RBAC on the Web by smart certificates

We have described in another paper how to develop and use smart certi cates by extending X.509 with several sophisticated features for secure attribute services on the Web. In this paper, we describe an implementation of RBAC (Role-Based Access Control) with role hierarchies on the Web as one possible application of smart certi cates. To support RBAC, we issued smart certi cates which hold the subjects' role information and con gured a Web server to use the role information in the certi cate instead of identities for its access control mechanism. Since the subjects' role information is provided integrity, the Web server can trust the role information after authentication and certi cate veri cation by SSL, and uses it for role-based access control. To maintain compatibility with existing technologies, such as SSL, we used a bundled (containing the subject's identity and role information) smart certi cate in the user-pull model.