A Decentralized Authorization Architecture

We present a decentralized authorization architecture based on capabilities in which parties are able to exercise full control over their resources and delegate it in an ad-hoc manner. In our architecture data objects are encrypted and capabilities are used to gain access to them directly. Data storage can then be decoupled from access to the stored data. Capabilities are also protected by encryption, so that they can be distributed to principals not authorized to use them. Replication and distribution can therefore be used to increase the availability not only of the data objects but of the authorization architecture itself to cope with disconnections and, in general, to adapt to changes of network topology typical of loosely coupled systems such as peer-to-peer networks and collaborative systems.