School of Computing

A Heterogeneous Network Access Service based on PERMIS and SAML

Gabriel Lopez, Oscar Canovas, Antonio F Gomez-Skarmeta, Sassa Otenko, and David Chadwick

In Proceedings of 2nd EuroPKI Workshop, pages 182-196, University of Kent, July 2005.

Abstract

The expansion of inter-organizational scenarios based on different authorization schemes involves the development of integration solutions allowing different authorization domains to share, in some way, protected resources. This paper analyzes different emerging technologies. On the one hand, we have two XML-based standards, the SAML standard, which is being widely accepted as a language to express and exchange authorization data, and the XACML standard, which constitutes a promising framework for access control policies. On the other hand, PERMIS is a trust management system for X.509 attribute certificates and includes a powerful authorization decision engine governed by the PERMIS XML policy. This paper presents a sample scenario where domains using these technologies can be integrated allowing, for example, the use of attribute certificates in a SAML environment and the utilization of the PERMIS authorization engine to decide about the disclosure or concealment of attributes. In order to design this scenario we have based our work on a Credential Conversion Service (CCS) which is able to convert ACs into SAML attributes, and a User Attribute Manager (UAM) which controls the disclosure of credentials. These modules are governed by policies defining the conversion process (the Conversion Policy) and the disclosure of attributes (the Disclosure Policy).

Download publication 210 kbytes (PDF)

Bibtex Record

@inproceedings{2292,
author = {Gabriel Lopez and Oscar Canovas and Antonio F Gomez-Skarmeta and Sassa Otenko and David Chadwick},
title = {{A Heterogeneous Network Access Service based on PERMIS and SAML}},
month = {July},
year = {2005},
pages = {182-196},
keywords = {determinacy analysis, Craig interpolants},
note = {},
doi = {},
url = {http://www.cs.kent.ac.uk/pubs/2005/2292},
    publication_type = {inproceedings},
    submission_id = {6591_1131981758},
    booktitle = {Proceedings of 2nd EuroPKI Workshop},
    address = {University of Kent},
}

School of Computing, University of Kent, Canterbury, Kent, CT2 7NF

Enquiries: +44 (0)1227 824180 or contact us.

Last Updated: 21/03/2014