Proxy-Based Authorization and Accounting for Distributed Systems

Despite recent widespread interest in the secure au-thentication of principals across computer networks there has been considerably less discussion of distributed m e chanisms to support authorization and accounting. By generalizing the authentication model to support restricted p r oxies, both authorization and accounting can be e asily supported. This paper presents the proxy model for authorization and shows how the model can be used to support a wide range of authorization and accounting mechanisms. The proxy model strikes a balance b etween access-control-list and capability-based m e chanisms allowing each to be used where appropriate and allowing their use in combination. The paper describes how restricted p r oxies can be supported using existing authentication methods.