Abstract
Defined-trust Domains (DtD) are a type of Limited Domain [RFC8799] where the rules specifying the networking of application information are defined in a communications schema that governs the information exchanged in a particular Limited Domain. Member identities are distributed within the Domain as a chain of trust, public certificates that have each been signed by the signing key associated with the next certificate in the chain and, at the root, signed by the trust anchor of the DtD. This approach is detailed in [DTD,DTLD,DFT,IOTK,TST] and example implementations using a Defined-trust Transport (DeftT) that handles communications and presents a publish/subscribe API are available at [DCT]. Members are configured with DtD identity credentials in the form of a certificate chain along with a integrity-secured rules schema that defines identities and publications that are legal in the DtD; certificates have a Validity Period. The private signing key of an identity certificate is securely configured.
A DtD that needs to remove an identity’s membership before it expires needs a decommissioning method. Decommissioning effectively revokes an identity’s membership in a DtD. DtD decommissioning makes use of a DtD’s certificate collection to quickly (the same speed as the domain’s packet communications) and efficiently communicate about identity certificates that should be decommissioned before their expiration time. This document describes Defined-trust identity decommissioning of particular identities earlier than their expiration times and makes it possible to require a higher privilege to decommission identities than to create them.
Creative Commons License
This work is licensed under a Creative Commons Attribution 4.0 License.
Recommended Citation
Nichols, Kathleen, "Decommissioning Identities in a Defined-trust Domain", Technical Disclosure Commons, (March 30, 2026)
https://www.tdcommons.org/dpubs_series/9663