1 / 6

Usage policies for end point access control

Usage policies for end point access control. XACML is Oasis standard to express enterprise security policies with a common XML based policy language http://docs.oasis-open.org/xacml/2.0/access_control-xacml-2.0-core-spec-os.pdf 103 pgs.

sheila-bentley
Download Presentation

Usage policies for end point access control

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Usage policies for end point access control • XACML is Oasis standard to express enterprise security policies with a common XML based policy language • http://docs.oasis-open.org/xacml/2.0/access_control-xacml-2.0-core-spec-os.pdf 103 pgs. • Provides mechanism for EKM to define USEAGE rules at point of key distribution.

  2. Common terms • PAP – Policy Administration Point. This would be the EKM • PDP - Policy Decision Point. An entity that evaluates an access request against one or more policies to produce an access decision. This is essentially a rules engine. • PEP – Policy Enforcement Point. An entity that enforces access control for one or more resources. When a resource access is attempted, a PEP sends an access request describing the attempted access to a PDP. The PDP returns an access decision that the PEP then enforces. • policy – A set of rules indicating which subjects are permitted to access which resources using which actions under which conditions. XACML has two different schema elements used for policies: <Policy> and <PolicySet>. A <Policy> contains actual access control rules.

  3. Typical XACML components

  4. Factors in rules • Common notion of SUBJECT, RESOURCE, ACTION Attributes used in rules • Must be able to define factors applicable to end points • Rules have different combination algorithms, such as first applicable [IMHO, Sufficient], or deny-overrides. • When a rule fires, the PEP must execute the rules “Obligations”. From our focus, may be things such as • Encrypt • Audit • If you can’t execute an obligation, service denied

  5. Basic role of a Policy Enforcement Point • An application functions in the role of the PEP if it guards access to a set of resources and asks the PDP for an authorization decision. • Recommend “Deny-biased” PEP approach • If the decision is "Permit", then the PEP SHALL permit access. If obligations accompany the decision, then the PEP SHALL permit access only if it understands and it can and will discharge those obligations. • All other decisions SHALL result in the denial of access. • Note: other actions, e.g. consultation of additional PDPs, reformulation/resubmission of the decision request, etc., are not prohibited..

  6. More to come…. • Need subset easily implemented in C

More Related