A Computational Framework for Certificate Policy Operations
نویسندگان
چکیده
The trustworthiness of any Public Key Infrastructure (PKI) rests upon the expectations for trust, and the degree to which those expectations are met. Policies, whether implicit as in PGP and SDSI/SPKI or explicitly required as in X.509, document expectations for trust in a PKI. The widespread use of X.509 in the context of global e-Science infrastructures, financial institutions, and the U.S. Federal government demands efficient, transparent, and reproducible policy decisions. Since current manual processes fall short of these goals, we designed, built, and tested computational tools to process the citation schemes of X.509 certificate policies defined in RFC 2527 and RFC 3647. Our PKI Policy Repository, PolicyBuilder, and PolicyReporter improve the consistency of certificate policy operations as actually practiced in compliance audits, grid accreditation, and policy mapping for bridging PKIs. Anecdotal and experimental evaluation of our tools on real-world tasks establishes their actual utility and suggests how machine-actionable policy might empower individuals to make informed trust decisions in the future.
منابع مشابه
TESLA Certificates: An Authentication Tool for Networks of Compute-Constrained Devices
In the near future wireless networks will consist of lowpowered, compute-constrained devices. These devices will have limited ability to perform the expensive computational operations associated with public key cryptography. This will limit the usefulness of conventional authentication mechanisms based on public key certificates in these domains. In this paper we introduce an alternative to con...
متن کاملAnalytical Performance Evaluation of Nested Certificates
The classical certificate systems are computationally inefficient, since they use signature operations based on public key cryptosystems. The nested certificates (A. Levi, Design and performance evaluation of the nested certification scheme and its applications in public key infrastructures, Ph.D. Thesis, Department of Computer Engineering, Boğaziçi University, Istanbul, Turkey) are proposed to...
متن کاملModeling X.509 Certificate Policies Using Description Logics
Public Key Infrastructures are gaining importance in today's IT environment for managing certificates and keys. It is recognized, that the quality and trustworthiness of certificates depend to a large extend on the practices and procedures a certification authority applies when issuing certificates. These procedures are documented in certificate policies, which are generally text-based document...
متن کاملInternet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework
< draft-ietf-pkix-ipki-new-rfc2527-01.txt > Status of this Memo This document is an Internet-Draft and is subject to all provisions of Section 10 of RFC2026. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF), its areas, and its working groups. Note that other groups may also distribute working documents as Internet-Drafts. Internet-Drafts are draft documents va...
متن کاملAssigning and Enforcing Security Policies on Handheld Devices
The proliferation of mobile handheld devices, such as Personal Digital Assistants (PDAs) and tablet computers, within the workplace is expanding rapidly. While providing productivity benefits, the ability of these devices to store and transmit corporate information through both wired and wireless networks poses potential risks to an organization’s security. This paper describes an approach to a...
متن کامل