USENIX Conference Policies
Certificate-based Access Control for Widely Distributed Resources
We have implemented and deployed an access control mechanism that uses digitally-signed certificates to define and enforce an access policy for a set of distributed resources that have multiple, independent and geographically dispersed stakeholders. The stakeholders assert their access requirements in use-condition certificates and designate those trusted to attest to the corresponding user attributes. Users are identified by X.509 identity certificates. During a request to use a resource, a policy engine collects all the relevant certificates and decides if the user satisfies all the requirements. This paper describes the model, architecture and implementation of this system. It also includes some preliminary performance measurements and our plans for future development of the system.
author = {Mary R. Thompson and William Johnston and Srilekha Mudumbai and Gary Hoo and Keith Jackson and Abdelilah Essiari},
title = {Certificate-based Access Control for Widely Distributed Resources},
booktitle = {8th USENIX Security Symposium (USENIX Security 99)},
year = {1999},
address = {Washington, D.C.},
url = {https://www.usenix.org/conference/8th-usenix-security-symposium/certificate-based-access-control-widely-distributed},
publisher = {USENIX Association},
month = aug
}