School of Computing

The PERMIS X.509 Role Based Privilege Management Infrastructure

D.W. Chadwick and A. Otenko

In Proc 7th ACM Symposium On Access Control Models And Technologies (SACMAT 2002), Monterey, USA, pages 182-196, June 2002.

Abstract

This paper describes the output of the PERMIS project, which has developed a role based access control infrastructure that uses X.509 attribute certificates (ACs) to store the users� roles. All access control decisions are driven by an authorization policy, which is itself stored in an X.509 attribute certificate, thus guaranteeing its integrity. All the ACs can be stored in one or more LDAP directories, thus making them widely available. Authorization policies are written in XML according to a DTD that has been published at XML.org. The Access Control Decision Function (ADF) is written in Java and the Java API is simple to use, comprising of just 3 methods and a constructor. There is also a Privilege Allocator, which is a tool that constructs and signs attribute certificates and stores them in an LDAP directory for subsequent use by the ADF.

Download publication 45 kbytes (PDF)

Bibtex Record

@inproceedings{2085,
author = {D.W. Chadwick and A. Otenko},
title = {{T}he {PERMIS} {X}.509 {R}ole {B}ased {P}rivilege {M}anagement {I}nfrastructure},
month = {June},
year = {2002},
pages = {182-196},
keywords = {determinacy analysis, Craig interpolants},
note = {},
doi = {},
url = {http://www.cs.kent.ac.uk/pubs/2002/2085},
    publication_type = {inproceedings},
    booktitle = {Proc 7th ACM Symposium On Access Control Models And Technologies (SACMAT 2002), Monterey, USA},
}

School of Computing, University of Kent, Canterbury, Kent, CT2 7NF

Enquiries: +44 (0)1227 824180 or contact us.

Last Updated: 21/03/2014