SCI: Collaborative Research: NMI DEVELOPMENT: Policy Controlled Attribute Framework

该方案集成了GSI和Shibboleth，为校园环境形成了一个健壮的属性基础设施，以实现机构间网格用户对用户属性的安全验证。该项目将提供一个框架，该框架允许多组织协作中的参与者控制他们想要发布、共享和向其他方显示的属性信息。这些各方还将能够通过将其能力与所需属性的服务共享策略相匹配来确定它们是否拥有访问服务的能力。假名交互将通过使用匿名公钥凭证得到支持，该凭证根据客户自己的判断映射到客户端的身份。该项目充分利用并扩展了现有技术，主要是Internet2的Shibboleth、Globus联盟的Globus Toolkit和NCSA的GridLogon Service。该框架将使用Shibboleth的属性授权服务（SAAS）及其属性发布策略来限制与其他方通信的属性。我们将通过与Globus Toolkit集成来支持Web服务访问，从而增强这些Shibboleth服务。为了启用假名部署，将为GridLogon服务开发一个模块，以允许经过身份验证的用户获得不泄露其身份的公钥凭证，但与网格安全基础设施完全兼容。最后，将开发和实现格式和协议，以表示、发布、共享和匹配与属性相关的策略和功能。

This proposal integrates GSI and Shibboleth to form a robust attribute infrastructure for campus environments to enable secure verification of user attributes by inter-institutional Grid users. This project will deliver a framework that allows participants in multi organizational collaborations to control the attribute information that they want to publish, share, and reveal to other parties. Those parties will be also be able to determine whether they possess the capabilities to access a service by matching their capabilities with the service's shared policy of required attributes. Pseudonymous interactions will be supported through the use of anonymous public key credentials that are mapped to the client's identity at the client's own discretion. The project substantially leverages on and extends existing technologies, primarily Internet2's Shibboleth, the Globus Alliance's Globus Toolkit, and NCSA's GridLogon Service. The framework will use Shibboleth's Attribute Authority service (SAAS) and its attribute release policies to restrict the attributes communicated to other parties. We will enhance these Shibboleth services by enabling Web services access through integration with the Globus Toolkit. To enable pseudonymous deployment, a module will be developed for the GridLogon service to allow authenticated users to obtain public key credentials that do not reveal their identity, yet are fully compatible with the Grid Security Infrastructure. Lastly, formats and protocols will be developed and implemented to express, publish, share, and match attribute-related policies and capabilities.