Towards a flexible access control mechanism for e transactions
1 / 41

Towards a Flexible Access Control Mechanism for E-Transactions - PowerPoint PPT Presentation

  • Uploaded on

The 2004 ACM/IEEE International Conference on E-Business and Telecommunication Networks (ICETE-04). Towards a Flexible Access Control Mechanism for E-Transactions. Vishwas Patil R. K. Shyamasundar, Fellow IEEE

I am the owner, or an agent authorized to act on behalf of the owner, of the copyrighted work described.
Download Presentation

PowerPoint Slideshow about 'Towards a Flexible Access Control Mechanism for E-Transactions' - aelwen

An Image/Link below is provided (as is) to download presentation

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.

- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -
Presentation Transcript
Towards a flexible access control mechanism for e transactions

The 2004 ACM/IEEE International Conference on E-Business and Telecommunication Networks (ICETE-04)

Towards a Flexible Access Control Mechanism for E-Transactions

Vishwas Patil

R. K. Shyamasundar, Fellow IEEE

School of Technology and Computer Science

Tata Institute of Fundamental Research, Mumbai.

Outline Telecommunication Networks (ICETE-04)

  • Need for Access Control

  • Present approaches: what more is required?

  • Background

  • Modeling security requirements for access control

  • Modeling dynamic security requirements

  • flexi-ACL

  • Conclusions

  • Future Directions

Need for access control
Need for Access Control Telecommunication Networks (ICETE-04)

  • Irresistible advantages of using Internet

  • More and more resources are coming over Internet

  • Restrict the access to intended users

  • Access Control: distinguish between Authorized and un-Authorized users

Mechanisms simple complex
Mechanisms: Simple/Complex? Telecommunication Networks (ICETE-04)

  • What is the nature of the security controls?

    • Do we require complexity or assurance?

  • Simple security mechanisms

    • easy to maintain

    • unlikely to be configured incorrectly

    • easy to prove implementation of security meets policy requirements

    • may not support all requirements of security policy

  • Complex security mechanisms

    • difficult to maintain

    • likely to be configured incorrectly

    • difficult to prove implementation of security meets policy requirements

    • support a wide variety of security features

Issues Telecommunication Networks (ICETE-04)

  • Secure access

  • Protection against misuse of authorizations

  • Manageability

  • Fault-tolerance

  • On-line vs. Off-line trade-off

  • Emergency access measures

  • Granular access

  • Dynamic aspects in distributed environment

  • Sequential access: Layered security approach

  • Privacy issues

  • Trust management

Approaches Telecommunication Networks (ICETE-04)

  • Various proposals exist

    • MAC/DAC

    • PKI

    • PKI-based: PolicyMaker/KeyNote, RBAC et. al.

    • Capability-based

  • How to do it in abetter way?

    • flexi-ACL

Early days of access control
Early days of Access Control Telecommunication Networks (ICETE-04)

  • Butler Lampson proposed “Access Control Matrix” (extended by HRU)

Access control matrix
Access Control Matrix Telecommunication Networks (ICETE-04)





  • A request can be regarded as a triple (s, o, a)

    • s is a subject

    • o is an object

    • a is an access operation

  • A request is granted (by the reference monitor) if

    • a belongs to the access matrix entry corresponding to subject s and object o



Access control matrix1
Access Control Matrix Telecommunication Networks (ICETE-04)

  • The matrix is likely to be extremely sparse and therefore implementation is inefficient

  • Management of the matrix is likely to be extremely difficult if there are 0000s of files and 00s of users (resulting in 000000s of matrix entries)

  • The administration of access control structures is extremely time-consuming, complicated and error-prone

  • Such kind of approach is suitable in OS, where the state transition is internal to system and readily available during decision making process, also security is not a concern.

Plain authentications over the internet
Plain Authentications over the Internet Telecommunication Networks (ICETE-04)

  • Distributed computing and the Internet have caused a paradigm shift in computing security

  • Security threats

    • Data confidentiality, integrity

    • Re-play attack

    • Non-repudiation

    • Identity theft, privacy, etc.

  • man-in-middle attack

  • Cryptography has a role to play in secure Access Control, especially in distributed environment like Internet.

Role of cryptography
Role of Cryptography Telecommunication Networks (ICETE-04)

  • Properties provided by cryptography (symmetric/asymmetric),

    • Data confidentiality

    • Data integrity

    • Authentication, Authorization

    • Non-repudiation

    • These properties can be realized in distributed environment using digital certificates

  • PKI comes into picture

    • X.509 (centralized framework), SPKI/SDSI (de-centralized)

  • Only integration of PKI with applications may not suffice!

    • Other Access Control Issues

Access control issues
Access Control Issues Telecommunication Networks (ICETE-04)

  • How is security to be managed?

    • Do we centralize or decentralize?

    • A security policy should be implemented consistently

  • Single point of control

    • Policy likely to implemented consistently throughout

    • May be performance bottleneck

  • Multiple control points

    • Implementation of policy more likely to be inconsistent

    • Performance likely to be improved

    • Flexible and natural policies

Towards a flexible access control mechanism for e transactions
PKI Telecommunication Networks (ICETE-04)

  • X.509

    • Centralized architecture

    • Global “root” CA are responsible for proper functionality of setup

    • Sub-ordinate CAs help in management, but delegation is limited

    • Single digital-certificate is used for name and authorization binding

    • Trust accumulates at CA, loss of flexibility

    • Key management is costly and cumbersome for large setup (CRL)

Towards a flexible access control mechanism for e transactions
PKI Telecommunication Networks (ICETE-04)


    • Decentralized architecture

    • Separate name and authorization certificates (privacy)

    • Each principal can independently issue certificates (local name space)

    • Principals can also make name and authorization bindings on names (defined in local name space or in someone else’s name space) rather than on exact keys (extended names)

    • Global CAs can be accommodated in the setup

    • Principals can delegate acquired authorizations to others (if allowed)

    • The onus of generating proof of some authorization is left on requester rather than on resource controller

Towards a flexible access control mechanism for e transactions
PKI Telecommunication Networks (ICETE-04)

Modeling security requirements for ac
Modeling Security Requirements for AC Telecommunication Networks (ICETE-04)

  • For today's complex applications over the Internet, the security requirements cannot be met merely by PKI based frameworks

  • Let us see with the help of few simple scenarios what are the requirements of a generic access control mechanism

  • We shall also see how these requirements can or cannot be met in existing frameworks

Scenario 0
Scenario 0 Telecommunication Networks (ICETE-04)

Underlying security framework: X.509

Scenario 1
Scenario 1 Telecommunication Networks (ICETE-04)

  • Is it possible to delegate authorizations and restrict the number of authorized users?

Underlying security framework: SPKI/SDSI

Scenario 2
Scenario 2 Telecommunication Networks (ICETE-04)

  • Is it possible to restrict the depth of authorization delegation?

Scenario 3
Scenario 3 Telecommunication Networks (ICETE-04)

  • Can each user have different accessing rights on the resource?

    • A typical approach is to categorize users into different roles and authorize them against the rights honored against respective roles.

    • This way resource controller has to maintain less info. in a manageable way (work-flow systems, RBAC etc.)

    • Another approach could be to include all the permissions into user’s certificate itself, but this leads to revelation of information that is not necessary while performing a particular authorization

    • This is suitable for setup where users exercise rights from a well-defined fixed set of rights.

Scenario 4
Scenario 4 Telecommunication Networks (ICETE-04)

  • Is it possible to restrict an authorized user from acting as a service proxy for others?

    • In communications that are not face-to-face, remote lending cannot be prevented, regardless of whether privacy-protecting certificates or fully traceable identity certificates are used. Indeed, the “lender” might as well perform the entire showing protocol execution and simply relay the provided service or goods to the “borrower” [Stefan Brands].

    • Case 1: auction robots – acting on behalf of its owner

    • Case 2: laundry service – if authorization credentials does not tightly bind the recipient of the service, users may run the laundry service

    • Case 3: privacy violation – if authorization credentials bind lot of user information with it

      • Reduces the scope of the underlying certification scheme or

      • Possess privacy threats

Modeling dynamic security requirements
Modeling Dynamic Security Requirements Telecommunication Networks (ICETE-04)

  • We have argued that the existing frameworks do not support the following features:

    • Constraints & flexibilities required for specifying proxies by users,

    • Variable access rights for the users,

    • Emergency access requirements, and

    • Robustness/fault-tolerance and immediate revocation of authority

Flexi acl
flexi Telecommunication Networks (ICETE-04)-ACL

  • Every access request is a negotiation between resource controller and the requester

  • We should have a judicious mix of certificates and on-line schemes (authentications), based on the requirement trade-offs

  • Our approach addresses the modeled requirements through the following abstractions

    • Abstract out the core access control across scenarios as a global policy specification that can and will be handled through certificates

    • Specify refinements that may require on-line schemes as local policy

    • The overall policy is then obtained through a merger of global and local policies.

Flexi acl typical controller requester interaction
flexi Telecommunication Networks (ICETE-04)-ACL [Typical “controller-requester” Interaction]

Challenge: Access Control Rule

Response: Certificate Chain as proof


Aintersect function derive actual perms
AIntersect() Telecommunication Networks (ICETE-04) Function [Derive Actual perms.]

Flexi acl scenario 1
flexi Telecommunication Networks (ICETE-04)-ACL: Scenario-1

Challenge: Access Control Rule

Response: Certificate Chain as proof

Stop the service to members of

my-group defined in the ACL

Remove this rule from acl


Flexi acl scenario 2
flexi Telecommunication Networks (ICETE-04)-ACL: Scenario-2

Challenge: Access Control Rule

Response: Certificate Chain as proof

Disable write perm on ftp



Remove write from

the (tag ) field

Flexi acl scenario 3
flexi Telecommunication Networks (ICETE-04)-ACL: Scenario-3

Challenge: Access Control Rule

Response: Certificate Chain as proof

Introduce a new perm foo on ftp



Add foo to the

(tag ) field


Flexi acl scenario 4
flexi Telecommunication Networks (ICETE-04)-ACL: Scenario-4

Challenge: Access Control Rule

Response: Certificate Chain as proof

Restrict access of ftp to the

members of my-group only



Remove the (delegate)flag


Flexi acl modified tag field of spki sdsi
flexi Telecommunication Networks (ICETE-04)-ACL [Modified (tag) field of SPKI/SDSI]

  • SPKI/SDSI allows application developers to define the structure of (tag) filed present in ACL rules and authorization certificates

  • Instead of (tag (resource (permissions))) in ACL / authorization certificates,

  • We have adapted following modification:

    • for ACL

      (tag (resource (*)(permissions-dynamic)))

    • for authorization certificates

      (tag (resource (permissions-static)(*)))

  • So that the resultant intersection will produce a combination of overall global policy (prescribed in certs) + local policy (prescribed in ACL)

Flexi acl introduction of positional operator in tag
flexi Telecommunication Networks (ICETE-04)-ACL [Introduction of positional * operator in (tag)]




Flexi acl typical structure
flexi Telecommunication Networks (ICETE-04)-ACL: Typical Structure

Flexi acl rule types supported
flexi Telecommunication Networks (ICETE-04)-ACL [rule types supported]

  • flexi-ACL allows integration of a priori defined authentication mechanisms (standard/proprietary) as rule types for a given setup

  • For example;

    • spki

    • pamd

    • RSA SecurID

    • biometric

    • TCP/IP wrapper

    • token

    • et. al.

Flexi acl rule type examples
flexi Telecommunication Networks (ICETE-04)-ACL [rule type examples]

Possession of


Proof of


Reputation or


Flexi acl scenarios
flexi Telecommunication Networks (ICETE-04)-ACL: Scenarios

  • Stop providing service to non-conforming users

    The Resource Administrator has control over one of the a priori defined authentication mechanisms integrated with flexi-ACL

    Administrator simply revokes the non-conforming user from the authentication mechanism, though the user is satisfying global policy, it is not satisfying the local policy and hence denied access

  • A particular user U should not access the resource more than “n” times

    For such requirements of tracking the state of user’s access to the resource, the administrator may integrate a suitable authentication mechanism into the rules-set.

    For example, one-time-passwords, or a mechanism integrated with database, to keep track of number of accesses already made.

Flexi acl scenarios1
flexi Telecommunication Networks (ICETE-04)-ACL: Scenarios

  • Provide more permissions to the users who can satisfy additional policy requirements

    Administrator can put the additional policy requirements in conjunctions with the necessary e-authentication mechanisms as a conformance check.

  • Introduce a new permission foo over the resource only to certain users

    Administrator will create a new rule inside the acl-block, in which permission foo is introduced as a new permission under local policy but availed to the users who can authenticate themselves against the newly integrated e-authentication mechanism integrated with the rule using AND operator.

Comprehensive scenario layered security infra
Comprehensive Scenario: Telecommunication Networks (ICETE-04)[Layered Security Infra.]

Conclusions Telecommunication Networks (ICETE-04)

  • We have argued the need for a hybrid of digital certificates and other state-based schemes to arrive at flexible distributed access control specification (flexi-ACL)

  • Inclusion of external authentication mechanisms into the underlying PKI framework empowers the resource controller to provide fine-grained access control

  • The ability of resource controller to enforce local access control policies helps the resource owner in granting discretionary auxiliary rights to the users

  • Such an approach is also helpful in achieving properties like; “rights amplification”, “fault-tolerance”, “instant authority revocation”, and better trust management!

Future directions
Future Directions Telecommunication Networks (ICETE-04)

  • How do we “do” access control if we can’t identify subjects?

    • Mobile code

    • e-Commerce customers

  • How do we control the access of untrusted code running on our machine?

    • Sandboxes

    • Code signing

  • Notion of incomplete contracts

    • Trust is an important ingredient for execution of incomplete contracts

Future directions1
Future Directions Telecommunication Networks (ICETE-04)

Contact references
Contact & References Telecommunication Networks (ICETE-04)

Prof. R. K. Shyamasundar

Dean, School of Technology and Comp. Science

Vishwas Patil

Scientific Officer

We will reply

before lunch-break