 1:
The patent introduces consent assertions as an intermediary mechanism that mediates between credential verification and fact inference. The consent assertion acts as a gatekeeper that explicitly permits or blocks the flow of facts between entities. This intermediary structure allows the system to maintain trust management capabilities while preventing unauthorized inference of secret facts, as the consent mechanism controls what information can be legitimately derived from credential evaluations.
3Ease of operation
If delegation of authority is allowed without export consent, then the ease of operation is improved, but the security against unauthorized fact export is worsened
Solution Approach 1:
The patent applies preliminary action by requiring the delegatee to provide export consent in advance before any facts can be exported. This preliminary consent assertion is evaluated before the delegation takes effect, ensuring that the delegatee has explicitly authorized the export of facts. This approach maintains ease of operation by streamlining the delegation process while enhancing security through the preliminary consent check that prevents unauthorized fact export.
Data Source
AI summary
Delegation-based authorization is described. In one example, a reference monitor receives from a first entity a request and a credential statement comprising a delegation of authority over a fact to a further entity. An authorization node then determines whether the further entity consents to provide the fact to the first entity and evaluates the request in accordance with an authorization policy and the credential statement. In another example, an assertion comprising a statement delegating authority over a fact to a further entity is received at an authorization node from a first entity. An authorization policy is then used to determine that the first entity vouches for the fact if each of these conditions are met: i) the first entity consents to import the fact from the further entity, ii) the further entity consents to export the fact to the first entity, and iii) the further entity asserts the fact.