WAVE: A Decentralized Authorization Framework with Transitive Delegation
Most deployed authorization systems rely on a central trusted service whose compromise can lead to the breach of millions of user accounts and permissions. We present WAVE, an authorization framework offering decentralized trust: no central services can modify or see permissions and any participant can delegate a portion of their permissions autonomously. To achieve this goal, WAVE adopts an expressive authorization model, enforces it cryptographically, protects permissions via a novel encryption protocol while enabling discovery of permissions, and stores them in an un-trusted scalable storage solution. WAVE provides competitive performance to traditional authorization systems relying on central trust. Lastly, it is an open-source artifact and has been used for two years for controlling 800 IoT devices.