# SoK: Delegated Security in the Internet of Things
## 4 Formalisation of the Security Properties
### Rights Delegation  
Assume that \(\exists\mathsf{id},\mathsf{i}:(\mathsf{id},\mathsf{i})\in M\) and \(\exists\,\mathcal{RP}(\mathsf{id},\mathsf{id}_{\mathcal{D}},\mathsf{i})\in L\), then, according to right delegation scenario, a party \(\mathcal{P}_{\mathsf{id}}\) (RC system) possesses some kind of rights related to a resource \(\mathcal{R}_{i}\) owned by a third party \(\mathcal{TP}\). A delegate \(\mathcal{D}\) wants to access \(\mathcal{R}_{i}\) and in order to be able to do it, it requests the rights from \(\mathcal{P}_{\mathsf{id}}\). In turn, \(\mathcal{P}_{\mathsf{id}}\) sends a \(\mathcal{RP}=\mathcal{RP}(\mathsf{id},\mathsf{id}_{\mathcal{D}},\mathsf{i})\) to \(\mathcal{D}\), so it can request access to \(\mathcal{R}_{i}\) from \(\mathcal{TP}\) and interact with it on its own.  
The goal of an adversary \(\mathcal{A}\) is to win the security game described in Definition 5, such that winning ensures that the confidentiality, integrity, and/or availability properties are violated.  
Definition 5: Let \(\Pi\) be a rights delegation protocol, and \(\mathsf{RD}\) be the following experiment:  
1. Initialising \(M\), \(F\), \(H\), \(L\), \(S\).
2. \(\mathcal{A}\) receives as input the access matrix \(M\) or \(F\).
3. \(\mathcal{A}\) is assigned identifier \(\mathsf{id}_{\mathcal{A}}\).
4. \(\mathcal{A}\) can query the following oracles: \[\{\mathsf{t},\bot\} \leftarrow\mathtt{ThP}(\mathsf{id},\mathsf{id}_{\mathcal{D}}, \mathsf{i},\mathcal{RP}(\mathsf{id},\mathsf{id}_{\mathcal{D}},\mathsf{i})),\] \[\{\mathsf{s},\bot\} \leftarrow\mathtt{Cor}(\mathsf{id}),\text{ and}\] \[\{\mathsf{ts},\bot\} \leftarrow\mathtt{Obs}(\mathsf{id}),\] where \(\mathsf{id}\) identifies an RC system party \(\mathcal{P}_{\mathsf{id}}\) which transfers its rights related to resource \(\mathcal{R}_{i}\) owned by \(\mathcal{TP}\), \(\mathsf{id}_{\mathcal{D}}\) identifies a delegate \(\mathcal{D}\) which obtains rights by possessing proof of rights \(\mathcal{RP}\) from \(\mathcal{P}_{\mathsf{id}}\).
5. \(\mathcal{A}\) wins if any of the following cases hold: * Confidentiality: \(\mathcal{A}\) outputs a resource identifier \(\mathsf{i}\) and a token \(\mathsf{t}\), such that 1. \(\mathcal{A}\) is not allowed to access \(\mathcal{R}_{i}\) according to \(M\), and 2. \(\mathcal{A}\) with \(\mathcal{RP}(\mathsf{id},\mathsf{id}_{\mathcal{A}},\mathsf{i})\) is not allowed to access \(\mathcal{R}_{i}\) according to \(L\), but 3. \(\mathcal{TP}\) grants \(\mathcal{A}\) access to \(\mathcal{R}_{i}\) when provided with \(\mathsf{t}\) and \(\mathcal{RP}(\mathsf{id},\mathsf{id}_{\mathcal{A}},\mathsf{i})\).
* Integrity: \(\mathcal{A}\) outputs a resource identifier \(\mathsf{i}\), token \(\mathsf{t}\), and a modified item \(\mathsf{h}_{\mathcal{A}}\) such that 1. \(\mathcal{P}_{\mathsf{id}}\) has access to \(\mathcal{R}_{i}\), and 2. \(\mathcal{A}\) is not allowed to access \(\mathcal{R}_{i}\) according to \(M\), and 3. \(\mathcal{A}\) with \(\mathcal{RP}(\mathsf{id},\mathsf{id}_{\mathcal{A}},\mathsf{i})\) is not allowed to access \(\mathcal{R}_{i}\) according to \(L\), but 4. \(\exists\mathsf{h}_{\mathcal{A}}\) does not match corresponding item \(\mathsf{h}\in H\).
* Availability: \(\mathcal{A}\) outputs a resource identifier \(\mathsf{i}\) and token \(\mathsf{t}\), such that 1. \(\mathcal{P}_{\mathsf{id}}\) is allowed to access \(\mathcal{R}_{i}\) according to \(M\), and 2. \(\mathcal{D}\) with \(\mathcal{RP}(\mathsf{id},\mathsf{id}_{\mathcal{D}},\mathsf{i})\) is allowed to access \(\mathcal{R}_{i}\) according to \(L\), but 3. \(\mathcal{TP}\) does not grants \(\mathcal{D}\) access to \(\mathcal{R}_{i}\) when provided with \(\mathsf{t}\) and \(\mathcal{RP}(\mathsf{id},\mathsf{id}_{\mathcal{D}},\mathsf{i})\).