PERMIS: a modular authorization infrastructure

Abstract

Authorization infrastructures manage privileges and render access control decisions, allowing applications to adjust their behavior according to the privileges allocated to users. This paper describes the PERMIS role-based authorization infrastructure along with its conceptual authorization, access control, and trust models. PERMIS has the novel concept of a credential validation service, which verifies a user's credentials prior to access control decision-making and enables the distributed management of credentials. PERMIS also supports delegation of authority; thus, credentials can be delegated between users, further decentralizing credential management. Finally, PERMIS supports history-based decision-making, which can be used to enforce such aspects as separation of duties and cumulative use of resources. Details of the design and the implementation of PERMIS are presented along with details of its integration with Globus Toolkit, Shibboleth, and GridShib. A comparison of PERMIS with other authorization and access control implementations is given, along with suggestions where future research and development are still needed.They provide facilities to manage user privileges, render access control decisions, and process the related information. Different types of policies may be supported, such as credential issuing policies, access control policies, delegation policies, and credential validation policies. These policies contain the rules and criteria that specify how user privileges (or credentials, which are digitally signed assertions made by some authority about a user's privileges) are managed and access control decisions are made. In the context of distributed Grid systems spanning multiple domains, policybased authorization systems bring a number of specific advantages such as: they can control the issuing of credentials in one domain and allow the autonomous delegation of privileges between users. They can then separately control the validation of these credentials in the resource domain, and allow each resource owner to independently say who he/she trusts to issue which credentials to whom, and which access rights these valid credentials should have. This is an important feature that most Grid systems today do not have.The authorization infrastructure that we have built is called PERMIS [1]. This paper describes the various components of the PERMIS authorization infrastructure, the conceptual models that lie behind them, and the standards that we have used. We conclude by comparing our work with that of others and by describing some of the future work that still needs to be done. The rest of this paper is structured as follows. Section 2 provides the conceptual models of our authorization infrastructure. Section 3 describes the design and implementation of PERMIS. Section 4 presents PERMIS's integration with Globus Toolkit (GT), Shibboleth, and GridShib. Section 5 compares PERMIS with other related research. Section 6 concludes and indicates our plans for the future. CONCEPTUAL MODELS The access control...

Virtual Organization Platform Interoperability Provides the Long Tail an eScience Environment

“…Privilege and Role Management Infrastructure Standards Validation (PERMIS) is a more ornate authorization model implementation that follows the principles of Role Based Access Control (RBAC) [9]. Attribute authorities in PERMIS are often independent and issue attributes that associate a role with a user.…”

Instant certificate revocation and publication using WebDAV

“…PERMIS [12,13] is an application independent privilege management infrastructure that comprises credential issuing and credential validation functionality as well as policy creation and policy decision making functionality. The components that are important to the current discussion are the Attribute Certificate Manager (ACM) and the Delegation Issuing Service (DIS), which both issue X.509 role ACs to holders, and the Credential Validation Service (CVS) which validates the issued role ACs (see Figure 2).…”

Dynamic VO Establishment in Distributed Heterogeneous Business Environments

“…In the case of PERMIS (Figure 6), the situation is more complex. PERMIS [8] provides a standalone authorization service (PERMIS Policy Decision Point), however it depends on the LDAP service which contains proper information in terms of Attribute Certificates and Policies. FiVO works with PERMIS by feeding an LDAP service with proper policies, generated automatically from policies which are part of the VO contract.…”