Presentation is loading. Please wait.

Presentation is loading. Please wait.

Institute for Cyber Security

Published byMartin Chase Modified over 6 years ago

Similar presentations

Presentation on theme: "Institute for Cyber Security"— Presentation transcript:

1 Institute for Cyber Security
An Attribute-Based Access Control Extension for OpenStack and its Enforcement Utilizing the Policy Machine Prof. Ravi Sandhu Executive Director and Endowed Chair 2nd IEEE International Conference on Collaboration and Internet Computing (CIC) November 1-3, 2016 Smriti Bhatt, Farhan Patwa and Ravi Sandhu Department of Computer Science © Ravi Sandhu World-Leading Research with Real-World Impact!

2 World-Leading Research with Real-World Impact!
Outline Introduction RBAC and ABAC Simplified OpenStack Access Control (OSAC) Model An ABAC Extension for OpenStack Policy Machine (PM) and its Architecture ABAC Enforcement Architecture Authorization using AE and PM Use Cases Evaluation Discussion and Analysis Conclusion and Future Work © Ravi Sandhu World-Leading Research with Real-World Impact!

3 World-Leading Research with Real-World Impact!
Introduction RBAC: Most dominant access control model Major cloud computing platforms: OpenStack AWS Microsoft Azure Limitations: Role explosion ABAC: Access control based on attributes Enhanced flexibility and fine grained access control Implement ABAC models in real-world applications A gradual shift from RBAC to ABAC models Authorization based on RBAC model © Ravi Sandhu World-Leading Research with Real-World Impact!

4 World-Leading Research with Real-World Impact!
RBAC and ABAC Three different ways of combining RBAC and ABAC by NIST – dynamic roles: uses user and context attributes to dynamically assign roles to users attribute-centric: roles just another attribute of users with no special semantics role-centric: constrains role permissions based on user attributes Proposed a role-centric ABAC extension for OpenStack Combining advantages of both RBAC and ABAC © Ravi Sandhu World-Leading Research with Real-World Impact!

5 Simplified OpenStack Access Control (OSAC) Model
Union of role permissions Union of role permissions based on the token of a user Simplified OSAC Model (Adapted from [*]) Groups and Domains removed * B. Tang and R. Sandhu, “Extending OpenStack access control with domain trust,” in International Conference on Network and System Security. Springer, 2014, pp. 54–69 © Ravi Sandhu World-Leading Research with Real-World Impact!

6 An ABAC Extension for OpenStack
Union of attribute-value permissions Role-Centric ABAC User-Attribute Enhanced OSAC in Single Tenant © Ravi Sandhu World-Leading Research with Real-World Impact!

7 An ABAC Extension for OpenStack
Extended simplified OSAC with user attributes – UAtt – a finite set of user attribute functions For each uatt in Uatt, Range(uatt) is a finite set of atomic value UAPA – user-attribute value permission assignment For any user – maximum permissions determined based on roles in the token, further constrained by permissions associated to its user-attribute values Currently, model designed for atomic valued attributes only Object attributes next challenge to explore Enforced this model in OpenStack utilizing the Policy Machine (PM) © Ravi Sandhu World-Leading Research with Real-World Impact!

8 World-Leading Research with Real-World Impact!
Policy Machine (PM) General-purpose attribute-based access control framework Express and enforce arbitrary access control policies Provide a unified platform supporting: Commonly known and implemented access control policies Combinations of policies New access control policies PM Core Elements Users Objects User Attributes Object Attributes Operations, Access Rights Processes Policy Classes PM Relations Assignment Association Prohibition Obligation assignment—for specifying relationships between policies, users, and user attributes, objects and object attributes association – for defining policies through associations between user attributes and object attributes or objects through some operations © Ravi Sandhu World-Leading Research with Real-World Impact!

9 World-Leading Research with Real-World Impact!
PM Architecture PAP - Policy Administration Point PDP - Policy Decision Point PEP – Policy Enforcement Point Policy Machine Architecture (Adapted from [*]) * D. Ferraiolo, V. Atluri, and S. Gavrila, “The Policy Machine: A novel architecture and framework for access control policy specification and enforcement,” J. of Sys. Architecture, vol. 57, no. 4, pp. 412–424, 2011 © Ravi Sandhu World-Leading Research with Real-World Impact!

10 ABAC Enforcement Architecture
Active Directory (AD): stores all the users and their associated user attributes in the system (the same AD also to be Identity backend for OpenStack) An ABAC Enforcement Architecture for OpenStack using PM © Ravi Sandhu World-Leading Research with Real-World Impact!

11 Authorization Sequence Diagram
OpenStack Authorization using AE and PM © Ravi Sandhu World-Leading Research with Real-World Impact!

12 World-Leading Research with Real-World Impact!
Use Case I A Simplified OSAC RBAC Policy Roles: {Admin, Manager} Commands (c): compute extension-keypair-index compute extension-keypair-create compute extension-keypair-delete compute extension-keypair-show Authorization rules for any user u: compute extension-keypair-create  Role(u) = Admin compute extension-keypair-delete  Role(u) = Admin compute extension-keypair-index  (Role(u) = Admin ˅ Role(u) = Manager) compute extension-keypair-show  (Role(u) = Admin ˅ Role(u) = Manager) A Role-Based Access Control Policy in PM © Ravi Sandhu World-Leading Research with Real-World Impact!

13 World-Leading Research with Real-World Impact!
Use Case I Role = Admin Role = Manager OpenStack Enforcement Results © Ravi Sandhu World-Leading Research with Real-World Impact!

14 World-Leading Research with Real-World Impact!
Use Case II A Role-Centric ABAC Policy Roles: {Admin, Manager} Department: {IT, OPS} Commands (c): compute extension-keypair-index compute extension-keypair-create compute extension-keypair-delete compute extension-keypair-show Authorization rules for any user u: compute extension-keypair-create  (Role(u) = Admin ˄ Dep(u) = IT) compute extension-keypair-delete  (Role(u) = Admin ˄ Dep(u) = IT) compute extension-keypair-index  ((Role(u) = Admin ˅ Role(u) = Manager) ˄ (Dep(u) = IT ˅ Dep(u) = OPS)) compute extension-keypair-show  ((Role(u) = Admin ˅ Role(u) = Manager) ˄ (Dep(u) = IT ˅ Dep(u) = OPS)) © Ravi Sandhu World-Leading Research with Real-World Impact!

15 World-Leading Research with Real-World Impact!
Use Case II A User-Attribute Enhanced OSAC Policy in PM © Ravi Sandhu World-Leading Research with Real-World Impact!

16 World-Leading Research with Real-World Impact!
Use Case II Role = Admin and Department = OPS Role = Admin and Department = IT OpenStack Enforcement Results © Ravi Sandhu World-Leading Research with Real-World Impact!

17 World-Leading Research with Real-World Impact!
Evaluation Indications of cost of implementing our ABAC extension in OpenStack using PM Network latency Proof-of-concept implementation Need for Optimization © Ravi Sandhu World-Leading Research with Real-World Impact!

18 Discussion and Analysis
Advantages of an ABAC extension with user attributes: define more fine-grained access control policies significantly reduce number of roles required in a policy avoid problems such as role explosion and role-permission explosion Trade-off between performance and enhanced functionality/capability Performance improvement techniques: high-performance server to host PM and AE to improve policy evaluation time cache policy evaluation results locally Install PM, AE, and OpenStack services on an isolated subnet © Ravi Sandhu World-Leading Research with Real-World Impact!

19 Conclusion and Future Work
Proposed an ABAC extension with user attributes for OpenStack Enforced our model in OpenStack utilizing the PM and AE An initial attempt to facilitate transition towards ABAC models in real world applications Future Work: Explore other capabilities of PM – combination of access control polices, attribute and role hierarchy Apply performance enhancements to enforcement framework Include object attributes © Ravi Sandhu World-Leading Research with Real-World Impact!

20 Institute for Cyber Security
Thank you!! Questions?? © Ravi Sandhu World-Leading Research with Real-World Impact!

Download ppt "Institute for Cyber Security"

Similar presentations

INSTITUTE FOR CYBER SECURITY 1 Application-Centric Security: How to Get There Prof. Ravi Sandhu Executive Director and Endowed Chair Institute for Cyber.

INSTITUTE FOR CYBER SECURITY 1 Application-Centric Security: How to Get There Prof. Ravi Sandhu Executive Director and Endowed Chair Institute for Cyber.
ROWLBAC – Representing Role Based Access Control in OWL

ROWLBAC – Representing Role Based Access Control in OWL
Institute for Cyber Security

Institute for Cyber Security
Institute for Cyber Security

Institute for Cyber Security
1 A Unified Attribute-Based Access Control Model Covering DAC, MAC and RBAC Prof. Ravi Sandhu Executive Director and Endowed Chair DBSEC July 11, 2012.

1 A Unified Attribute-Based Access Control Model Covering DAC, MAC and RBAC Prof. Ravi Sandhu Executive Director and Endowed Chair DBSEC July 11, 2012.
Institute for Cyber Security Extending OpenStack Access Control with Domain Trust World-Leading Research with Real-World Impact! 1 Bo Tang and Ravi Sandhu.

Institute for Cyber Security Extending OpenStack Access Control with Domain Trust World-Leading Research with Real-World Impact! 1 Bo Tang and Ravi Sandhu.
Attribute-Based Access Control Models and Beyond

Attribute-Based Access Control Models and Beyond
1 Attribute-Based Access Control Models and Beyond Prof. Ravi Sandhu Executive Director, Institute for Cyber Security Lutcher Brown Endowed Chair in Cyber.

1 Attribute-Based Access Control Models and Beyond Prof. Ravi Sandhu Executive Director, Institute for Cyber Security Lutcher Brown Endowed Chair in Cyber.
11 World-Leading Research with Real-World Impact! Role and Attribute Based Collaborative Administration of Intra-Tenant Cloud IaaS (Invited Paper) Xin.

11 World-Leading Research with Real-World Impact! Role and Attribute Based Collaborative Administration of Intra-Tenant Cloud IaaS (Invited Paper) Xin.
Secure Information and Resource Sharing in CloudSecure Information and Resource Sharing in Cloud References OSAC-SID Model [1]K. Harrison and G. White.

Secure Information and Resource Sharing in CloudSecure Information and Resource Sharing in Cloud References OSAC-SID Model [1]K. Harrison and G. White.
ADVANCED LINUX SECURITY. Abstract : Using mandatory access control greatly increases the security of an operating system. SELinux, which is an implementation.

ADVANCED LINUX SECURITY. Abstract : Using mandatory access control greatly increases the security of an operating system. SELinux, which is an implementation.
1 © Talend 2014 XACML Authorization Training Slides 2014 Jan Bernhardt Zsolt Beothy-Elo

1 © Talend 2014 XACML Authorization Training Slides 2014 Jan Bernhardt Zsolt Beothy-Elo
1 A Role Based Administration Model For Attribute Xin Jin, Ram Krishnan, Ravi Sandhu SRAS, Sep 19, 2012 World-Leading Research with Real-World Impact!

1 A Role Based Administration Model For Attribute Xin Jin, Ram Krishnan, Ravi Sandhu SRAS, Sep 19, 2012 World-Leading Research with Real-World Impact!
INSTITUTE FOR CYBER SECURITY 1 Cyber Security: Past, Present and Future Prof. Ravi Sandhu Executive Director and Endowed Chair Institute for Cyber Security.

INSTITUTE FOR CYBER SECURITY 1 Cyber Security: Past, Present and Future Prof. Ravi Sandhu Executive Director and Endowed Chair Institute for Cyber Security.
1 Institute for Cyber Security Prof. Ravi Sandhu Executive Director and Endowed Chair February 4, 2015

1 Institute for Cyber Security Prof. Ravi Sandhu Executive Director and Endowed Chair February 4, 2015
1 Big Data Applications in Cloud and Cyber Security Prof. Ravi Sandhu Executive Director and Endowed Professor UTSA COB Symposium on Big Data, Big Challenges.

1 Big Data Applications in Cloud and Cyber Security Prof. Ravi Sandhu Executive Director and Endowed Professor UTSA COB Symposium on Big Data, Big Challenges.
1 Grand Challenges in Authorization Systems Prof. Ravi Sandhu Executive Director and Endowed Chair November 14, 2011

1 Grand Challenges in Authorization Systems Prof. Ravi Sandhu Executive Director and Endowed Chair November 14, 2011
Institute for Cyber Security Multi-Tenancy Authorization Models for Collaborative Cloud Services Bo Tang, Ravi Sandhu, and Qi Li Presented by Bo Tang ©

Institute for Cyber Security Multi-Tenancy Authorization Models for Collaborative Cloud Services Bo Tang, Ravi Sandhu, and Qi Li Presented by Bo Tang ©
Extensible Access Control Framework for Cloud Applications KTH-SEECS Applied Information Security Lab SEECS NUST Implementation Perspective.

Extensible Access Control Framework for Cloud Applications KTH-SEECS Applied Information Security Lab SEECS NUST Implementation Perspective.
1 Group-Centric Models for Secure Information Sharing Prof. Ravi Sandhu Executive Director and Endowed Chair March 30, 2012

1 Group-Centric Models for Secure Information Sharing Prof. Ravi Sandhu Executive Director and Endowed Chair March 30, 2012

Similar presentations

Ads by Google