Certificate-based authorization policy in a pki environment

ACM Transactions on Information and System Security

Volumn 6, Issue 4, 2003, Pages 566-588

  Thompson, Mary R ^a   Essiari, Abdelilah ^a   Mudumbai, Srilekha ^a  

^a LAWRENCE BERKELEY NATIONAL LABORATORY   (United States)

Author keywords

Digital certificates; Public key infrastructure; XML

Indexed keywords

AUTHENTICATION; AUTHORIZATION; DIGITAL CERTIFICATES; PUBLIC KEY INFRASTRUCTURE;

COMPUTER OPERATING SYSTEMS; INTERFACES (COMPUTER); MATHEMATICAL MODELS; NETWORK PROTOCOLS; PUBLIC KEY CRYPTOGRAPHY; PUBLIC POLICY; SECURITY OF DATA; WORLD WIDE WEB; XML;

SOFTWARE ENGINEERING;

EID: 2942654406     PISSN: 10949224     EISSN: None     Source Type: Journal    
DOI: 10.1145/950191.950196     Document Type: Article

References (44)

1. AGARWAL, D. A., SACHS, S. R., AND JOHNSTON, W. E. 1998. The reality of collaboratories. Computer Physics Communications, 110, 134-141.
2. AKENTI.XSD. 2003. Akenti certificate schema. http://www-itg.lbl.gov/ Akenti/docs/AkentiCertificate.xsd.
3. ALFIERI, R., CECCHINI, R., CIASCHINI, V., DELL'AGNELLO, L., FROHNER, A., GIANOLI, A., LORENTEY, K., AND SPATARO, F. 2003. VOMS, an authorization system for virtual organizations Presented at the 1st European Across Grids Conference, Santiago de Compostela, February 13-14, 2003.
4. APACHE. 2002a. Apache software foundation, http://www.apache.org.
5. APACHE. 2002b. Apache module registry. http://modules.apache.org/.
6. APACHE. 2002c. Apache XML project. http://xml.apache.org/.
7. ARSENAULT, A. AND TURNER, S. 2002. Internet X.509 public key infrastructure: roadmap internet draft, draft-ietf-pkix-roadmap-09.txt July 2002. http://www.ietf.org/internet-drafts/draft-ietfpkix-roadmap-09.txt.
8. BELANI, E., VAHDAT, A., ANDERSON, T., AND DAHLIN, M. 1998. The CRISIS wide area security architecture. In Proceedings of the USENIX Security Symposium, San Antonio, Texas, January 1998.
9. BLAZE, M., FEIGENBAUM, J., IOANNIDIS, J., AND KEROMYTIS, A. 1999. The KeyNote trust management system, version 2. IETF RFC-2704. http://www.crypto. com/papers/rfc2704.txt.
10. DIERKS, T. AND ALLEN, C. 1999. The TLS protocol, version 1. IETF RFC 2246. http://www.ietf.org/rfc/rfc2246.txt.
11. 2. http://www.llnl.gov/asci/ discom/.
12. ELLISON, C. 1999. SPKI requirements. IETF RFC 2692. http://www.ietf.org/ rfc/rfc2692.txt.
13. ERDOS, M. AND CANTOR, S. 2002. Shibboleth-architecture draft, v05. http://middleware.internet2.edu/shibboleth/docs/draft-internet2-shibboleth-arch- 05.pdf
14. FAHRELL, S. AND HOUSLEY, R. 2001. An Internet attribute certificate profile for authorization. draft-ietf-pkix-ac509prof-09.txt June 2001. http://www.ietf.org/internet-drafts/draft-ietfpkix-ac509prof-09.txt.
15. FOSTER, I. AND KESSELMAN, C. (eds.). 1999. The Grid: Blueprint for a New Computing Infrastructure. Morgan Kaufmann, San Mateo, CA.
16. FOSTER, I., KESSELMAN, C., AND TUECKE, S. 2001. The anatomy of the Grid: Enabling scalable virtual organizations. International J. Supercomputer Applications 15, 3. http://www.globus.org/.
17. FRANKS, J., HALLAM-BAKER, P., HOSTETLER, J., LAWRENCE, S., LEACH, P., LUOTONEN, A., AND STEWART, L. 1999. HTTP authentication: Basic and digest access authentication. IETF RFC2617. http://www.ietf.org/rfc/rfc2617.txt
18. GODIK, S. AND MOSES, T. 2003. extensible access control markup language (XACML), version 1.0, oasis-xamcl-1.0.pdf. http://www.oasis-open.org/committees/ xacml/repository/oasis-xamcl-1.0.pdf.
19. GOLAND, Y., WHITEHEAD, E., FAIZI, A., CARTER, S., AND JENSEN, D. 1999. HTTP extensions for distributed authoring-WEBDAV. IETF RFC2518. http://www.ietf.org/rfc/rfc2518.txt.
20. HALLAM-BAKER, P. AND MALER, E. (eds.). 2002. Assertions and protocol for the OASIS security assertion markup language (SAML), draft-ssct-core-31. http://www.oasis-open.org/committees/security/docs/draft-ssct-core-31.pdf.
21. HODGES, J. AND WAYSON, T. 2003. Liberty architecture overview. http://www.projectliberty.org.
22. HOUSLEY, R., POLK, W., FORD, W., AND SOLO, D. 2001. Internet X.509 public key infrastructure certificate and CRL profile, draft-ietf-pkix-new-part1-12. txt. http://www.ietf.org/internet-drafts/draft-ietf-pkix-new-part1-12.txt.
23. IPG. 2002. NASA's information power grid, http://www.ipg.nasa.gov/.
24. KEAHEY, K., FREDIAN, T., PENG, Q., SCHISSEL, D. P., THOMPSON, M., FOSTER, I., GREENWALD, M., AND MCCUNE, D. 2001. Computational grids in action: The National Fusion Collaborator. Future Generation Computer System. http://www.fusiongrid.org.
25. KOHL, J. AND NEUMAN, B. C. 1993. The Kerberos network authentication service (version 5). Internet request for comments RFC-1510.
26. LAUNCH. PAD. 2002. Portal to the IPG. http://www.ipg.nasa.gov/launchpad/ servlet/launchpad.
27. LAMPSON, B., ABADI, M., BURROWS, M., AND WOBBER, E. 1992. Authentication in distributed systems: Theory and practice. ACM Trans. Computer Systems 10, 4 (Nov.), 265-310.
28. LEVY, H. M. 1984. Capability-Based Computer Systems. Digital Press, Bedford, MA. On-line at http://www.cs.washington.edu/homes/levy/capabook/.
29. MODSSL. 2002. http://www.modssl.org/.
30. MUDUMBAI, S. 2002. mod_akenti: Akenti access control module for Apache. http://www-itg.lbl.gov/Akenti/docs/mod.akenti.html.
31. NEUMAN, B. C. 1993. Proxy-based authorization and accounting for distributed systems. In Proceedings of 13th International Conference on Distributed Computing Systems, 283-291.
32. NEUMAN, B. C. AND Ts'o, T. 1994. Kerberos: An authentication service for computer networks. IEEE Communications, 32, 9, 33-38.
33. NFC. 2002. National Fusion Grid. http://www.fusiongrid.org/.
34. PANCERELLA, C., RAHN, L., AND YANG, C. 1999. The diesel combustion collaboratory: Combustion researchers collaborating over the Internet. In Proceedings of ACM/IEEE SC99 Conference, November 13-19, 1999, Portland, Oregon, USA. http://www-collab.ca.sandia.gov/dcc/.
35. PEARLMAN, L., WELCH, V., FOSTER, I., KESSELMAN, C., AND TUECKE, S. 2002. A community authorization service for group collaboration. In Proceedings of the IEEE 3rd International Workshop on Policies for Distributed Systems and Networks. http://www.globus.org/research/papers.html#CAS-2002.
36. PPDG. 2002. Particle Physics Data Grid, http://www.ppdg.net/.
37. OASIS. 2002. www.oasis-open.org.
38. RYUTOV, T., GHEORGHUI, G., AND NEUMAN, B. C. 1999. An authorization framework for metacomputing applications. Cluster Computing. 2, 2, 165-175.
39. RYUTOV, T. AND NEUMAN, B. C. 2000. Access control framework for distributed applications, IETF draft work-in-progress draft-ietf-cat-acc-cntrl- frmw-05.txt.
40. THAU, R. 2002. Apache API notes. http://modules.apache.org/doc/API.html.
41. THOMPSON, M., JOHNSTON, W., MUDUMBAI, S., HOO, G., JACKSON, K., AND ESSIARI, A. 1999. Certificate-based access control for widely distributed resources. In Proceedings of the 8th Usenix Security Symposium, Aug. 1999.
42. TUECKE, S., ENGERT, D., FOSTER, I., WELCH, V., THOMPSON, M., PEARLMAN, L., AND KESSELMAN, C. 2002. Internet X.509 public key infrastructure proxy certificate profile. IETF draft. http://ww.ietf.org/internet-drafts/draft-ietf- pkix-proxy-03.txt.
43. WAINWRIGHT, P. 2001, Professional apache, Wrox 2001. http://www.apache. org/.
44. WOO, T. Y. C. AND LAM, S. S. 1993. A Framework for distributed authorization. In Proceedings of the ACM conference on Computer and Communications Security, Fairfax, VA.