A privilege management and enforcement system for distributed resource sharing

Abstract

The Internet has been identified as one of the most dangerous aspects for an organization in today's information based world. Unauthorized access, misuse, and manipulation of data can create havoc. We have chosen a distributed environment with thousands of users and tens of thousands of resources to illustrate an approach to solve this problem. We have developed a system for easy administration and enforcement of controlled access. Distributed, delegated management of resources is at the core of the project. For portability, the enforcement system is established between the operating system and the user rather than being embedded in the operating system. In particular, we have developed management and access methods for end user access to resources via the Internet including X Windows and World Wide Web based interfaces, and DCE based authentication and authorization. The environment for this project is the Distributed Informatics Computing and Collaborative Environments project associated with the US Department of Energy's Energy Science Network. This project is a joint effort between the Continuous Electron Beam Accelerator Facility (CEBAF), the Chinese Institute of High Energy Physics, and Old Dominion University.