Platform-Based Authorization Technologies

Bc. Filip Höfer

Master's thesis

Abstract:

Computing platforms such as Windows operating systems traditionally support authorization to protect accesses to well-defined, persistent objects, e.g., files. Operating system authorization is usually based on the model of DAC (Discretionary Access Control) and is realized via ACLs (Access Control Lists). These mechanisms do not satisfy the needs of applications that process resources on higher abstractions than the operating system. Therefore, Microsoft introduced a new authorization framework Authorization Manager (Azman) which is built on the RBAC model (Role Based Access Control). This thesis presents experiences with Azman and investigates possible relations to XACML and PCIM standards. The comparison focuses on XACML versus Azman and leads to proposing integrated solutions to overcome identified deficiencies of Azman. Prototype implementations are developed and described in this thesis. Results are used to assess the viability of the technologies and future evolvement.

Keywords

Access Control, Authorization, Azman, PCIM, RBAC, Windows Authorization Manager, XACML

Language used: English

Date on which the thesis was submitted / produced: 18. 5. 2006

Thesis defence

• Date of defence: 28. 6. 2006
• Supervisor: prof. RNDr. Václav Matyáš, M.Sc.

Masaryk University

Faculty of Informatics

Master programme / field:
Applied Informatics / Applied Informatics