XACML MAP Authorization Profile Richard Hill, John Tolbert May 16, 2013

Why use XACML for MAP Authz? n The MAP server contains highly valued information about the network which needs to be protected n A strong desired to use a standard based policy language n The policy language must provide an expressive, flexible, and fine-grained access control

OASIS – TNC Collaboration n 2010 – Initial XACML TC interest in IF-MAP n Discussed possibility of using XACML for MAP Content Authorization. n Q – TNC & OASIS Collaboration Agreed n Collaboration Approach: l TNC develop the MAP Content Authorization Spec. l Work with OASIS XACML TC represenitive. l OASIS XACML TC develops XACML MAP Authorization Profile.

Where does XACML fit in? The MAP server performs the XACML PEP function. The XACML PDP may be internal or external to the MAP server. MAP authorization policies are written in XACML XACML PAP may be used maintain the lifecycle of the MAP policies

What can the MAP Authorize? IF-MAP Client operations on the MAP Server based on: l The IF-MAP Client’s roles l The metadata type l The identifier type l Top-level attributes of the identifier l Top-level attributes of the metadata item l The action to be performed

XACML MAP Authorization Profile Profile identifier urn:oasis:names:tc:xacml:3.0:if-map:content Subject Attributes n role Resource Attributes n metadata-type n identifier-type n is-map-client-identifier n is-self-identifier n on-link n metadata-attribute n identifier-attribute

XACML MAP Authorization Profile Action Attributes n request-type n delete-metadata-by-other-client n publish-request-subtype Environment Attributes n dry-run No Obligations will be used.

Aids Security Strategy Digital Policy Management Goals n Use a standard policy language n Manage access polices centrally n Distribute policies to access control points. n Ensure XACML capabilities are pushed to the network layer.

Next Steps n Updates based on comment periods: l TNC MAP Content Authorization l OASIS XACML MAP Authorization profile n Testing of MAP content authorization with XACML l Summer of 2013 n Expected stabilization l TNC MAP Content Authorization – Mid July l OASIS XACML MAP Authorization profile – Q n Possible demonstrations of TNC MAP & OASIS XACML in 2014?