Secure Data Network System (SDNS) Access Control Documents - NIST

Access Control Concept; SDN.801 Secure Data Network System INTRODUCTION: ACCESS CONTROL WITHIN SDNS access control consists of two processes: the Peer 1. 1.1 Overview Access Enforcement process for enforcing access This document describes the principles and functions underlying the Secure Data (SDNS) System Access Approval process for interpreting the data of the four-tiered model, and the Peer access (PDU) basis. Network Security policies are generally established by and different administrative levels within an control authentication security services. control on a Protocol Data Unit A trusted organization. The policies established at each distribution algorithm, operating in conjunction administrative level should either reflect the with a trusted central authority, provides a consistent implementation of the policy means established by the administrative level above for an authenticated exchange of identity it and attribute data between communicating peers. Auxiliary vectors (A Vs) provide a means or establish security policies that are unique to represent additional have been broadly categorized as rule based and for local authorities to identity and attribute data within their the current administrative level. These policies identity based policies. jurisdiction, without the central authorities’ involvement. Based on these and other inputs, a range of rule-based access control (RBAC) and identity-based access control (IBAC) can be afforded in order to satisfy customer requirements. Access approval, enforcement, and authentication functions are defined implement a security policy within In order to any security product, the security policy specification must translate the security policy into a realizable structure (such as which will serve as inputs to the security policy in a general fashion, compatible with real time and algorithm. The application of a security policy algorithm to the joint characteristics of each store-and-forward communication contexts. communicating With the intention of applying multiple vendor SDNS security products to a wide variety of communicating data systems, the SDNS security architecture does not limit secure communications to security products provided any one vendor. As a by result, the access control and authentication security services provided by any SDNS common security product must share a structure. It is a goal that the access control and authentication by SDNS be adaptable to mechanisms designed support a wide range of anticipated customer security policies. The entity, along with establishing the validity of each entity's characteristics, results in an access control decision. SDNS must support the dynamic mechanisms which identify the communicating entities, mediate their access, and enforce the security policy of that specific communication. system and data access decisions Toward that end, the SDNS Most end will be a machine function on behalf of the made SDNS as users. authentication and access control functions are based on the following five assumptions: application and variety of security policies 1) Security policies implemented by model mechanistically represent access control identification that SDNS are influenced the development of a four-tiered to an algorithm) and identify the characteristics of each entity can be those that are specifiable (algorithmically expressable).! information. A framework has been developed for authentication data and access control checks 1 . Not all policies are expressable in a mechanistically implementable form. which will allow communication between different SDNS users/systems when their respective security policies allow it SDNS Page 7 1

Secure Data Network System 2) A Access Control Concept; SDN.801 of characteristics set communicating entities of the input to an is algorithmic security policy decision process. These characteristics have been subdivided into four subsets which are identified as the four-tiered model. 3) SDNS A mechanism is required component receives the strong authentication through which an SDNS information necessary to identify and validate another SDNS component. Each communicating Authentication of the SDNS through a strongly other accountable entity from this strong trusted distribution method. This authentication information. The access distribution method must employ identification and authentication. From this basis, peer permissions, limitations, or constraints enforced nonforgeable during that association are established using the accountable expanded to SDNS meet the requirements of SDNS component determines the identity of the identity information received from a trusted central authority in the form of an identity certificate. Note that the identification authentication for access control. information contained within an identity SDNS certificate will not be provides two processes for access control decisions. The first process determines whether communications can be initiated, and the second process provides continuing access control of data. These are the Peer Access Approval (PAA) and Peer Access Enforcement (PAE) processes. 5) Relationship of Authentication and entities is established entity authentication is 4) 1.3 Access Control Within SDNS cannot correct deficiencies in end The SDNS access control concept document centers on the above second and fourth bullets. of these two bullets is couched in terms of a required strong authentication process and results in a specific control concept for SDNS regard many to which the components, but varies with factors (i.e., the OSI layer at SDNS component operates, local security policy). 1.3.1 Exchange SDNS access control decisions begin with the accountable entities attempting to communicate. systems. The discussion family of uniform over the entire operational access These decisions are made each accountable entity’s security policy, as established by the appropriate cognizant authority. Once initialized, SDNS the components can establish the means to securely communicate. Identity certificates are exchanged on behalf of the entities. SDNS. in the context of SDNS accountable Access control enforcement occurs as a result of using the information contained in the 1.2 Scope & References identity certificate This access control concept document provides a framework control; it for understanding SDNS access does not provide the detail that would allow the implementation of SDNS access control in any particular environment. These concepts will be used to develop the SDNS System Specification (SDN. 802). Access Control and continues as long as the specific association exists. The information contained within the identity certificate intentionally left is as general as possible to help preserve interoperability. This allows authorities to configure a wide variety of security policies to govern access control decisions. The information contains enough granularity to allow for access control decisions according to the security policies applied. Page 8 2

Access Control Concept; SDN.801 Secure Data Network System with the EV's constraints. 1.3.2 Authentication EV and the Accountable entity authentication means that those identity characteristics, attributable to the entity being protected by the and meaningful and SDNS for access control, are component exchanged The chosen authentication scheme support the goal of confirming in be represented may be required decision may be made on differently, thus a translation before an access control PDU. PDUs that conform pass unimpeded; PDUs that do not conform are dropped. a verified. must (authenticating) the identities of the SDNS components. The COMPOSITE ID (the total of all identity information about an accountable entity as contained in the identity certificate and any extensions, see Section 1.3.4) carries the SDNS component information necessary for an to The information PDU may the make an access control decision commensurate Extension 1.3.4 The to the Identity Certificate may identity certificate contain to adequately identify an and the all lifetime of information not be large of the information which to may SDNS enough needed user/component, some of the access control be too short to be included in the identity certificate. Therefore, a scheme devised to place was of the locally defined all information under the control of a local authority. Both the local rule based with the security policies involved. is and some of the identity based access control information 1.3.3 Two Access Control may be variations of an authentication process are of an auxiliary vector, discussed in this document, real time and staged delivery. Both variations provide equivalent outcomes. Either an association between entities is established (and supervised according to each SDNS component’s communication is access rules) or denied. The authentication mechanism must establish the identity of each SDNS accountable entity involved in the requested secure communication. Once the identity information exchange process has been accomplished another process will be initiated determine whether or not the called the initially PAA process. The PAA secure process determines the constraints imposed upon the secure communication between peers. These constraints are established by interpreting SD.NS components and placing the resulting the identity certificate data of both constraints, limitations, or permissions apply to information present in a PDU within an Enforcement Vector (EV). EV which PAE inbound and outbound for to the The assemblage of and in the auxiliary vector will be referred to as COMPOSITE the ID. The "Local Domain Authority Identifier" field in the identity certificate identifies the source of the additional access control information to the SDNS user/component. 1.3.5 Impact of Store-and-Forward Key Formulation The store-and-forward characteristic of electronic mail (E-Mail) introduces a number of special issues which do not apply to an environment in which peer entities communicate directly in real time. Originator and recipient user agents (UAs) do not communicate in real time. As a result, the information contained in a recipient's identity certificate and auxiliary vector (as posted on a server or bulletin board label, perform any desired access control checks. valid is process monitors each PDU bound information contained in the identity certificate to If a is system) must be sufficient to allow an originator has been formed, the communication established and the identity certificate. which to communication should be allowed This process is generated by a local authority in the form conformance In the context communication, it is of store-and-forward not practical, in general, to carry out a distinct mutual association Page 9 3

Access Control Concept; SDN.801 Secure Data Network System PAA, subsequent validation step within certificate exchange. is an autonomous to the Each transmitted message entity, outside the context of any bilaterally-accepted association. Therefore, an originator must make any access control decisions without a prior validation step. Transmission takes place without prior, timely assurance of an intended peer's participation as the actual recipient of the transfer. 1.4 Four-Tiered Model for Access Control The four-tiered model, described in subsequent sections of this paper, serves as a vehicle for defining the types of information necessary for making an access control decision. Depending on appropriate policy, with the exception of the tier, not all tiers must be used by all first SDNS components. The four-tiered model consists An SDNS Partition Tier - of; access control division, at the highest level, of the population into discrete groups. Partition Rule Tier - Based Access Control Expression of the SDNS access control information which represents a policy common to all entities in the same partition. Local Rule Based Access Control Tier Expression of the SDNS - access control information which represents locally applicable policies or rules which govern the access to resources owned or administered by specific organizations. Identity Based Access Control Tier - Expression of the identity of the peer and additional information about the kinds of associations that are allowed with that peer. Page 4 10

Access Control Concept; SDN.801 Secure Data Network System PAA, PAE and THE FOUR-TIERED 2. PAA MODEL Successful On Identity Certificate Credentials KMP Allowed To Continue 2.1 Introduction Peer Credentials Received This section describes the processes of PAE and Parse Identity Certificate Credentia and amplifies the four-tiered model. The PAA, PAE, and relationship between tiered used PAA model is Additional Access Control Info Received the four- examined. Several figures are Parse Additional Access Control info to describe these processes, their operation, PAA Successful and their interoperation. 2.2 Relationship of Pass PAA, PAE, and the Four- PAA Tiered Model EV Failed Abort Key: Event SDNS provides two processes for access control decisions. The first Action process determines whether communications can be initiated, and the second Figure 2. KMP/PAA State Diagram process provides continuing access control of data. These processes are respectively. Figure I 1 PAA and PAE, process will yield a result (Process successful or represents one possible End System KMP. is PAA exchanged, SDNS I Process failed) which will be returned to additional access control information will If to be again be called upon to Net evaluate both peers’ additional access control Component I information Figure 1. SDNS Relationship to the System SDNS component relative to the perform its (KMP) Two calling PAA is the to Protocol (SP) calling processing. the will SP appropriate pointer may may is SP it When checks in place will enter If . an allow for an optional be cached with the processing being transferred to only one possible it is its recovery attempt to be made; the packet being processed strategy, chosen for expository purposes, and perform to receives a packet for processing implementations PAA This presentation relates only to the real-time case is PAE error condition and drop the packet (some at this time. If no further access control not to the staged delivery case. This which acts as a gatekeeper for all this pointer is not in place the identity certificate information will be evaluated exchanged, the The SP to see if the received). All of the access control-relevant 2. this result data packets, both incoming and outgoing. certificate information (Peer credentials to be a result KMP must perform. specific services in called upon to evaluate both peer’s identity is It is PAA (Process successful Figure 3 illustrates the situation of the Security the KMP make use of the PAA process. First, PAA is information KMP determine the remainder of the processing which function; an exception to this store-and-forward-case. the completion of or Process failed). Figure 2 illustrates the situation of the Key Protocol Upon will be returned to the network and the end system. Management form of an Auxiliary Vector (AV)). (Additional access control information received.) placement of an (in the KMP in an attempt to establish a secure association). At the not appropriate time in the intended to constrain implementation alternatives. SP processing the PAE process will be called upon to perform processing PAE (PDU its The process received for processing). Page 11 5

Access Control Concept; SDN.801 Secure Data Network System As An NoEV Figure 3. SP/PAE (No EV, will yield a result checks not It is OK) which this result State As Initiator: A Recipient: Diagram EV checks OK, EV will be returned to the SP. which will determine the remainder of the processing which the SP must perform. 2.2. 1 Peer Access Approval Peer Access Approval is the process by which a particular uses a implementation of the four-tiered model to sender/recipient establish an EV. Figure 4, a top-level diagram of the four-tiered access control model's evaluation process, illustrates the evaluation process for both an initiator and recipient peer entity. The evaluation process depends on whether the peer entity is initiating or receiving the initial message, and also on whether the peer is functioning in the store-and-forward or real time mode. For an when initiator, the PAA process begins the local process discovers that an not exist for an outbound PDU EV does and concludes with the security service option negotiation. Correspondingly, the begins when PAA process for a recipient the local process receives an establishment request for an association and also concludes with the security service option negotiation. Figure 12 4. PAA Process Page 6

Access Control Concept; SDN.801 Secure Data Network System some preliminary In the real time example, checks can be made by the initiating side (e g., is the peer request to the destination allowed The ?). identity certificate will then be sent to the destination SDNS SDNS component component and the initiating await the arrival of will peer's identity certificate. If, after its an appropriate SDNS component's wait, the destination has not been received, a time-out will certificate occur and an error message will be generated. an identity certificate is received from the SDNS component destination If then the PAA checks can occur. The recipient process begins when the is received. The some preliminary checks originator's identity certificate recipient can perform as, "Do I wish to communicate based on what I now know about this ID ?” and (depending such on the local security policy) either before, during, or after the PAA checks, the identity certificate will be sent to the initiator. The PAA Exit checks begin with verifying that the received certificate's contents are valid. Following this, a same compares the remaining PAA tiers) as checks fail, evaluation of the peer's tier enforcement during PAE. applicable PDU and compare it the information PAE (e.g., EV will take the security label) with the information in the EV. The EVs used by each peer may be different based upon the security policy of the peer. simple example LRBAC is A where one peer employs Figure 5 introduces the PAA process relative to the identity certificate exchange and generation Upon receipt of the other peer SDNS component's identity certificate t

sdn.301 security protocol3(sp3) sdn.401 security protocol4(sp4) sdn.701 messagesecurity protocol sdn.702 directoryspecs forusewith msp key management sdn.601 keymanagement profile sdn.902 kmp definitionof servicesprovided bykmase sdn.903 kmp servicesprovided bykmase sdn,906 kmp traffickey attribute negotiation access control sdn.801 .