SCI: Collaborative Research: NMI DEVELOPMENT: Policy Controlled Attribute Framework

该方案集成了GSI和Shibboleth，为校园环境形成了一个健壮的属性基础设施，使跨机构网格用户能够安全地验证用户属性。该项目将提供一个框架，允许多组织协作的参与者控制他们想要发布、共享和显示给其他各方的属性信息。这些参与方还将能够通过将他们的能力与服务的所需属性的共享策略相匹配来确定他们是否拥有访问服务的能力。假名交互将通过使用匿名公钥凭据来支持，该凭据由客户端自行决定映射到客户端的身份。该项目在很大程度上利用和扩展了现有技术，主要是Internet2的S Shibboleth、Globus联盟的Globus工具包和NCSA的GridLogon服务。该框架将使用Shibboleth的属性授权服务(SAAS)及其属性发布策略来限制与其他方通信的属性。我们将通过与Globus工具包集成来支持Web服务访问，从而增强这些Shibboleth服务。为了实现假名部署，将为GridLogon服务开发一个模块，允许经过身份验证的用户获得不会透露其身份但与网格安全基础设施完全兼容的公钥凭据。最后，将开发和实施格式和协议，以表达、发布、共享和匹配与属性相关的策略和功能。

This proposal integrates GSI and Shibboleth to form a robust attribute infrastructure for campus environments to enable secure verification of user attributes by inter-institutional Grid users. This project will deliver a framework that allows participants in multi organizational collaborations to control the attribute information that they want to publish, share, and reveal to other parties. Those parties will be also be able to determine whether they possess the capabilities to access a service by matching their capabilities with the service's shared policy of required attributes. Pseudonymous interactions will be supported through the use of anonymous public key credentials that are mapped to the client's identity at the client's own discretion. The project substantially leverages on and extends existing technologies, primarily Internet2's Shibboleth, the Globus Alliance's Globus Toolkit, and NCSA's GridLogon Service. The framework will use Shibboleth's Attribute Authority service (SAAS) and its attribute release policies to restrict the attributes communicated to other parties. We will enhance these Shibboleth services by enabling Web services access through integration with the Globus Toolkit. To enable pseudonymous deployment, a module will be developed for the GridLogon service to allow authenticated users to obtain public key credentials that do not reveal their identity, yet are fully compatible with the Grid Security Infrastructure. Lastly, formats and protocols will be developed and implemented to express, publish, share, and match attribute-related policies and capabilities.