Authorization certificate
In
The authorization certificate works in conjunction with a
Comparison of attribute and public key certificates
An AC resembles a PKC but contains no
The verification of an AC requires the presence of the PKC that is referred as the AC holder in the AC.
As with a PKC, an AC can be chained to delegate attributions. For example, an authorization certificate issued for Alice authorizes her to use a particular service. Alice can delegate this privilege to her assistant Bob by issuing an AC for Bob's PKC. When Bob wants to use the service, he presents his PKC and a chain of ACs starting from his own AC issued by Alice and then Alice's AC issued by the issuer that the service trusts. In this way, the service can verify that Alice has delegated her privilege to Bob and that Alice has been authorized to use the service by the issuer that controls the service. RFC 3281, however, does not recommend the use of AC chains because of the complexity in administering and processing the chain and there is little use of AC in the Internet.
Usage
To use a service or a resource that the issuer of an AC controls, a user presents both the PKC and the AC to a part of the service or resource that functions as an AC verifier. The verifier will first check the identity of the user using the PKC, for example, by asking the user to decrypt a message encrypted by the user's public key in the PKC. If the authentication is successful, the verifier will use the preinstalled public key of the AC issuer to check the validity of the presented AC. If the AC is valid, the verifier will check whether or not the PKC specified in the AC matches the presented PKC. If it matches, the verifier will check the validity period of the AC. If the AC is still valid, the verifier can perform additional checks before offering the user a particular level of service or resource usage in accordance to the attributes contained in the AC.
For example, a software developer that already has a
A user may also need to obtain several ACs from different issuers to use a particular service. For example, a company gives one of its employees a company-wide AC that specifies engineering department as the work area. To access engineering data, however, the employee also needs a security clearance AC from the head of the engineering department. In this example, the resource of engineering data needs to be preinstalled with the public keys of both the company-wide and the engineering department AC issuers.
Contents of a typical attribute certificate
Version: the version of the certificate.
Holder: the holder of the certificate.
Issuer: the issuer of the certificate.
Signature algorithm: the algorithm by which the certificate is signed.
Serial number: the unique issuance number given by the issuer.
Validity period: the validity period of the certificate.
Attributes: the attributes associated to the certificate holder.
Signature value: the signature of the issuer over the whole data above.
Benefits
Using attribute certificate, the service or resource
See also
- Public key certificate
- Attribute-based access control
- Security Assertion Markup Language
- Shibboleth
- Voms
References
- . Informational.
- ^ Farrell, S.; Housley, R. "An Internet Attribute Certificate Profile or Authorization". RFC 3281.
{{cite journal}}
: Cite journal requires|journal=
(help)