Designing an Authorization Service

We present the design of an authorization service which parallels existing authentication services for distributed systems. Such a service would operate on top of an authentication substrate. There are two distinct ideas underlying our design: (1) The use of a language, called generalized access control list (GACL), as a common representation of authorization requirements. (2) The use of authenticated delegation to effect authorization offloading from an end server to an authorization server. We present the syntax and semantics of GACL, and illustrate how it can be used to specify authorization requirements that cannot be easily specified by ordinary ACL. We also describe the protocols in our design. Research sponsored by NSA INFOSEC University Research Program under contract no. MDA 904-94-C-6106. Technical report TR-93-29, Department of Computer Sciences, University of Texas at Austin, October 1994 (revised).