The PERMIS X.509 role based privilege management infrastructure

ABSTRACT

This paper describes the output of the PERMIS project, which has developed a role based access control infrastructure that uses X.509 attribute certificates (ACs) to store the users' roles. All access control decisions are driven by an authorization policy, which is itself stored in an X.509 attribute certificate, thus guaranteeing its integrity. All the ACs can be stored in one or more LDAP directories, thus making them widely available. Authorization policies are written in XML according to a DTD that has been published at XML.org. The Access Control Decision Function (ADF) is written in Java and the Java API is simple to use, comprising of just 3 methods and a constructor. There is also a Privilege Allocator, which is a tool that constructs and signs attribute certificates and stores them in an LDAP directory for subsequent use by the ADF.

REFERENCES

• 1: Carlisle Adams , Steve Lloyd, Understanding Public-Key Infrastructure: Concepts, Standards, and Deployment Considerations, Macmillan Technical Publishing, 1999
• 2: Tom Austin, PKI: A Wiley Tech Brief, John Wiley & Sons, Inc., New York, NY, 2000
• 3: Blaze, M., Feigenbaum, J., Ioannidis, J. "The KeyNote Trust-Management System Version 2", RFC 2704, September 1999.
• 4: David W. Chadwick , Alexander Otenko, RBAC Policies in XML for X.509 Based Privilege Management, Proceedings of the IFIP TC11 17th International Conference on Information Security: Visions and Perspectives, p.39-54, May 07-09, 2002
• 5: Nicodemos Damianou , Naranker Dulay , Emil Lupu , Morris Sloman, The Ponder Policy Specification Language, Proceedings of the International Workshop on Policies for Distributed Systems and Networks, p.18-38, January 29-31, 2001
• 6: Russ Housley , Tim Polk, Planning for PKI: Best Practices Guide for Deploying Public Key Infrastructure, John Wiley & Sons, Inc., New York, NY, 2001
• 7: ITU-T Rec. X.509 (2000) | ISO/IEC 9594-8 The Directory: Authentication Framework.
• 8: ITU-T Rec X.812 (1995) | ISO/IEC 10181-3:1996 "Security Frameworks for open systems: Access control framework.
• 9: Sandhu, R. and Samarati, P. "Access controls, principles and practice". IEEE Communications, 32(9), pp 40--48, 1994.
• 10: Ravi S. Sandhu , Edward J. Coyne , Hal L. Feinstein , Charles E. Youman, Role-Based Access Control Models, Computer, v.29 n.2, p.38-47, February 1996 [doi>10.1109/2.485845]
• 11: {AZN} The Open Group. "Authorization (AZN) API", January 2000, ISBN 1-85912-266-3.

INDEX TERMS

Primary Classification:
  C. Computer Systems Organization
  C.2 COMPUTER-COMMUNICATION NETWORKS
      C.2.0 General
          Subjects: Security and protection (e.g., firewalls)

Additional Classification:
  J. Computer Applications
  J.1 ADMINISTRATIVE DATA PROCESSING
      Subjects: Government

  K. Computing Milieux
  K.6 MANAGEMENT OF COMPUTING AND INFORMATION SYSTEMS
      K.6.5 Security and Protection (D.4.6, K.4.2)
          Subjects: Authentication

General Terms:
Design, Management, Security

Keywords:
Privilege management infrastructure, RBAC, X.509, XML, attribute certificates, authorization, policies