Access Control in a Distributed Object Environment Using XML and - PowerPoint PPT Presentation

Access Control in a Distributed Object Environment Using XML and Roles Jason Crampton and Hemanth Khambhammettu Information Security Group Royal Holloway, University of London

Introduction – Overview • What are we doing? – Ensuring that access to protected resources in a distributed computing environment is restricted to appropriately authenticated and authorised users • Why is it important? – Web services – Complex heterogeneous systems in large enterprises • How are we doing it? – An architecture for authentication and authorisation – Authorisation uses role-based techniques – Components of architecture integrated by XML schema ISSA 2003 Access Control in a Distributed Environment Sandton, South Africa Jason Crampton & Hemanth Khambhammettu

Introduction – Objectives • Modularity – Independence of authentication and authorisation mechanisms – Independence of authorisation enforcement point and authorisation decision point – Avoid bottlenecks at decision and enforcement points – Promote inter-operability, scalability and extensibility • Avoid reliance on third-party trust mechanisms • Support for audit and delegation ISSA 2003 Access Control in a Distributed Environment Sandton, South Africa Jason Crampton & Hemanth Khambhammettu

Introduction – Access control • Access control protects resources from users – Access control lists (ACLs) defined for protected resources (Windows 2000, IBM RACF) – A resource’s ACL consists of entries defining which users and groups can access the object – Often difficult to administer in large enterprise Read? Authenticated Reference Protected Resource User Monitor ISSA 2003 Access Control in a Distributed Environment Sandton, South Africa Jason Crampton & Hemanth Khambhammettu

Introduction – RBAC • Role-based access control – associates each user with a set of roles – and associates each role with a set of permissions • Hence each user is indirectly associated with a set of permissions • Roles may form a hierarchy reflecting organisational structure • Scales well and simplifies administration ISSA 2003 Access Control in a Distributed Environment Sandton, South Africa Jason Crampton & Hemanth Khambhammettu

Components of architecture • Authentication engine – Creates authentication tokens • Interface – Access control enforcement point – Assesses the validity of authentication tokens, session certificates and access requests • Session manager – Creates session certificates – Only processes requests from the interface – Maintains information about role hierarchy and user-role assignment • Authorisation engine – Access control decision point – Only processes requests from the interface – Maintains information about permission-role assignment ISSA 2003 Access Control in a Distributed Environment Sandton, South Africa Jason Crampton & Hemanth Khambhammettu

XML schema • Authentication tokens – Contain user identity, public key of user, delegation information, lifetime of token • Session certificates – Contain issuer information, user identity, public key of user, lifetime of certificate, roles assigned to user, delegation information • Interface requests – Access requests (forwarded to authorisation engine) – Session certificate requests (forwarded to session manager) ISSA 2003 Access Control in a Distributed Environment Sandton, South Africa Jason Crampton & Hemanth Khambhammettu

Session creation (1) • User presents credentials to authentication engine Interface Session Manager User Authentication Authorisation Engine Engine ISSA 2003 Access Control in a Distributed Environment Sandton, South Africa Jason Crampton & Hemanth Khambhammettu

Session creation (2) • Authentication engine generates public/private key pair and sends private key to user Interface Session Manager User Authentication Authorisation Engine Engine ISSA 2003 Access Control in a Distributed Environment Sandton, South Africa Jason Crampton & Hemanth Khambhammettu

Session creation (3) • Authentication engine generates authentication token and sends it to interface Interface Session Manager User Authentication Authorisation Engine Engine ISSA 2003 Access Control in a Distributed Environment Sandton, South Africa Jason Crampton & Hemanth Khambhammettu

Session creation (4) • Interface sends authentication token to session manager Interface Session Manager User Authentication Authorisation Engine Engine ISSA 2003 Access Control in a Distributed Environment Sandton, South Africa Jason Crampton & Hemanth Khambhammettu

Session creation (5) • Session manager creates session certificate, encrypts it and sends it to user Interface Session Manager User Authentication Authorisation Engine Engine ISSA 2003 Access Control in a Distributed Environment Sandton, South Africa Jason Crampton & Hemanth Khambhammettu

Making an access request (1) • User sends session certificate and digitally signed access request to interface Interface Session Manager User Authentication Authorisation Engine Engine ISSA 2003 Access Control in a Distributed Environment Sandton, South Africa Jason Crampton & Hemanth Khambhammettu

Making an access request (2) • Interface verifies signature on access request and forwards access request to authorisation engine Interface Session Manager User Authentication Authorisation Engine Engine ISSA 2003 Access Control in a Distributed Environment Sandton, South Africa Jason Crampton & Hemanth Khambhammettu

Making an access request (3) • Authorisation engine decides whether request should be granted and sends decision to interface Interface Session Manager User Authentication Authorisation Engine Engine ISSA 2003 Access Control in a Distributed Environment Sandton, South Africa Jason Crampton & Hemanth Khambhammettu

Making an access request (4) • Interface enforces decision by returning either a handle to the resource or an error message Interface Session Manager User Authentication Authorisation Engine Engine ISSA 2003 Access Control in a Distributed Environment Sandton, South Africa Jason Crampton & Hemanth Khambhammettu

Updating session certificates • A session certificate is a static binding of a user identity to a set of roles • Validity of session certificate is sensitive to – Changes to the user-role assignment relation – Changes in the structure of the hierarchy • A user u could have been issued with a session certificate containing a role r and then have his assignment to a role r revoked – Any subsequent request by u to use a permission p assigned to r should be denied by the system ISSA 2003 Access Control in a Distributed Environment Sandton, South Africa Jason Crampton & Hemanth Khambhammettu

Updating session certificates (1) • Session manager sends revised certificate to interface in response to changes in role hierarchy or user-role assignment Interface Session Manager User Authentication Authorisation Engine Engine ISSA 2003 Access Control in a Distributed Environment Sandton, South Africa Jason Crampton & Hemanth Khambhammettu

Updating session certificates (2) • User makes access request Interface Session Manager User Authentication Authorisation Engine Engine ISSA 2003 Access Control in a Distributed Environment Sandton, South Africa Jason Crampton & Hemanth Khambhammettu

Updating session certificates (3) • Interface verifies signature, substitutes new session certificate and forwards request to authorisation engine which returns decision Interface Session Manager User Authentication Authorisation Engine Engine ISSA 2003 Access Control in a Distributed Environment Sandton, South Africa Jason Crampton & Hemanth Khambhammettu

Updating session certificates (4) • Interface enforces decision and sends revised session certificate to user Interface Session Manager User Authentication Authorisation Engine Engine ISSA 2003 Access Control in a Distributed Environment Sandton, South Africa Jason Crampton & Hemanth Khambhammettu

Delegation • Our architecture allows users to delegate their privileges to other users (whom they trust) • The ability to delegate privileges is – determined by the authentication engine – defined in the authentication token • Delegation element in session certificate determines – whether the certificate can be delegated – constrains the number of delegation certificates that can be created ISSA 2003 Access Control in a Distributed Environment Sandton, South Africa Jason Crampton & Hemanth Khambhammettu

Conclusions • The architecture provides – mutual authentication for user and target system – role-based authorisation – dynamic re-issue of session certificates – delegation • Future work to include – separation of duty – inter-domain authorisation ISSA 2003 Access Control in a Distributed Environment Sandton, South Africa Jason Crampton & Hemanth Khambhammettu