DISTRIBUTED AUTHORIZATION: PRINCIPLES AND PRACTICE

Design and management of authorization policies and service in distributed systems pose several challenges in practice. In this paper, first we discuss some of the key architectural principles involved in the design of a distributed authorization service. We consider the different types of authorization information involved, the ways of propagating them and their verification and management. Then we consider a language based approach to policy specification and outline the constructs of a simple language that can be used to specify a range of commonly used access policies. Then we propose a distributed authorization architecture and outline the various components involved in the provision of the authorization service. We discuss the issues involved in formulating a policy management framework and highlight the various design options and alternatives in a mechanism independent manner. Finally we apply this framework to a specific case of role based access control to illustrate its applicability.