A Formal Approach to Modelling Delegation Policy Based On Subject Attributes And Role Hierarchy

There are considerable number of approaches to policy specification both for security and policy driven network management. This specification sort security policies into two basic types: authorization and obligation policies. Most of the researches in security policies specification over the years focus on authorization policy modelling. In this paper, we report our approach in developing an information security policy model with specific emphasis on delegation of roles as a form of obligation policy. Whilst noting the previous research works on delegation modelling, we considered subjects and roles attributes in refining and formulating delegation relation attributes rules using concept of set theory. The work was further extended by developing a formal model for role hierarchy based on permissions and integrating it into the delegation model developed to eliminate flatness of subject roles. Future works proposed include the development of a formal model for revocation after delegation and extension of the model with the principle of separation of duties.