WAVE: A Decentralized Authorization Framework with Transitive Delegation

Conference · Thu Aug 01 04:00:00 EDT 2019 · Proceedings of the 28th USENIX Security Symposium

OSTI ID:1772706

Andersen, Michael P. ^[1]; Kumar, Sam ^[2]; AbdelBaky, Moustafa ^[2]; Fierro, Gabe ^[2]; Kolb, John ^[2]; Kim, Hyung-Sin ^[2]; Culler, David E. ^[2]; Popa, Raluca Ada ^[2]

---

1. Univ. of California, Berkeley, CA (United States); CIEE/UC Berkeley
2. Univ. of California, Berkeley, CA (United States)

Most deployed authorization systems rely on a central trusted service whose compromise can lead to the breach of millions of user accounts and permissions. We present WAVE, an authorization framework offering decentralized trust: no central services can modify or see permissions and any participant can delegate a portion of their permissions autonomously. To achieve this goal, WAVE adopts an expressive authorization model, enforces it cryptographically, protects permissions via a novel encryption protocol while enabling discovery of permissions, and stores them in an un-trusted scalable storage solution. WAVE provides competitive performance to traditional authorization systems relying on central trust. Lastly, it is an open-source artifact and has been used for two years for controlling 800 IoT devices.

• Research Organization: Univ. of California, Berkeley, CA (United States)
• Sponsoring Organization: USDOE Office of Energy Efficiency and Renewable Energy (EERE), Energy Efficiency Office. Building Technologies Office
• DOE Contract Number: EE0007682
• OSTI ID: 1772706
• Conference Information: Journal Name: Proceedings of the 28th USENIX Security Symposium
• Country of Publication: United States
• Language: English

Related Subjects

32 ENERGY CONSERVATION, CONSUMPTION, AND UTILIZATION
Security