An authorization scheme for distributed object systems

Addresses the problem of distributed object system protection. A new authorization scheme is presented and described, based on the collaboration between a central authorization server and security kernels located on each site of the system. A novel approach to access rights management for such an architecture is detailed, based on a new kind of access rights and a new scheme of privilege delegation. This authorization scheme can be adapted to various security policies, including multilevel policies such as that of Bell & LaPadula (1975). An extension of the Bell-LaPadula model to distributed object systems is presented and its implementation using the authorization scheme is described.