An authentication and authorization system for virtual organizations

As more businesses engage in globalization, inter-organizational collaborative computing grows in importance. In order to effectively participate in modem collaborations, member organizations must be able to share specific data and functionality with collaboration partners, while ensuring that their resources are safe from inappropriate access. This requires access control models, policies, and enforcement mechanisms for collaboration resources. This paper describes a mechanism that can exchange user's authentication and authorization information between independent organizations in a secured way, and how this mechanism can be used to carry out the privilege management for virtual organization. The basic principle is that a user is authenticated locally at his origin site, and the origin site creates a handle to be used to retrieve attributes about the user for the resource provider. According to the user's handle, the resource provider sends an attribute request to the user's attribute authority. The attribute authority then issues a X.509 attribute certificate that holds the user's attributes and sends it back to the requester. The resource provider then provides required services to the user based on his privileges. A prototype called Cross Security Access Control Framework (CSACF) has been developed.