Access control in an open distributed environment

Abstract

We describe a n a r chitecture for secure, independent, interworking services Oasis. Each service i s made responsible for the classi cation of its clients into named roles, using a formal logic to specify precise conditions for entering each role. A client becomes authenticated by presenting credentials to a service that enable the service to prove that the client conforms to its policy for entry to a particular role. During authentication a data structure i s created that embodies the proof.An authenticated client is issued a r ole membership certi cate RMC for its subsequent use with that service. An RMC is an encryption-protected capability which includes the role name, the identity of the principal to which it was issued and a reference to the issuing service. A p r oof rule of one service may refer to an authenticated user of another; that is, an RMC issued by one service may be r equired a s a c r edential during authentication by another. A dynamic proof tree may thus be built which exhibits amongst other things the trust relationships between the services which the client has entered.The rst part of the paper shows how a service may de ne a set of proof rules Horn clauses that specify who may use it and in what way. Delegation of rights may be expressed naturally within these rules.The second part of the paper presents the design details of the system. Associated with each RMC issued by a service, the service keeps a credential record CR. The CR indicates the predicates against which the RMC was issued and lists all other services which have issued RMCs to this principal based on this CR. If one of these predicates becomes false, the local RMC is immediately invalidated. Event technology is used to achieve rapid revocation of the dependent RMCs issued by other services; any portion of a proof tree which is based on this predicate collapses.The system is inherently decentralised and has a tuneable reaction to network or server failure which allows services to make appropriate decisions when authorization or revocation information is unavailable.A prototype system has been implemented and tested.

CODEX: a robust and secure secret distribution system

“…CODEX does not include an implementation for |= θ nor does it fix a representation for credentials. However, contemporary authorization engines, like SDSI [35], KeyNote [2] or the work of Hayton et al [23], do provide such implementations and could well be incorporated into CODEX. CODEX associates a separate authorization policy with each of the three operations it supports.…”

Access Control and Trust in the Use of Widely Distributed Services

“…The credential record reference (CRR) in the RMC allows the issuer and the CR to be located. Details of how the CR might be designed were given in [9]. [10] discussed engineering issues for OASIS implementations in administrative domains that span many individual services.…”

Regularity-Based Trust in Cyberspace

“…If the community subject to this policy is small enough, then such enforcement can sometimes be carried out by employing a trusted third party (TTP) to function as a kind of reference monitor [1], which mediates all the interactions subject to it. This has been done by several projects [3,12], mostly in the context of distributed enterprise systems. But if the community is large, as is often the case over the internet, then the use of a single reference monitor is inherently unscalable, since it constitute a dangerous single point of failure, and could become a bottleneck if the system is large enough.…”