Certificate-based authorization policy in a PKI environment
The major emphasis of Public Key Infrastructure has been to provide acryptographically secure means of authenticating identities. However, procedures for authorizing the holders of these identities to perform specific actions still need additional research and development. While there are a number of proposed standards for authorization structures and protocols such as KeyNote, SPKI and SAML based on X.509 or other key-based identities, none have been widely adopted. As part of an effort to use X.509 identities to provide authorization in highly distributed environments, we have developed and deployed an authorization service based on X.509 identified users and access policy contained in certificates signed by X.509 identified stakeholders. The major goal of this system, called Akenti, is to produce a usable authorization system for an environment consisting of distributed resources used by geographically and administratively distributed users. Akenti assumes communication between user s and resources over a secure protocol such as Transport Layer Security(TLS) to provide mutual authentication with X.509 certificates. This paper explains the authorization model and policy language used by Akenti, and how we have implemented an Apache authorization module to provide Akenti authorization.
- Research Organization:
- Lawrence Berkeley National Lab. (LBNL), Berkeley, CA (United States)
- Sponsoring Organization:
- USDOE Director. Office of Science. Computational and Technology Research (US)
- DOE Contract Number:
- AC03-76SF00098
- OSTI ID:
- 821027
- Report Number(s):
- LBNL-51616; R&D Project: K52011; TRN: US200407%%145
- Journal Information:
- ACM Transactions on Information and System Security, Vol. 6, Issue 4; Other Information: Journal Publication Date: Nov. 2003; PBD: 15 Feb 2003
- Country of Publication:
- United States
- Language:
- English
Similar Records
Security Technologies for Open Networking Environments (STONE)
CILogon: A federated X.509 certification authority for cyberinfrastructure logon