Annotated Bibliography
Park, J.S., Ahn, Gail-Joon, & Sandhu, R. (2001). Role-Based Access Control on the Web. ACM Transactions on Information and System Security, 4, 37-71. Retrieved on September 13, 2006, from the ACM Digital Library database.
In this article, authors Park, Ahn and Sandhu observed that current ways to access Web Control on Web servers, based on a user’s identity, were inadequate for enterprise-wide systems. In response, they proposed the use of Role-Based Access Control (RBAC) in large-scale Web environments with the addition of user-pull and server-pull architectures, as well as secure cookies and smart certificates.
Access control methods currently used on Web servers tend to use individual’s identity, a method not compatible with enterprise-wide systems. Instead, the authors proposed the use of RBAC to manage and enforce security in such environments. With RBAC, permissions are associated with roles and users are assigned to roles. A role forms the basis of an access control policy. In RBAC, administrators can make roles, grant permission to them, and assign users to the roles based on their job responsibilities. Users can make sessions in which they can start a subset of roles to which they belong. Each of these sessions can be assigned to many roles, but it maps to only one user. In this way, RBAC guarantees that only authorized users can get to access certain data or resources. It also supports information hiding, least privilege, and the separation of duties.
In order to manage role-based access control (RBAC) in Web environments, the authors proposed the use of user-pull and server-pull for roles. In user-pull, a user pulls his roles from the roles server and then shows them to the web servers. In server-pull, each Web server pulls the user’s roles from the role server. In the user-pull architecture, the binding of roles and identification for every user must be supported. There are three main components in both user-pull and server-pull architectures: a Web server, role server, and client. A role server holds user-role assignment (URA) information (for the domain). A web server has a table for permission-role assignment (PRA) which states the necessary roles for resources in the web server.
Another contribution of this paper was the concept of secure cookies as a way of getting information between the browser and the Web server. Cookies are insecure because they are transmitted in clear text. The authors described how to change regular cookies that have no security into secure cookies that resist cookie harvesting, network security and end-system threats. The use of secure cookies is a transparent process to users, and can be applied to browsers and Web servers. Secure cookies are made by cryptographic technologies to maintain integrity, authentication in that authentication services verify who owns the cookies, and confidentiality. There are two types of cryptographic technologies for secure cookies: public-key based and secret-key-based. The authors used a public-key based solution by a PGP package with Common Gateway Interface (CGI) scripts. The authors decided to use Pretty Good Privacy (PGP) for secure cookies in their implementation. Secure cookies only support user-pull since the cookies are stored in the user’s machines. On the other hand, LDAP and smart certificates both support user-pull and server-pull architectures.
Authors Park and Sandhu presented the concept of smart certificates in a work in 1999, and in this article the authors described an RBAC implementation for smart certificates in a user-pull scenario. The basic idea of X.509 certificates, the predecessor to smart certificates, was to bind users to keys. Smart certificates are extended X.509 certificates for the Web and RBAC which support user-pull and server-pull architectures. They can maintain several certification authorities (CAs) without losing maintenance, contain attributes, give postdated and renewable certificates, and keep confidentiality.
To demonstrate the use of their ideas, the authors implemented each architecture by using well known technologies (i.e. X.509, cookies, SSL and Lightweight Directory Access Protocol (LDAP)) that could be used in conjunction with Web technologies. The authors discussed the use of RBAC on the Web using different technologies on different architectures, and compared the tradeoffs of different approaches on the basis of their experiences.
The authors proposed that successfully combining RBAC and the Web can make a huge impact on the deployment of effective enterprise-wide security in large-scale systems, and believe that their contributions in this paper were important in giving strong security management based on users’ roles on the Web.
In this article, authors Park, Ahn and Sandhu observed that current ways to access Web Control on Web servers, based on a user’s identity, were inadequate for enterprise-wide systems. In response, they proposed the use of Role-Based Access Control (RBAC) in large-scale Web environments with the addition of user-pull and server-pull architectures, as well as secure cookies and smart certificates.
Access control methods currently used on Web servers tend to use individual’s identity, a method not compatible with enterprise-wide systems. Instead, the authors proposed the use of RBAC to manage and enforce security in such environments. With RBAC, permissions are associated with roles and users are assigned to roles. A role forms the basis of an access control policy. In RBAC, administrators can make roles, grant permission to them, and assign users to the roles based on their job responsibilities. Users can make sessions in which they can start a subset of roles to which they belong. Each of these sessions can be assigned to many roles, but it maps to only one user. In this way, RBAC guarantees that only authorized users can get to access certain data or resources. It also supports information hiding, least privilege, and the separation of duties.
In order to manage role-based access control (RBAC) in Web environments, the authors proposed the use of user-pull and server-pull for roles. In user-pull, a user pulls his roles from the roles server and then shows them to the web servers. In server-pull, each Web server pulls the user’s roles from the role server. In the user-pull architecture, the binding of roles and identification for every user must be supported. There are three main components in both user-pull and server-pull architectures: a Web server, role server, and client. A role server holds user-role assignment (URA) information (for the domain). A web server has a table for permission-role assignment (PRA) which states the necessary roles for resources in the web server.
Another contribution of this paper was the concept of secure cookies as a way of getting information between the browser and the Web server. Cookies are insecure because they are transmitted in clear text. The authors described how to change regular cookies that have no security into secure cookies that resist cookie harvesting, network security and end-system threats. The use of secure cookies is a transparent process to users, and can be applied to browsers and Web servers. Secure cookies are made by cryptographic technologies to maintain integrity, authentication in that authentication services verify who owns the cookies, and confidentiality. There are two types of cryptographic technologies for secure cookies: public-key based and secret-key-based. The authors used a public-key based solution by a PGP package with Common Gateway Interface (CGI) scripts. The authors decided to use Pretty Good Privacy (PGP) for secure cookies in their implementation. Secure cookies only support user-pull since the cookies are stored in the user’s machines. On the other hand, LDAP and smart certificates both support user-pull and server-pull architectures.
Authors Park and Sandhu presented the concept of smart certificates in a work in 1999, and in this article the authors described an RBAC implementation for smart certificates in a user-pull scenario. The basic idea of X.509 certificates, the predecessor to smart certificates, was to bind users to keys. Smart certificates are extended X.509 certificates for the Web and RBAC which support user-pull and server-pull architectures. They can maintain several certification authorities (CAs) without losing maintenance, contain attributes, give postdated and renewable certificates, and keep confidentiality.
To demonstrate the use of their ideas, the authors implemented each architecture by using well known technologies (i.e. X.509, cookies, SSL and Lightweight Directory Access Protocol (LDAP)) that could be used in conjunction with Web technologies. The authors discussed the use of RBAC on the Web using different technologies on different architectures, and compared the tradeoffs of different approaches on the basis of their experiences.
The authors proposed that successfully combining RBAC and the Web can make a huge impact on the deployment of effective enterprise-wide security in large-scale systems, and believe that their contributions in this paper were important in giving strong security management based on users’ roles on the Web.
posted by Dr. Adam Norten at 4:58 PM
0 Comments:
Post a Comment
<< Home