The major emphasis of public key infrastructure has been to provide a cryptographically secure means of authenticating identities. However, procedures for authorizing the holders of these identities to perform specific actions still need additional research and development. While there are a number of proposed standards for authorization structures and protocols such as KeyNote, SPKI, and SAML based on X.509 or other key-based identities, none have been widely adopted. As part of an effort to use X.509 identities to provide authorization in highly distributed environments, we have developed and deployed an authorization service based on X.509 identified users and access policy contained in certificates signed by X.509 identified stakeholders. The major goal of this system, called Akenti, is to produce a usable authorization system for an environment consisting of distributed resources used by geographically and administratively distributed users. Akenti assumes communication between users and resources over a secure protocol such as transport layer security (TLS) to provide mutual authentication with X.509 certificates. This paper explains the authorization model and policy language used by Akenti, and how we have implemented an Apache authorization module to provide Akenti authorization.

The ZEBRA system, which is part of the VisualHarness platform for managing heterogeneous data, supports three types of access to distributed image repositories: keyword based, attribute based, and image content based. A user can assign different weights (relative importance) to each of the three types, and within the last type of access, to each of the image properties. The image based access component (IBAC) supports access based on computable image properties such as those based on spatial domain, frequency domain or statistical and structural analysis. However, it uses a novel black box approach of utilizing a Visual Information Retrieval (VIR) engine to compute corresponding metadata that is then independently managed in a relational database to provide query processing involving image features and information correlation. That is, one overcomes the difficulties in using the feature vectors that are proprietary to a VTR engine, as one does not require any knowledge of the internal representation or format of the image feature used by a VIR engine.