Abstract:

      During message exchange in acrossapplication there is risk of security certificate. An authorization management model based on Security Assertion Markup Language (SAML) and Privilege Management Infrastructure (PMI) is presented in this paper. The model implements authority management and grants access through combination of logic separation and application. It uses SAML assertion, SAML protocol and SAML binding technologies to conduct identification, attribute acquisition and grant decision based on PMI. This model attains the ability of certificate management by the Attribute Authority (AA) and the Lightweight Directory Access Protocol (LDAP). Experiment results demonstrate that the model is competent for acrossapplication security access control of multirole users.

Key words: computer application, authorization management, identification, security assertion markup language(SAML), privilege management infrastructure(PMI)