Access control meets public key infrastructure, or: assigning rolesto strangers
Herzberg, A.; Mass, Y.; Mihaeli, J.; Naor, D.; Ravid, Y.
Security and Privacy, 2000. S&P 2000. Proceedings. 2000 IEEE Symposium on
Volume , Issue , 2000 Page(s):2 - 14
Digital Object Identifier 10.1109/SECPRI.2000.848442
Summary:The Internet enables connectivity between many strangers: entities
that don't know each other. We present the Trust Policy Language (TPL),
used to define the mapping of strangers to predefined business roles,
based on certificates issued by third parties. TPL is expressive enough
to allow complex policies, e.g. non-monotone (negative) certificates,
while being simple enough to allow automated policy checking and
processing. Issuers of certificates are either known in advance, or
provide sufficient certificates to be considered a trusted authority
according to the policy. This allows bottom-up, “grass
roots” buildup of trust, as in the real world. We extend, rather
than replace, existing role based access control mechanisms. This
provides a simple, modular architecture and easy migration from existing
systems. Our system automatically collects missing certificates from
peer servers. In particular this allows use of standard browsers, which
pass only one certificate to the server. We describe our implementation,
which can be used as an extension of a Web server or as a separate
server with interface to applications
View citation and abstract |
Cart
