A System for the Specification and Enforcement of Quality-Based Authentication Policies
Abstract
This paper develops a language and a reference architecture supporting the management and enforcement of authentication policies. Such language directly supports multi-factor authentication and the high level specification of authentication factors, in terms of conditions against the features of the various authentication mechanisms and modules. In addition the language supports a rich set of constraints; by using these constraints, one can specify for example that a subject must be authenticated by two credentials issued by different authorities. The paper presents a logical definition of the language and its corresponding XML encoding. It also reports an implementation of the proposed authentication system in the context of the FreeBSD Unix operating system (OS). Critical issues in the implementation are discussed and performance results are reported. These results show that the implementation is very efficient.
Keywords
architecture, authentication, modules, constraints, XML, FreeBSD Unix
Date of this Version
2007
Comments
Information and Communications Security Lecture Notes in Computer Science, 2007, Volume 4861/2007, 386-397