1. Cyber-Identity and Authorization in an Uncertain World Ravi Sandhu Laboratory for Information Security Technology www.list.gmu.edu Department of Information and Software Engineering School of Information Technology and Engineering George Mason University sandhu@gmu.edu 703-993-1659

2. Laboratory for Information Security Technology 2 What is Cyber-Security? Fighting fires –Keeping the bad guys out –Firewalls, Intrusion Detection, Virus scans, Spam filters, Content filters Increasing productivity –Letting the good guys in –Cyber-Identity and Authorization STOP GO

3. Laboratory for Information Security Technology 3 What is Cyber-Security? EASYSECURE PRACTICAL

4. Laboratory for Information Security Technology 4 An Uncertain World Uncertain threat –We are always fighting the last war Technological change –Pervasive (ubiquitous) computing –Peer-to-peer, grid and utility computing –Intels LaGrande and Microsofts Longhorn –The next Intel, Microsoft, Cisco, …. Business change –Outsourcing and globalization

5. Laboratory for Information Security Technology 5 Cyber-Identity Megatrends Federated identity –Identity relying party is NOT the identity provider –Who will be the DMV in cyberspace? Grades of identity –Identity vetting, authentication strength, purpose, privacy –A single infrastructure to drive all grades

6. Laboratory for Information Security Technology 6 Cyber-Identity Mega-Challenges Pervasive (ubiquitous) computing –How can a user get effective control of identity in a pervasive environment Ad-hoc peer-to-peer computing –First responders in an emergency Trustworthy computing –Will Intels LaGrande technology or Microsofts Longhorn help us save the day

7. Laboratory for Information Security Technology 7 RBAC96 Model ROLES USER-ROLE ASSIGNMENT PERMISSIONS-ROLE ASSIGNMENT USERSPERMISSIONS... SESSIONS ROLE HIERARCHIES CONSTRAINTS

8. Laboratory for Information Security Technology 8 Usage Control (UCON) Coverage Protection Objectives –Sensitive information protection –IPR protection –Privacy protection Protection Architectures –Server-side reference monitor –Client-side reference monitor –SRM & CRM

9. Laboratory for Information Security Technology 9 UCON_ABC Models Continuity Decision can be made during usage for continuous enforcement Mutability Attributes can be updated as side- effects of subjects actions

10. Laboratory for Information Security Technology 10 Conclusion Managing cyber-identity and authorization in an uncertain world is one of our nations foremost cyber-security problems RBAC and UCON will be essential underpinnings of the solutions GMU is a world leader in this sector