Authentication-driven Authorization on Web Access

Unlike in traditional computing environments such as operating systems or databases, the authorized user set, the mode of access, users’ access rights, etc., are not predefined in WWW. In order to assign privileges to authorized but not predefined users in dynamic access environments, we propose an approach called authentication-driven authorization. In this approach, authentication is integrated with authorization. The validity of a user is checked by using authentication routines associated with the requested data object. The access permission is achieved by authentication rather than by inheriting from group/role membership relation. A logic-based authorization language has been designed. A prototype has been implemented, which can be used to enforce complex web-based application security policies.