Enforce Authorization Policies Research Articles

FedAAA-SDN: Federated Authentication, Authorization and Accounting in SDN controllers

Modern technology advancements such as Software Defined Networking (SDN) have been employed in distinct scenarios such as cloud computing and wireless networks, and have made network administration simpler since it gives greater flexibility in centralizing the configurations of a network and its data. Several SDN controllers have started to offer Authorization, Authentication, and Accounting (AAA) services to improve user management and security, including support for OAuth2.0. However, basic authentication schemes using the tuple username and password are not considered secure nowadays (prone to brute force attacks), or the use of basic tokens in OAuth 2.0 is propitious to security vulnerabilities not meeting the security requirements in current and future use cases dealing with authentication. Therefore, the main objective of this work is the design and evaluation of the FedAAA-SDN framework enabling authentication, authorization, and accounting mechanisms in SDN controllers controlling different types of networks. In particular, the FedAAA-SDN framework enables federated authentication and authorization processes for network functions by enabling the conveyance of identity and authentication information across heterogeneous domains/networks, allowing also network operators to enforce authorization policies for network functions in wired and wireless networks. A FedAAA-SDN proof of concept is implemented with OpenDaylight as the SDN controller, OpenID Connect as the authentication and authorization mechanism, and Keycloak as the OpenID Provider. FedAAA-SDN also includes the concept of trust levels and trust policies that rely on the context information of a user’s device and associated connected access networks. The implementation of the FedAAA-SDN framework proof of concept involves modifications in the OpenDaylight AAA filter component to secure all the interactions with the several network applications/subcomponents of the OpenDaylight SDN controller. STRIDE security analysis demonstrates that the FedAAA-SDN framework is able to reduce the number of threats.

A constraint and risk-aware approach to attribute-based access control for cyber-physical systems

Cyber-physical systems (CPSs) integrate cyber components and physical processes. This integration enhances the capabilities of physical systems by incorporating intelligence into objects and services. On the other hand, the integration of cyber and physical components and the interaction between them introduce new security threats. Since CPSs are mostly safety-critical systems, data stored and communicated in them are highly critical. Hence, there is a crucial need for protecting the data and resources in CPSs against unauthorized accesses. In this paper, we propose an access control (AC) framework to address CPS related security issues. The proposed framework consists of two parts: a Cyber-Physical Access Control model (CPAC) and a Generalized Action Generation Model (GAGM). CPAC utilizes an attribute-based approach and extends it with cyber-physical components and cyber-physical interactions. In addition, we incorporate Separation of Duty (SoD) constraints into the CPAC model. GAGM is used to augment the enforcement of access policies. We present formal representations of CPAC and GAGM and demonstrate their use in a sample scenario for a medical CPS. We propose an algorithm for enforcing authorization policies. We implement the CPAC model and compare its performance against the core attribute-based access control model. We present an authorization enforcement approach and show through our experimental results its feasibility.

Semantic-based authorization architecture for Grid

There are a few issues that still need to be covered regarding security in the Grid area. One of them is authorization where there exist good solutions to define, manage and enforce authorization policies in Grid scenarios. However, these solutions usually do not provide Grid administrators with semantic-aware components closer to the particular Grid domain and easing different administration tasks such as conflict detection or resolution. This paper defines a proposal based on Semantic Web to define, manage and enforce security policies in a Grid scenario. These policies are defined by means of semantic-aware rules which help the administrator to create higher-level definitions with more expressiveness. These rules also permit performing added-value tasks such as conflict detection and resolution, which can be of interest in medium and large scale scenarios where different administrators define the authorization rules that should be followed before accessing a resource in the Grid. The proposed solution has been also tested providing some reasonable response times in the authorization decision process.

Sharing Data and Analytical Resources Securely in a Biomedical Research Grid Environment

ObjectivesTo develop a security infrastructure to support controlled and secure access to data and analytical resources in a biomedical research Grid environment, while facilitating resource sharing among collaborators. DesignA Grid security infrastructure, called Grid Authentication and Authorization with Reliably Distributed Services (GAARDS), is developed as a key architecture component of the NCI-funded cancer Biomedical Informatics Grid (caBIG™). The GAARDS is designed to support in a distributed environment 1) efficient provisioning and federation of user identities and credentials; 2) group-based access control support with which resource providers can enforce policies based on community accepted groups and local groups; and 3) management of a trust fabric so that policies can be enforced based on required levels of assurance. MeasurementsGAARDS is implemented as a suite of Grid services and administrative tools. It provides three core services: Dorian for management and federation of user identities, Grid Trust Service for maintaining and provisioning a federated trust fabric within the Grid environment, and Grid Grouper for enforcing authorization policies based on both local and Grid-level groups. ResultsThe GAARDS infrastructure is available as a stand-alone system and as a component of the caGrid infrastructure. More information about GAARDS can be accessed at http://www.cagrid.org. ConclusionsGAARDS provides a comprehensive system to address the security challenges associated with environments in which resources may be located at different sites, requests to access the resources may cross institutional boundaries, and user credentials are created, managed, revoked dynamically in a de-centralized manner.