Access control policies are specified in terms of domain membership rather than individual identities so performance of domain membership verification is critical for the access control decision mechanism. This is crucial for TINA, since it is widely expected that the DPE kernel will be provided by at least one ORB system in each TINA administrative domain. The Solution to Security for Open Distributed Systems . Journal of Computer Communications, July 1994, 501-518. He differentiates bearer proxies from delegate proxies.
Proxies are delegation tokens.
Thus we focus here on the key based schemes. The generation of asymmetric keys can be cumbersome.