Electronic Credential based Security Management in Decentralized Computing Environment

Role Based Access Control (RBAC) and Access Control List (ACL) are the most commonly adopted access control mechanisms in traditional centralized computing environment. Nowadays people frequently work in a highly dynamic and distributed computing environment, in which two or more heterogeneous systems do not share the same security domain. Traditional access control mechanisms that require pre-registration become obsolete. Electronic credential based distributed access control turns out to be the best solution to the current situation. We adopt three kinds of certificates in the solution: attribute certificate, capability certificate and delegation certificate. A language is required to delineate a unified certificate format and to enable administrators to define the trust relationships between e-strangers. We present a policy language, Z-Trust Language, to meet this end. Administrators can finely manage privileges assigned to individual users with the Language. A java program has also been developed as the compliance checker.