Govcert2011 - Context-enhanced Authorization

399 views
353 views

Published on

Context-enhanced Authorization overview for GOVCERT.NL symposium in Rotterdam.

Published in: Technology, Business
0 Comments
1 Like
Statistics
Notes
  • Be the first to comment

No Downloads
Views
Total views
399
On SlideShare
0
From Embeds
0
Number of Embeds
4
Actions
Shares
0
Downloads
4
Comments
0
Likes
1
Embeds 0
No embeds

No notes for slide

Govcert2011 - Context-enhanced Authorization

  1. 1. Context-enhanced AuthorizationGOVCERT symposium16 november 2011Martijn Oostdijk
  2. 2. Authorization & Context? Solution Problem: ant Drivers: •A uthorization import • Context : • GRC • Authorization not • A BA C Drivers • Insider dynamic enough • Mobil e fraud • Cloud• Nomadic working (“HNW”) (Attribute Based Access Control)2 Context-enhanced Authorization
  3. 3. Context-enhanced Authz • Research project within SII TOP programme • Goal: assess feasibility of context-enhanced authorization w/ focus on employees • Method: through desktop research, use cases, and a demonstrator • Novay, together with a big Dutch bank, and IBM3 Context-enhanced Authorization
  4. 4. Context4 Context-enhanced Authorization
  5. 5. Context Solution For example: • Context - Time of day twork) • A BA C - Lo cation (Geo IP, office ne - Location (GPS) - Proximity , BYOD) - Device (PC vs mobile rs (social?) - Relation to other use - Authentication level - …5 Context-enhanced Authorization
  6. 6. Social PhysiologicalEnvironment - people nearby - heart rate - weather - behaviour - skin -air pollution - friends - voice - Twitter activities Location Time Mental - long/lat -office hours - happy - proximity - lunch time - scared - country/city - between points - sad- @home/@work in time - stressed Device Network Activities - type - IP-address - working - ownership - VPN - travelling (BYO) - LAN - meeting - OS and apps - WiFi or 3G - sleeping -patch status
  7. 7. Domain Type Source 1. Environment Weather Buienradar Air polution Weeronline.nl 2. Physiological Heart rate ECG sensor 3. Social People nearby Bluetooth, Google Lattitude, Outlook Calendar SN Friends LinkedIn, Facebook Activity Twitter 4. Location Long/Lat GPS, GSM Cell-Id City GPS, Geo-IP Proximity Bluetooth, RFID/NFC7 Context-enhanced Authorization
  8. 8. Domain Type Source 5. Time Office hours System time Lunch time Outlook Calendar 6. Mental Happy/sad Sound sensor Scared Galvanic skin responses Stressed 7. Network VPN or localnet Network access gateway Wireless or Wired IP address 8. Device Type Device mngmt system Ownership Device mngmt system8 Context-enhanced Authorization
  9. 9. Domain Type Source 9. Activity Travelling GPS, accelerometer Meeting Calendar, Proximity sources Sleeping Heart sensor, ECG, sound Some observations: • Inter-dependencies between domains/types • Some inference is needed in some types • Most domains/types can benefit from multiple measurements over time • What characteristics determine which domains / types / sources are most suitable in a given scenario?9 Context-enhanced Authorization
  10. 10. Authorization10 Context-enhanced Authorization
  11. 11. Authorization 101 • Authentication: who is this user? • Authorization: is this user supposed to be doing that? RBA MA C AC L C B ABAC ell- Lapa Subject DA C Actionultd-ulaObject M i LevelAttribute BasedAccess Control Permit or Deny 11 Context-enhanced Authorization
  12. 12. ABAC Solution • Context Defacto standard: XACML 2.0 • ABA C App PEP PDP App PEP Policies PIP PIPPolicy Decision Point PAPPolicy Enforcement PointPolicy Information Point AP APPolicy Administration Point12 Context-enhanced Authorization
  13. 13. ABAC Solution • Context Defacto standard: XACML 2.0 • ABA C GUI Banking PEP Service IBM TSPM App PEP PDP Policies PIP PIPPolicy Decision Point PAPPolicy Enforcement Point ContextPolicy Information Point AP ServerPolicy Administration Point GUI13 Context-enhanced Authorization
  14. 14. PAP (in TIP)14 Context-enhanced Authorization
  15. 15. 15 Context-enhanced Authorization
  16. 16. 16 Context-enhanced Authorization
  17. 17. 17 Context-enhanced Authorization
  18. 18. 18 Context-enhanced Authorization
  19. 19. Context – AuthZ levels • All • @office, proximity, IT-dept. mngd laptop • A lot • @home, proximity, IT-dept. mngd laptop, time in 6.00-23.00 • Some • @office, user mngd (but registered) iPad, agenda, time in 6.00- 23.00 • IT-dept. mngd laptop, proximity, agenda, time in 6.00-23.00 • A little • Proximity, registered device • Nothing19 Context-enhanced Authorization
  20. 20. Use-cases • Finer grained access to application with “hit-n-run” functionality • Data loss prevention when traveling • More flexible authentication20 Context-enhanced Authorization
  21. 21. Challenges • Adoption in applications • Architectural choices • Authenticity of context • Complexity of policies • Lack of standards for context management • Linking context to user identities • Privacy consequences • Quality of context • Scalability and performance • …21 Context-enhanced Authorization
  22. 22. Authenticity of context • Can we trust the source? • Depends on the precise scenario • and on technology • and on who controls the source • Some sources are more trustworthy than other • Just fuse with more context sources? • Multi-factor context, harder to fake for attacker • But also harder to understand22 Context-enhanced Authorization
  23. 23. Authenticity of context CeA vs TM (SIEM, …): Needed trust in authenticity of context mon saction catio p atio nced in n u ng la Auth + step Exp itori a Auth ext-enh n enti Tran + CeA CeA oriz t Con23 Context-enhanced Authorization
  24. 24. Scalability & performance24 Context-enhanced Authorization
  25. 25. (Preliminary) conclusions • Using context-information in authz policies • Some use-cases • Challenges in selecting the right types of context, in adoptation, in how to deal with quality of context (incl. authenticity) • Demonstrator under construction, due the next couple of weeks25 Context-enhanced Authorization
  26. 26. 26 Context-enhanced Authorization

×