Key delegation for controlling access
It is provided a method for controlling access to an access object. The method is performed in an electronic key device and comprises the steps of: communicating with an access control device to obtain an identity of the access control device; sending an access request to a server, the access request comprising an identity of the electronic key device and the identity of the access control device; receiving a response from the server, the response comprising a key delegation to the electronic key device; and sending a grant access request to the access control device, the grant access request comprising the key delegation, to allow the access control device to evaluate whether to grant access to the access object based on a plurality of delegations comprising a sequence of delegations.
1. A method for controlling access to an access object, the method being performed in an access control device and comprising:
communicating with an electronic key device to provide an identity of the access control device;
receiving a grant access request from the electronic key device, the grant access request comprising a key delegation provided by a server to the electronic key device; and
evaluating, based on the key delegation, whether to grant access to the access object based on a plurality of delegations comprising a sequence of delegations covering a delegation path from the access control device to the electronic key device such that, in the sequence of delegations, the delegator of the first delegation is the access control device, and the last delegation is the key delegation, wherein each delegation is a delegation of an access right for the access object from a delegator to a receiver, and each delegation comprises a delegator identifier and a receiver identifier.
2. The method according to claim 1 , further comprising:
providing a delegation from the access control device to the server.
3. The method according to claim 1 , wherein each delegation is of a same data structure.
4. The method according to claim 1 , wherein the key delegation is digitally signed by the delegator of the key delegation.
5. The method according to claim 1 , wherein the key delegation comprises a time constraint.
6. The method according to claim 1 , wherein the key delegation comprises an operation constraint.
7. An access control device for controlling access to an access object, the access control device being configured to:
communicate with an electronic key device to provide an identity of the access control device;
receive a grant access request from the electronic key device, the grant access request comprising a key delegation provided by a server to the electronic key device; and
evaluate, based on the key delegation, whether to grant access to the access object based on a plurality of delegations comprising a sequence of delegations covering a delegation path from the access control device to the electronic key device such that, in the sequence of delegations, the delegator of the first delegation is the access control device, and the last delegation is the key delegation, wherein each delegation is a delegation of an access right for the access object from a delegator to a receiver, and each delegation comprises a delegator identifier and a receiver identifier.
8. The access control device according to claim 7 , wherein the access control device is further configured to:
provide a delegation from the access control device to the server.
9. The access control device according to claim 7 , wherein each delegation is of a same data structure.
10. The access control device according to claim 7 , wherein the key delegation is digitally signed by the delegator of the key delegation.
11. The access control device according to claim 7 , wherein the key delegation comprises a time constraint.
12. The access control device according to claim 7 , wherein the key delegation comprises an operation constraint.