SCI: Collaborative Research: NMI DEVELOPMENT: Policy Controlled Attribute Framework

SCI：协作研究：NMI 开发：策略控制属性框架

• 批准号: 0438385
• 负责人: Katarzyna Keahey
• 金额: $ 59.55万
• 依托单位: University of Chicago
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2004
• 资助国家: 美国
• 起止时间: 2004-12-01 至 2007-11-30
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=0438385&HistoricalAwards=false
• 关键词: SCI; Collaborative; Research; NMI; DEVELOPMENT

This proposal integrates GSI and Shibboleth to form a robust attribute infrastructure for campus environments to enable secure verification of user attributes by inter-institutional Grid users. This project will deliver a framework that allows participants in multi organizational collaborations to control the attribute information that they want to publish, share, and reveal to other parties. Those parties will be also be able to determine whether they possess the capabilities to access a service by matching their capabilities with the service's shared policy of required attributes. Pseudonymous interactions will be supported through the use of anonymous public key credentials that are mapped to the client's identity at the client's own discretion. The project substantially leverages on and extends existing technologies, primarily Internet2's Shibboleth, the Globus Alliance's Globus Toolkit, and NCSA's GridLogon Service. The framework will use Shibboleth's Attribute Authority service (SAAS) and its attribute release policies to restrict the attributes communicated to other parties. We will enhance these Shibboleth services by enabling Web services access through integration with the Globus Toolkit. To enable pseudonymous deployment, a module will be developed for the GridLogon service to allow authenticated users to obtain public key credentials that do not reveal their identity, yet are fully compatible with the Grid Security Infrastructure. Lastly, formats and protocols will be developed and implemented to express, publish, share, and match attribute-related policies and capabilities.

该提案将GSI和Shibboleth集成了校园环境的强大属性基础架构，以通过机构间网格用户对用户属性进行安全验证。该项目将提供一个框架，该框架允许多组织合作的参与者控制他们想要发布，共享和揭示其他方的属性信息。这些当事方也将能够确定他们是否拥有通过将其功能与服务所需属性的共享策略相匹配的能力来访问服务的功能。假名交互将通过使用匿名公共密钥凭据来支持，这些匿名公共密钥凭据由客户自行决定映射到客户的身份。该项目基本上利用并扩展了现有技术，主要是Internet2的Shibboleth，Globus Alliance的Globus Toolkit和NCSA的Gridlogon服务。该框架将使用Shibboleth的属性授权服务（SAAS）及其属性发布策略来限制传达给其他方的属性。我们将通过与Globus工具包的集成来启用Web服务访问，从而增强这些Shibboleth服务。为了启用假名部署，将为GridLogon服务开发一个模块，以允许身份验证的用户获得未透露其身份的公共密钥凭据，但与网格安全基础架构完全兼容。最后，将开发和实施格式和协议，以表达，发布，共享和匹配与属性相关的策略和功能。