Managing Revocation in Role Based Access Control Models Using Delegation Licences

The paper presents revocation schemes in role-based access control models. We are particularly interested in two key issues: how to perform the revocation and how to manage the revocation policy. We show how to deal with these two aspects in our delegation model based on the OrBAC formalism and its administration licence concept. This model provides means to manage several types of of delegations, such as the delegation or the transfer of permissions and roles, multi-step delegation and temporary delegation. We state formally in this paper how to manage the revocation of these delegations schemes. Our model supports a wide spectrum of the revocation dimensions such as propagation, dominance, dependency, automatic/user revocation, transfer revocation, role/permission revocation.