The Research And Design Of RBAC-Based PMI

Public Key Infrastructure (PKI) based on the ITU-T X.509 standard has become an indispensable security supporting system and technical specification for network application such as e-business and e-government in the past few years. However, with the rapid growth of Internet, it is not sufficient merely to authenticate communicating parties, which is to know who you are. Besides to recognize a remote party's identity, we also need to know what actions they may perform. Thus, we need an authorization mechanism. Privilege Management Infrastructure (PMI) enables authorization after authentication has occurred.This thesis is organized as follows. Chapter 2 introduces the relevant theories of e-government and cryptography. Chapter 3 presents the basic ideas of PKI and PMI, and provides a comparison between them. Based on role-based access control and attribute certificate, an improved PMI model (RBPMI) is proposed in chapter 4. Firstly we summarize the performance-related requirements that RBPMI has to fulfill. Then the architecture and workflow are explicitly described. We emphasize the research and design of access control mechanism, the authorization scheme and the certificate structure. Finally we discuss the mechanisms of certificate revocation and freshness. Chapter 5 presents conclusion and proposes further work.Based on the theory of PMI, this paper gives a revised privilege management model to implement access control and privilege management. It is accomplished under the condition that there aren't explicit related specifications and standards in our country especially in e-government. It might be helpful to the further research and application in this area.