Certificate-based authorization policy in a PKI environment

TLDR

Public key infrastructure focuses on cryptographically secure identity authentication, yet research on authorizing those identities for specific actions remains limited and existing standards such as KeyNote, SPKI, and SAML have seen little adoption. This work introduces Akenti, an X.509‑based authorization service that embeds access policy in certificates to enable a usable, distributed authorization system for geographically and administratively dispersed users. Akenti operates over TLS, using X.509 certificates for mutual authentication, and enforces policy through an Apache authorization module that interprets certificate‑signed policy statements.

Abstract

The major emphasis of public key infrastructure has been to provide a cryptographically secure means of authenticating identities. However, procedures for authorizing the holders of these identities to perform specific actions still need additional research and development. While there are a number of proposed standards for authorization structures and protocols such as KeyNote, SPKI, and SAML based on X.509 or other key-based identities, none have been widely adopted. As part of an effort to use X.509 identities to provide authorization in highly distributed environments, we have developed and deployed an authorization service based on X.509 identified users and access policy contained in certificates signed by X.509 identified stakeholders. The major goal of this system, called Akenti, is to produce a usable authorization system for an environment consisting of distributed resources used by geographically and administratively distributed users. Akenti assumes communication between users and resources over a secure protocol such as transport layer security (TLS) to provide mutual authentication with X.509 certificates. This paper explains the authorization model and policy language used by Akenti, and how we have implemented an Apache authorization module to provide Akenti authorization.