Attribute certification: an enabling technology for delegation and role-based controls in distributed environments

In order to implement role-based controls in operational environments, they must be represented and managed in a secure manner, desirably leveraging other security infrastructure elements. Attribute certification is an emerging technology area, extending authenticationoriented public-key infrastructures (PIUS) to support authorization facilities. It allows a wide range of authorization decision criteria to be managed in a coordinated fashion. In particular, it offers facilities that can be applied usefully and effectively to manage and delegate role-related attributes within distributed and mutually suspicious computing environments, minimizing unnecessary trust in intermediaries. As such, its definition and adoption affords opportunities for increasing support of role-based policies, Consistent with separation of duties, it allows attribute management to be separated from identity and user management. This paper considers aspects of attribute certification, examines current proposals in the area, and assesses the technology’s value for controlled support of delegation and role-based policies within distributed environments.