210 likes | 408 Views
Extensible Access Control Framework for Cloud based Applications. Funded by National ICT R&D Introduction & Briefing. Outline of the Talk. Extensible Access Control Framework for Cloud based Applications Team Introduction Access Control as a Service ( ACaaS )
E N D
Extensible Access Control Framework for Cloud based Applications Funded by National ICT R&D Introduction & Briefing
Outline of the Talk Extensible Access Control Framework for Cloud based Applications Team Introduction Access Control as a Service (ACaaS) Project Overview (Introduction & Briefing) Future Prospects
Extensible Access Control Framework for Cloud based Applications Funded by National ICT R&D Status:2 quarters completed Project Cost: 13 Million Duration: 2 Years Research Area: Cloud Computing Security Workforce: 14 Team Members including MS and BS degree holders Direct Beneficiary: Educational Institutes, Cloud Community, IT industry Principal Investigator: Dr.AwaisShibli Co-principal Investigator: Dr.Arshad Ali
Security Challenges in SaaS Web Application Security SaaS Data Access Data Integrity Data Backup Network Security Data Confidentiality Authentication Data Locality Data Segregation Data Breaches Identity Management & SSO
Security as a Service (SECaaS) for SaaS Cloud Service Consumers SECaaS Email Security aaS Web content filtering aaS Access control aaS Identity aaS Network Security aaS Security assessment aaS Data protection aaS Encryption aaS
Access Control in Cloud(Area of Focus) Access control’s role is to control and limit the actions or operations in the Cloud systems that are performed by a user on a set of resources.
Challenging Authorization ProblemsCloud Perspective Cloud subscribers often do not have sufficient control over technical access policy decision-making and enforcement in the cloud infrastructure. Most cloud providers do not offer subscriber-configurable policy enforcement points (e.g. based on the OASIS XACML standard). Cloud providers naturally cannot pre-configure subscriber-specific policies for subscribers (because they are subscriber- specific).
Challenging Authorization ProblemsCloud Perspective Managing and creating Cloud subscriber access policies is the biggest challenge around authorization There is no common standard policy specification format adopted yet for cloud. Traditional access control models have some specific parameters suitable only for particular scenarios and granular access control is yet a key requirement. Translating policies into security implementationgets more time-consuming, expensive, and error-prone.
Access Control as a Service (ACaaS) There should be a generic framework for the applications of Cloud consumers that can be customized by consumers according to their own security needs along with the basic security features provided by Cloud providers. This framework should encompasses multiple models and should have the ability to add any access control model within framework based on the security requirements of consumer.
ACaaS for Cloud PEP Attribute Lookup PolicyRequest Trusted Attribute Stores 1 6 PDP 5 PIP 2 3 4
Project Statements We aim to provide Access Control-as-a-Service (ACaaS) for Software-as-a-Service (SaaS) layer applications by incorporating variety of reliable and well-known access control models as Cloud based services. Framework will be capable of handling a wide variety of Cloud Service Consumers (CSC) and intends to minimize the chance of data loss and corruption by unauthorized users. Final deliverables include the implementation of an extensible API that is capable of managing and controlling access for SaaS hosted Cloud applications and resources.
Architecture Figure presents the architecture of framework
Common Policy Language Format Comprehensive Authorization Application Customization & Extensibility
State of the Art Technologies OASIS Extensible Access Control Markup Language (XACML 2.0) Security Assertion Markup Language (SAML) Hibernate Java Server Pages (JSF) OpenStack CloudStack Eclipse Java 2 Enterprise Edition (J2EE)
Pleasure in the job puts perfection in the work. --Aristotle