Abstract: Authentication and authorization are the important technologies to ensure the secure access to the Web resources, and the delegation can strengthen the dynamicity, flexibility and scalability of authorization mechanism. OAuth (open authorization) 2.0 specification defines an open delegation authorization framework and is used in a wide variety of applications, but it is not applicative to the scenarios that require stronger security properties. By extending the functionalities of the OAuth 2.0, a secure delegation authorization framework for the Web application environment is proposed. In the proposed framework, the scheme of client authentication to the resource server is proposed based on the proof-of-possession (PoP) security mechanism, and the method to bind PoP key to PoP token is described. Finally, the related issues in the framework such as the overall architecture, the abstract implementation flow and the revocation of delegation are discussed in detail.

Key words: open authorization (OAuth) framework, delegation, authorization, authentication, proof-of-possession