An Advanced Policy Based Authorisation Infrastructure

David Chadwick; Kaniz Fatema

doi:10.1145/1655028.1655045

An Advanced Policy Based Authorisation Infrastructure

David Chadwick, Kaniz Fatema

Computer Science

Research output: Chapter in Book/Published conference output › Conference publication

Abstract

We describe a more advanced authorisation infrastructure for identity management systems which in addition to the traditional Policy Enforcement Point (PEP) and Policy Decision Point (PDP) has an application independent policy enforcement point (AIPEP), a credential validation service (CVS) and a master PDP. The AIPEP is responsible for handling sticky policies, calling the master PDP, performing application independent obligations, and validating credentials using the CVS. The master PDP is responsible for calling multiple traditional PDPs that support a variety of policy languages, and resolving conflicts between the various authorisation decisions. Whilst this authorisation infrastructure may seem more complex to implement, it is in fact easier for applications to integrate since nearly all of the complexity is hidden beneath the PEP interface.

Original language	English
Title of host publication	DIM '09: Proceedings of the 5th ACM workshop on Digital identity management
Publisher	ACM
Pages	81-84
ISBN (Print)	978-1-60558-786-8
DOIs	https://doi.org/10.1145/1655028.1655045
Publication status	Published - Nov 2009

Access to Document

10.1145/1655028.1655045

Cite this

@inproceedings{7dceba4865aa40a4b66df9b03f39d764,

title = "An Advanced Policy Based Authorisation Infrastructure",

abstract = "We describe a more advanced authorisation infrastructure for identity management systems which in addition to the traditional Policy Enforcement Point (PEP) and Policy Decision Point (PDP) has an application independent policy enforcement point (AIPEP), a credential validation service (CVS) and a master PDP. The AIPEP is responsible for handling sticky policies, calling the master PDP, performing application independent obligations, and validating credentials using the CVS. The master PDP is responsible for calling multiple traditional PDPs that support a variety of policy languages, and resolving conflicts between the various authorisation decisions. Whilst this authorisation infrastructure may seem more complex to implement, it is in fact easier for applications to integrate since nearly all of the complexity is hidden beneath the PEP interface.",

author = "David Chadwick and Kaniz Fatema",

year = "2009",

month = nov,

doi = "10.1145/1655028.1655045",

language = "English",

isbn = "978-1-60558-786-8",

pages = "81--84",

booktitle = "DIM '09: Proceedings of the 5th ACM workshop on Digital identity management",

publisher = "ACM",

address = "United States",

}

TY - GEN

T1 - An Advanced Policy Based Authorisation Infrastructure

AU - Chadwick, David

AU - Fatema, Kaniz

PY - 2009/11

Y1 - 2009/11

N2 - We describe a more advanced authorisation infrastructure for identity management systems which in addition to the traditional Policy Enforcement Point (PEP) and Policy Decision Point (PDP) has an application independent policy enforcement point (AIPEP), a credential validation service (CVS) and a master PDP. The AIPEP is responsible for handling sticky policies, calling the master PDP, performing application independent obligations, and validating credentials using the CVS. The master PDP is responsible for calling multiple traditional PDPs that support a variety of policy languages, and resolving conflicts between the various authorisation decisions. Whilst this authorisation infrastructure may seem more complex to implement, it is in fact easier for applications to integrate since nearly all of the complexity is hidden beneath the PEP interface.

AB - We describe a more advanced authorisation infrastructure for identity management systems which in addition to the traditional Policy Enforcement Point (PEP) and Policy Decision Point (PDP) has an application independent policy enforcement point (AIPEP), a credential validation service (CVS) and a master PDP. The AIPEP is responsible for handling sticky policies, calling the master PDP, performing application independent obligations, and validating credentials using the CVS. The master PDP is responsible for calling multiple traditional PDPs that support a variety of policy languages, and resolving conflicts between the various authorisation decisions. Whilst this authorisation infrastructure may seem more complex to implement, it is in fact easier for applications to integrate since nearly all of the complexity is hidden beneath the PEP interface.

UR - https://dl.acm.org/doi/abs/10.1145/1655028.1655045

U2 - 10.1145/1655028.1655045

DO - 10.1145/1655028.1655045

M3 - Conference publication

SN - 978-1-60558-786-8

SP - 81

EP - 84

BT - DIM '09: Proceedings of the 5th ACM workshop on Digital identity management

PB - ACM

ER -

An Advanced Policy Based Authorisation Infrastructure

Abstract

Access to Document

Other files and links

Fingerprint

Cite this