engineering

Privilege Management Infrastructure

Privilege Management Infrastructure is a engineering topic covered in the lgStudy science library. This page brings together a partial reference excerpt, illustrations, worked examples, real-world applications and a short study plan, so you can understand Privilege Management Infrastructure rather than just read about it. In short: In cryptography Privilege Management is the process of managing user authorisations based on the ITU-T Recommendation X.509. The 2001 edition of X.509 specifies most (but not all) of the components of a Privilege Management Infrastructure (PMI), based on X.509 attribute certificates (ACs).

Key takeaways

Privilege Management Infrastructure belongs to engineering; place it in that map before memorising details.
Learn the definition first, then one example that makes the definition concrete.
Connect Privilege Management Infrastructure to a quantity you can measure, compute or draw — that is where exam questions come from.
Reproduce the core statement of Privilege Management Infrastructure from memory before moving on to harder problems.

Reference excerpt

In cryptography Privilege Management is the process of managing user authorisations based on the ITU-T Recommendation X.509. The 2001 edition of X.509 specifies most (but not all) of the components of a Privilege Management Infrastructure (PMI), based on X.509 attribute certificates (ACs). Later editions of X.509 (2005 and 2009) have added further components to the PMI, including a delegation service (in 2005 ) and interdomain authorisation (in the 2009 edition ). Privilege management infrastructures (PMIs) are to authorisation what public key infrastructures (PKIs) are to authentication. PMIs use attribute certificates (ACs) to hold user privileges, in the form of attributes, instead of public key certificates (PKCs) to hold public keys. PMIs have Sources of Authority (SoAs) and Attribute Authorities (AAs) that issue ACs to users, instead of certification authorities (CAs) that issue PKCs to users. Usually PMIs rely on an underlying PKI, since ACs have to be digitally signed by the issuing AA, and the PKI is used to validate the AA's signature. An X.509 AC is a generalisation of the well known X.509 public key certificate (PKC), in which the public key of the PKC has been replaced by any set of attributes of the certificate holder (or subject). Therefore, one could in theory use X.509 ACs to hold a user's public key as well as any other attribute of the user. (In a similar vein, X.509 PKCs can also be used to hold privilege attributes of the subject, by adding them to the subject directory attributes extension of an X.509 PKC). However, the life cycle of public keys and user privileges are usually very different, and therefore it isn't usually a good idea to combine both of them in the same certificate. Similarly, the authority that assigns a privilege to someone is usually different from the authority that certifies someone's public key. Therefore, it isn't usually a good idea to combine the functions of the SoA/AA and the CA in the same trusted authority. PMIs allow privileges and authorisations to be managed separately from keys and authentication. The first open source implementation of an X.509 PMI was built with funding under the EC PERMIS project, and the software is available from here. A description of the implementation can be found in. X.509 ACs and PMIs are used today in Grids (see Grid computing), to assign privileges to users, and to carry the privileges around the Grid. In the most popular Grid privilege management system today, called VOMS, user privileges, in the shape of VO memberships and roles, are placed inside an X.509 AC by the VOMS server, signed by the VOMS server, and then embedded in the user's X.509 proxy certificate for carrying around the Grid. Because of the rise in popularity of XML SOAP based services, SAML attribute assertions are now more popular than X.509 ACs for transporting user attributes. However, they both have similar functionality, which is to strongly bind a set of privilege attributes to a user.

References

Worked examples

Example 1 — a first encounter with Privilege Management Infrastructure

Start with the simplest possible case. Write down what Privilege Management Infrastructure claims or describes in one sentence, then invent the smallest concrete situation in which that sentence is true. In engineering, the smallest case is usually a single object, a single equation or a single measurement. Check that every symbol or term in your sentence has a meaning in that case.

Example 2 — changing one variable

Take the situation from Example 1 and change exactly one quantity: double it, halve it, or set it to zero. Predict what should happen to Privilege Management Infrastructure before you calculate. Comparing your prediction with the result is the fastest way to find out whether you understand the idea or only the words.

Example 3 — an exam-style question

Typical questions about Privilege Management Infrastructure ask you to (a) state it precisely, (b) apply it to given data, and (c) explain a limitation. Practise writing all three answers in under five minutes; the third part is what separates a full-mark answer from an average one.

Applications of Privilege Management Infrastructure

In research: Privilege Management Infrastructure appears in engineering research whenever the underlying quantities have to be modelled precisely. Papers usually cite it as a starting assumption and then explore where it breaks down.
In technology and industry: Engineering practice reuses Privilege Management Infrastructure in design rules, simulations and safety margins. Knowing the idea lets you read a specification sheet and understand why the numbers look the way they do.
In the classroom: Privilege Management Infrastructure is common in secondary-school and first-year university syllabi. It links to neighbouring topics Communications protocols, Cryptography, so understanding it makes those chapters shorter.
In everyday life: Look for Privilege Management Infrastructure outside the textbook — in sport, cooking, traffic, electronics or the sky above you. An example you found yourself is remembered far longer than one you were given.

Affiliate

Preply — study more efficiently by working with a personal tutor. 50% off.

How to study Privilege Management Infrastructure in 20 minutes

Read the reference excerpt below once, without taking notes.
Close the page and write down what Privilege Management Infrastructure means in your own words.
Compare your version with the excerpt and mark what you missed.
Work through the three examples above with pen and paper.
Explain Privilege Management Infrastructure out loud to somebody else — or to Teacher Smith in the lgStudy chat.

Frequently asked questions

What is Privilege Management Infrastructure in simple terms?

Why does Privilege Management Infrastructure matter?

Because it connects several engineering ideas at once: it gives you a definition you can apply, a quantity you can calculate, and a way to check whether a result is plausible.

How should I study Privilege Management Infrastructure?

Read the excerpt, restate it from memory, then work through the examples and applications listed on this page. The five-step study plan above takes about twenty minutes.

What does this page cover?

It gives you a compact reference excerpt plus original lgStudy explanations, examples, applications and study material on Privilege Management Infrastructure.