1,462 research outputs found
The PERMIS X.509 Based Privilege Management Infrastructure
This document describes the PERMIS X.509 Based Privilege Management Infrastructure, which is a trust management system as described in RFC 2704 [2]. The PERMIS Infrastructure is compared with the AAA Authorisation Framework described in RFC 2904 [4], and is shown to be compatible with it
Internet X.509 Public Key Infrastructure Operational Protocols -- LDAPv3
This document describes the features of the Lightweight Directory Access Protocol v3 that are needed in order to support a public key infrastructure based on X.509 certificates and CRLs
A Method for Collecting Case Study Information via the Internet
The Internet is rapidly becoming the communications infrastructure. With its advantages of speed, availability, and `different time, different place' mode of communication, it can be successfully harnessed to accomplish tasks that previously required face-to-face meetings. Such meetings can consume large travel budgets and staff time, and therefore alternative mechanisms that achieve the same results for less cost should be welcomed. One of these new uses of the Internet is to collect case study material. This paper presents a method that has been successfully employed by the author to collect 15 case studies of X.500 implementations. The method described herein consists of three phases: preparation, correspondence and documentation phases. Each of the phases is described, and the author also presents useful tips that he gained during the course of his studies. The method should provide future researchers with a framework which can be successfully employed to productively utilise the resources of the Internet
Important Lessons Derived from X.500 Case Studies
X.500 is a new and complex electronic directory technology, whose basic specification was first published as an international standard in 1988, with an enhanced revision in 1993. The technology is still unproven in many organisations. This paper presents case studies of 15 pioneering pilot and operational X.500 based directory services. The paper provides valuable insights into how organisations are coming to understand this new technology, are using X.500 for both traditional and novel directory based services, and consequently are deriving benefits from it. Important lessons that have been learnt by these X.500 pioneers are presented here, so that future organisations can benefit from their experiences. Factors critical to the success of implementing X.500 in an organisation are derived from the studies
The Trusted Attribute Aggregation Service (TAAS)-Providing an Attribute Aggregation Layer for Federated Identity Management
Enabling the Internet White Pages Service -- the Directory Guardian
The Internet White Pages Service (IWPS) has been slow
to materialise for many reasons. One of them is the
security concerns that organisations have, over allowing
the public to gain access to either their Intranet or their
directory database. The Directory Guardian is a firewall
application proxy for X.500 and LDAP protocols that is
designed to alleviate these fears. Sitting in the firewall
system, it filters directory protocol messages passing into
and out of the Intranet, allowing security administrators
to carefully control the amount of directory information
that is released to the outside world. This paper describes
the design of our Guardian system, and shows how
relatively easy it is to configure its filtering capabilities.
Finally the paper describes the working demonstration of
the Guardian that was built for the 1997 World
Electronic Messaging Association directory challenge.
This linked the WEMA directory to the NameFLOWParadise
Internet directory, and demonstrated some of
the powerful filtering capabilities of the Guardian
Distributed Key Management for Secure Role Based Messaging
Secure Role Based Messaging (SRBM) augments messaging systems with role oriented communication in a secure manner. Role occupants can sign and decrypt messages on behalf of roles. This paper identifies the requirements of SRBM and recognises the need for: distributed key shares, fast membership revocation, mandatory security controls and detection of identity spoofing. A shared RSA scheme is constructed. RSA keys are shared and distributed to role occupants and role gate keepers. Role occupants and role gate keepers must cooperate together to use the key shares to sign and decrypt the messages. Role occupant signatures can be verified by an audit service. A SRBM system architecture is developed to show the security related performance of the proposed scheme, which also demonstrates the implementation of fast membership revocation, mandatory security control and prevention of spoofing. It is shown that the proposed scheme has successfully coupled distributed security with mandatory security controls to realize secure role based messaging
- âŠ