论文标题
基于功能的分布式授权系统，以执行上下文感知权限序列
A Capability-based Distributed Authorization System to Enforce Context-aware Permission Sequences
论文作者
论文摘要
受控共享对分布式系统至关重要。我们考虑一个基于功能的分布式授权系统，客户端从授权服务器接收功能（访问令牌）以访问资源服务器的资源。基于功能的授权系统已在网络，移动应用程序和其他分布式系统中广泛使用。 这种系统的一个常见要求是，用户按特定顺序使用多个服务器的令牌。相关的要求是，如果某些环境条件保持，则可以使用令牌。我们引入了一个基于安全的功能系统，该系统支持“权限序列”和“上下文”。这允许执行有限的权限序列，每个权限都具有自己的特定上下文。我们证明了该系统在这些条件下的安全性，并将该系统与全体证明令牌集成到OAuth 2.0中。我们评估了我们的实施情况，并将其与普通的OAuth相对于获得授权令牌和获取对资源的访问的平均时间进行比较。
Controlled sharing is fundamental to distributed systems. We consider a capability-based distributed authorization system where a client receives capabilities (access tokens) from an authorization server to access the resources of resource servers. Capability-based authorization systems have been widely used on the Web, in mobile applications and other distributed systems. A common requirement of such systems is that the user uses tokens of multiple servers in a particular order. A related requirement is the token may be used if certain environmental conditions hold. We introduce a secure capability-based system that supports "permission sequence" and "context". This allows a finite sequence of permissions to be enforced, each with their own specific context. We prove the safety property of this system for these conditions and integrate the system into OAuth 2.0 with proof-of-possession tokens. We evaluate our implementation and compare it with plain OAuth with respect to the average time for obtaining an authorization token and acquiring access to the resource.
