Secure Information Sharing Using Attribute Certificates and Role

Based Access Control^{∗}

Ganesh Godavari and Edward Chow Department of Computer Science, University of Colorado, 1420 Austin Bluffs Parkway Colorado Springs, Colorado 80917 USA gkgodava@cs.uccs.edu, chow@cs.uccs.edu

Abstract

In this paper, we explore the issues involved with the design and rapid deployment of large scale secure information sharing (SIS) systems for coordination involved with multiple agencies. Procedures and tools were developed for setting up quickly the public key infrastructure (PKI) and privilege management infrastructure (PMI) for the multiagency SIS systems. A multi-agency SIS testbed based on LDAP servers and web servers was built to explore the use of the attribute certificate, public key digital certificate, and role-based access control for secure access and efficient authorization. LDAP servers were enhanced to accept attribute certificates. The LDAP module for the apache web server was extended to submit the LDAP query based on the subject field of the client certificate, and to authorize the web access based on the attribute certificate return from a LDAP server. Preliminary performance of the SIS prototype shows that the techniques and tools developed can rapidly set up the PKI and PMI for a large scale multi-agency, web-based, SIS system and support secure web accesses based on the effective role-based access control and authorization. They can be used to support the critical information and communication needs of a joint task force assembled for unexpected natural disasters, nuclear/chemical accidents, or terrorist attacks.

Keywords: Secure Information Sharing, Attribute Certificate, LDAP, PKI, PMI.

1 Introduction

As the WWW is quickly becoming a place for sharing of information, piracy and misuse of information are quickly becoming a threat. Security and Authorization become necessary. This situation not only provides excellent business opportunities but also posts research challenges. One of the most challenging problems in managing large secure information sharing (SIS) systems is the complexity of security administration, particularly the management of digital certificates and the role based access control. The creation and management of an SIS system for a rapidly deployed joint task force from multiple agencies impose the stringent requirements on the information infrastructure, since both the public key infrastructure (PKI) and the privilege management infrastructure (PMI) need to be set up quickly and to process large volume of requests. The related digital certificates need to be signed and distributed to large members of the task force. The servers, applications, and resource utilized by the task force needs to be configured to recognize the new certificates and to provide secure access according the roles of the members. Role-Based Access Control (RBAC) simplifies the access control administration and provides better manageability in enterprise environments by allowing permissions to be managed in terms of user job roles [?]. RBAC maps user job roles to application permissions so that the access control administration can be accomplished in terms of the job role of users. This means that administrators will have to set up and assign clients with roles, such as employee, manager and administrator, without having to change the access permission on each client. Many of the e-commerce applications require authentication services, in addition to the basic services provided by PKI, to allow users to do what they are allowed to do. Authentication means that that the sender of a message or transaction is verified to be who they claim to be, while authorization means that someone who has the authority to do what, so he/she can initiate or progress a transaction, process, or activity. In simple terms, authentication is what is required to gain access e.g., a passport, driving license, or in computing terms, such as passwords and strong digital certificate authentication. Authorization deals with what you are permitted to do, once you are authenticated. Public key certificate (PKC) strongly binds a public key to its subject (country, location, organization unit etc.) helping to identify the holder of the certificate. Attribute certificates (AC) have been proposed as a solution for the authorization services [?, ?, ?]. It is designed to convey a potentially short-lived attribute about a given subject to facilitate flexible and scalable privilege management. The attribute certificate may point to a public-key certificate that can be used to authenticate the identity of the attribute certificate holder. Some research and development efforts have been done in this area [?, ?, ?], but these efforts are still in preliminary phase, and no authorization mechanism is widely accepted. We were motivated by the need of using PKI, PMI and RBAC concepts to construct an authorization mechanism which uses the PERMIS [?, ?] model of storing the user’s roles in ACs. Access control decisions are driven by an authorization policy, and the authorization policy is also stored in an AC. The organization of this paper is as follows. Section 2 provides an overview of the related research. Section 3 describes the design and implementation of the secure information sharing (SIS) system architecture. In Section 4 we present the SIS prototype and analysis of its performance results. In Section 5, and 6 we discuss future directions of research and conclusions.

∗This research work was supported in part by a NISSC AFOSR Grant award under agreement number F49620-03-1-0207.

2 Related Research Technologies

2.1 Role Based Access Control

Role-based access control [?, ?, ?, ?, ?] has gained attention as a proven alternative to traditional discretionary and mandatory access control mechanisms. RBAC helps specify organization’s security policies reflecting its organizational structure. In the RBAC, a user can be assigned one or more roles, and a role can be assigned to one or more users. Roles are based on the user’s job responsibilities in the organization. This provides for flexibility and finer granularity during the assignment of access permissions to roles and users to roles. In the role-based model, the role hierarchy partially determines which roles and permissions are available to users via various inheritances. For example, a senior role can inherit permissions from junior roles. A user establishes a session during which he activates some subset of roles of which he is a member. RBAC provides static separation of duty relations to prevent conflict of interests that arise when user gains permission associated with conflicting roles. It also provides dynamic separation of duty relations to place constraints on roles that can be activated in the session of a user.

Figure 1: RBAC model[?]

The RBAC in Figure 1 consists of 1) a set of users (USERS) where a user is an intelligent autonomous agent,

2) a set of roles (ROLES) where a role is a job function, 3) a set of objects (OBS) where an object is an entity that contains or receives information, 4) a set of operations (OPS) where an operation is an executable image of a program, and 5) a set of permissions (PRMS) where a permission is an approval to perform an operation on objects. The cardinalities of the relationships are indicated by the absence (denoting one) or presence of arrows (denoting many) on the corresponding associations. For example, the association of user to session is one-to-many. All other associations shown in the figure are many-to-many. The association labeled Role Hierarchy defines the inheritance relationship among roles. Further information about RBAC is available at [?].

2.2 Privilege Management Infrastructure (PMI)

PMI is the information security infrastructure that assigns privilege attribute information such as privilege, capability, and role, etc., to users, and issues and manages it using the X.509 Attribute Certificate. Attribute Certificates (ACs) were initially introduced in Recommendation X.509 Ű 97, but they were fully covered in Recommendation X.509 - 2000 published in year 2001. The PKIX WG from the IETF has endorsed a profile of attribute certificates in April 2002 with the RFC 3281. The PMI supports access control service using the user’s privilege management in application services. The function of the PMI is to specify the policy for the attribute certificate issuance and management. Then, the PMI carries out the AC-related management functions such as issuing, updating, and revoking an attribute certificate based on a specified policy. In PMI the ACs issuer is called Attribute Authority (AA). ACs are digitally signed by the AA, so they are tamperresistant. The trusted root is called source of authority (SOA). When a user’s authorization permissions need to be revoked, AA will issue an attribute certificate revocation list (ACRL) containing the list of ACs no long to be trusted. There are two primary models for distribution of attribute certificates: the ‘push’ or ‘pull’ model. In the push model the client needs to present its AC to the server, so the client needs to contain AC. The ‘push’ model is suitable in application where the client’s permissions should be authenticated/validated in the client’s ‘home’ domain. In the ‘pull’ model the client presents its identity to the server, the server retrieves the client’s AC from a repository. Therefore the client does not contain AC. The ‘pull’ model is suitable when the client’s privileges should be authenticated in the inter-domain. In the ‘pull’ model a change in the organizations role permissions only requires an update in the repository, while in the push model clients with the same role need to update their AC. Figure 2 below shows the difference between PKC’s, and AC’s. PKC binds a subject(DN) to a public key while AC’s have no Public Key but binds permission (attributes) to an entity.

Figure 2: PKC and Attribute certificates

Further information about AC is available at [?].

3 Design and Implementation of an SIS System

3.1 Design Considerations

Although the concept of role-based access control (RBAC) began 25 years ago, It gained wide spread interest in 90’s. A study by NIST [?] on 28 organizations revealed that RBAC addresses many needs of the commercial and government sectors. In this study of 28 organizations it was found that many organizations based access control decisions on the roles that individual users take on as part of the organization and also found that permissions assigned to roles tend to change relatively slowly compared to the changes in user membership of roles. With RBAC it is possible to predefine role-permission relationships, which makes it simple to assign users to the predefined roles. Since access control mechanism is crucial in enforcing and tracking secure information distribution and traditional discretionary and mandatory access control are too restricted, we have investigated RBAC, which provides flexibility and allows dynamic update. National Institute of Standards and Technology (NIST) has recently ratified RBAC draft into a standard. RABC is currently being used in various database management systems like Sybase and J2EE/Java servers. The central notion of RBAC is that permissions are associated with roles, and users are assigned to appropriate roles. This greatly simplifies management of permissions. Roles are created for the various job functions in an organization and users are assigned roles based on their responsibilities and qualifications. Users can be easily reassigned from one role to another. Roles can be granted new permissions as new applications and systems are incorporated, and permissions can be revoked from roles as needed. RBAC model can be used for interaction between organizations are planning to coordinate and share information in entirety or part wise. Some of the challenges faced in ensuring cooperation are

• Confidentiality: Information available at the organizations is confidential and should not be shared with people outside the organization(s). Access to such information has to be restricted to a selected group of people with in the organizations that are involved in the cooperation. This problem becomes hard if the roles of the people outside the organization are not defined properly.

• Non-Repudiation: The shared information may changed by people belonging to various organization. Changes made must be monitored to ensure reliability of the information, along with the ability to provide nonrepudiation service for changes made to the shared information.

• Decentralized maintenance and control: Information shared by each organizational should be managed and maintained by that organization. This helps not only to remove the disputes raised by questions like "who is responsible for what?", but also simplifies the maintenance of information. If USER-A of Organization-A wants to access information from organization-B, then organization-B is responsible for providing a certificate to USER-A for authentication and authorization. These certificates are stored at Organization-A along with other information about USER-A in the LDAP server. This might cause the user to be overwhelmed by number of certificates he needs to maintain; one for each organization involved in the coordination.

3.2 Establishing PKI for SIS

When a task force is formed with multiple agencies or organizations, the first task is to issue a valid certificate to the members of the task force. User certificate maintenance problem can be alleviated, if all the organizations participating in the information sharing service have the same rootCA. The following steps outline a procedure for setting up a PKI for the task force.

1. The coordinator of the task force from multiple agencies set up a rootCA-MA (root CA for Multiple Agencies).

2. Each agency requests a certificate to be signed by rootCA-MA.

3. Each agency issues a new PKC to each user in its organization involved in the task force.

4. At each server which providing secure information sharing service for this task force, add the rootCA-MA information into CABundle (file containing list of valid CA’s).

5. Each client/user installs the certificate in the local browser or application(s).

With a large task force, it takes a long time for the PKI to be established. We developed a tool for automating the certificate creation process. We compare the performance of this automated tool with that of manual signing process. The automated tool uses expect library and OpenSSL to sign the certificates. Automated tool can sign 100 certificates in 2 min and 13 sec on a Pentium-III machine with 512 MHz, 512 MB RAM configuration. Based on my own person experience generating one certificate manually takes about 2 min 35 sec. In a joint task force with 100 organizations and 100 participants from each organization coordinating, in the worst case the time taken in the manual process is 516 min and 40 sec, while time taken in an automated process = 2 min and 14.33 sec.

3.3 Establishing PMI for SIS

The leaders of the task force will decide the roles of its members. To speed up the rapid deployment process, the existing information infrastructure, such as LDAP servers at those agencies can be recruited to serve as the PMI components for the SIS system. The other possibility to set up a dedicated SIS system with its own LDAP servers, web servers, and resources that move the task force when the communication bandwidth and delay to servers in those existing information infrastructures become bottlenecks. The following steps suggest a procedure for setting up a PMI for the task force.

1. The coordinator of the task force signed the attribute certificates of the members.

2. The attribute certificates belong the members of an agency are distributed and installed on the LDAP server of the agency.

3. The web servers and shared applications are configured to query the PMI for authorization and access control.

3.3.1 Organizational Information Sharing System Overview

Our access control system is designed to support RBAC using X.509 PKIs and ACs. The authentication is implemented by PKI, and the authorization is implemented by AC. Role information is stored in User Role Specification AC’s (see section ‘Administration tool’). All the access control decisions are made based on authorization policies. They are written in XML and stored in ACs. ACs and their corresponding PKIs are all stored in LDAP servers [?]. In our current prototype implementation we have a simple RBAC policy specification file as shown in Table 1.

<?xml version="1.0" encoding="utf-8" standalone="yes"?> <!–======= SIS rbac parsing example =======–> <SIS>

<userRoleSpecification> <Role>Teller</Role> <Group>Info Share</Group> <OU>banking</OU>

</userRoleSpecification> </SIS>

Table 1: Sample RBAC File Format

An SIS system consists of the following components:

• Administration Tool: is used for creating key pair, PKIs, User Role Specification ACs.

• RBAC Policy file: specify the roles and what privileges the role can have on the resources. Access control decisions are made based on these privileges. This information is stored in AC generated using administrative tool.

• Ldap Server: stores the user’s information along with User Role Specification ACs and Delegated Role Specification AC’s.

• Access Control Decision and Enforcement: executes the function of authorization and informs the target if the user has the privileges or not.

• Resources: they may be web servers, database servers, or any other format of resources.

Figure 3 shows the interaction of the various SIS components. The administrative tool generates X509 certificates and User Role Specification AC for the users participating in the secure information sharing service. The RBAC policy file passed to the administrative tool is used for embedding the policy information in the AC. The ACs generated by the administrative tool are stored in the LDAP server along with other information about the user. The user X509 certificates are installed in the his/her client application. Access Control Decision and Enforcement (ACDE) engine makes sure that the user has the required authorization privileges to access the resource. The user needs to submit his/her X509 certificate to the ACDE in order to access a resource. The ACDE verifies the user X509 certificate, and queries the LDAP server for the user AC. If the user has the required privileges to access the resource, access permission is granted.

Figure 3: Interaction between various SIS componenets

3.4 Mapping Role Hierarchy to permissions

Mapping of Role Hierarchy of the organization to permissions for directory access is critical for enabling information sharing and providing access restrictions. Figure 6 shows the mapping of user roles to directory access Permissions. USER3 has access permissions to USER3, USER2 and USER1 directories. The organizational role hierarchy information is contained in the configuration file of the apache. The module uses the Role information in the user AC along with role hierarchy information, to determine the access permissions to the requested web document. Figure 4 shows the mapping of role hierarchy to access permissions.

Figure 4: Mapping Role Hierarchy to Permissions

3.5 Administration tool

OpenSSL [?] provides strong open source cryptographic library for X509, and SSL&TLS. Currently OpenSSL does not have any support for AC except for RFC 3281 AC’s ASN.1 object definitions. We wrote the code for AC generation using the crypto library and ASN.1 object definitions in OpenSSL. There are two types of Attribute Certificates in our proposed architecture system:

1. ‘User Role Specification’ attribute certificate which tells what privilege(s) a user has. It is used by the decision making service to make a decision to determine whether a user has access information or resources available in application services.

2. ‘Delegated Role Specification’ attribute certificate which tells what privileges are given for a resource(s) by a user of higher authority.

In the User Role Specification AC the issuer and signature values belong to that of Attribute Authority. In Delegated Role Specification AC the issuer and signature value belongs to the user who delegated the authority. To issue User Role Specification AC, the tool needs the AA’s certificate and key, and user’s certificate along with RBAC policy file. To issue Delegated Role Specification AC, the tool needs the delegating user’s certificate and key, and user’s certificate along with RBAC policy file specifying the authority delegated. In our prototype we adopt AC ‘Pull’ model, so the role ACs are not given to users. The ‘User Role specification’ and ‘Delegated Role Specification’ ACs are all stored in LDAP servers.

3.6 Access Permissions specification Format

Currently there are no XML parsers that can parse XML data fast. This can create a bottleneck if the XML file is large. We can optimize parsing by parsing XML tags that are of interest to us. In the XML document shown below, some of the tags are repeated, e.g., Role, Group, OU. Hence, a rule syntax is needed to allow for selecting a particular set of tags in the rule set. Here is an example of a scheme that addresses this problem. To specify a rule based on Group value present in the second item tag within the first userRoleSpecification tag, the rule will be specified as Śsis: 1.userRoleSpecification:2.OUŠ. As another example, ’sis: 1.userRoleSpecification:1: GroupŠ specifies a rule based on the Group tag present within the first UserRoleSpecification tag in the first sis tag. We use this method of representation for specifying access permissions.

3.7 Information Sharing among Multiple Agencies

We implemented the Access Control Decision and Enforcement (ACDE) engine as an Apache [?] module. It is responsible for providing the authorization service for web requests between user and the requested target file(s).

<? xml version="1.0" encoding="utf-8" standalone="yes"?> <!–======= SIS rbac parsing example =======–> <SIS>

<userRoleSpecification> <Role>Manager</Role> <Group>communication</Group> <OU>Info Share</OU>

</userRoleSpecification> <userRoleSpecification>

<Role>TeamLeader</Role>

<Group>communication</Group> <OU>banking</OU>

</userRoleSpecification> </SIS>

Table 2: Access Permissions specification Format

This framework separates authentication service, provided by ModSSL [?] from authorization service. Our prototype consists of following components: Initiator (e.g. a browser), Target (web server), Access Control Decision and Enforcement (ACDE) provided by the apache_sis_module. Figure 5 shows the control flow in ACDE engine. Figure 6 shows the message flow between these components. The initiator submits secure web access request to the web server. Through SSL protocol the client and the web server are mutually authenticated through the exchange of their digital certificates. From the uri of the submitted HTTP request, the web server identifies that the corresponding directory contains special access control as specified in the httpd.conf configuration file. The corresponding <directory>section of the httpd.conf file contain the information port number, bind password of the LDAP server where the web server queries for the authorized permission on behalf of the client. Besides the LDAP server location, it also includes the specification of the access right associated with the role which will be contained in the LDAP query result. The web server extracts the client information from the subject field of the client certificate and submits them in the LDAP query request to the LDAP sever. The LDAP server retrieves the corresponding client’s attribute certificate and returns it to the web server. The web server translates the role containing in the attribute certificate into the related access right. If the command contains in the HTTP request does not match with the resulting accessing right, the request will be rejected. For example, if this is a POST command while the role of the client only has read access right, the request will be rejected.

Figure 5: Control Flow in Access Control Decision and Enforcement engine

4 Experimental results

In this section, we present the details of our prototype and its performance.

4.1 Prototype implementation

We developed a Secure Information Sharing system prototype for supporting a joint task force from multiple agencies with web based approach. Authentication was provided for Apache (v 1.3.31) web server using third party module Mod_SSL (v 2.8.18-1.3.31), which uses OpenSSL (v 0.9.7d) package for providing SSL & TLS. The Web server is configured to validate the clients, by requesting for client certificates. LDAP module [apacheldap] for Apache was enhanced to provide ACDE functionality. Attribute Certificate’s attribute definitions was added to inetorgperson.schema in OpenLDAP (v 2.0.27-8) [?]. attributeCertificateAttribute attribute is added to inetOrgPerson objectclass in inetorgperson.schema file. Table 3 below shows the AC attribute definition. OpenSSL libraries were also used for generating X509 certificates. For example, we use the following command to add the attribute certificate to the enhanced LDAP server.

ldapadd -xv -D "cn=manager,dc=sis-nissc,dc=edu" -W -f entries.ldif -h hostDNSname #ldapsearch -C -b "cn=alpha-sis-nissc,ou=Research,ou=coordinationExercise,dc=sis-nissc,dc=edu" -x "(objectclass=*)"

Figure 6: Message Flow between the components

# attribute certificate attribute definition

attributetype (2.5.4.58 NAME ’attributeCertificateAttribute’ DESC ‘A binary attribute certificate’ EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.8 )

Table 3: attributeCertificateAttribute definition [?]

The entries.ldif is a file that contains the LDAP entry in Lightweight Directory Inter-exchange Format. -D option specifies the root DN of the LDAP server. -x specifies the use of simple authentication instead of SASL. -W is used to prompt the password. -v for the verbose mode. The commented ldapsearch command can be used to verify if the entry has been added to the LDAP server.

4.2 Experimental setup

We set up a testbed to simulate the coordination among four different agencies. The four different agencies shared a similar Directory Information Tree (DIT) shown in Figure 7. Each agency runs a SIS node which is installed with an OpenLDAP server and an Apache web server with sis module. The operating systems are Linux Redhat 8.0 or 9.0. Netscape and Internet Explorer browsers were used as clients. Each SIS node is a HP Kayak machine with PII 233MHz, 96MB RAM, and 10 Mb Ethernet connection.

Figure 7: LDAP DIT Format at each agency

Figure 8 shows the multi-agency testbed. The following steps take place for a user (alpha-sis-canada) in organization sis-canada.csnet.edu to retrieve a web document from a web server located in sis-nissc.csnet.edu

1. alpha-sis-canada sends a secure web request to sis-nissc.csnet.edu. sis-nissc.csnet.edu validates alpha-sis-canada’s certificate for authentication.

2. If the certificate is valid, sis-nissc.csnet.edu uses the subject (DN) in the certificate, to establish connection with the LDAP server on sis-canada, and retrieves his AC.

3. sis-nissc.csnet.edu validates alpha-sis-canada’s AC and checks if alpha-sis-canada has the right privileges. The coordinationExercise group is allowed to retrieve data from sis-nissc.csnet.edu

4. sis-nissc.csnet.edu returns web documents back to alpha-sis-canada using the secure communication channel.

4.3 Performance Results

Table 4 show the performance results of sis-module multiple agency scenarios.

client-server Total time taken for LDAP access (ms)

Total Time taken for Attribute certificate retrieval and validation (ms)

sis-canada-sis-nissc.csnet.edu  54.623001  96.885002
sis-canada-sis-connecticut.csnet.edu 51.845001  93.778999
sis-canada-sis-newjersy.csnet.edu  51.191002  93.310997

Table 4: Performance Results in a multiple agency scenario

Figure 8: multi-agency prototype testbed of SIS

5 Lessons Learnt and Future Directions

We were not able to store attribute certificates in the current stable versions of OpenLDAP (2.2.15) due to the lack of support the AC attribute definitions with the desirable object class. An older version of OpenLDAP (2.0.27) was enhanced to support attribute certificate using inetOrgPerson object class. Hope future OpenLDAP version will be able to support AC more easily. Some servers such as Java-based Tomcat web server and J2EE application server have already adopted role based access control and can be easily modified to interact with the proposed privilege management infrastructure based on attribute certificates. Other web servers or applications such as Apache may require additional instrumentation to interact with LDAP-based PMI and to implement the access control related to specific roles. Our implementation of LDAP-sis module for the Apache server provides a glimpse of what is required to modify a legacy information system component and suggests the need for a well defined API and protocol for the servers and applications to interact with the PKI/PMI of an SIS system. Our current SIS prototype only supports the passive secure web accesses. We are currently working on techniques and tools for supporting a large scale secure notification system where urgent information can reach members of a joint task force in a timely and secure manner with the option of collecting acknowledgements and replies. The other related task is to track and protect the distributed sensitive documents.

Policy specification is critical in an information sharing environment. We plan to evaluate if and how a policy specification language like eXtensible Access Control Markup Language, can be used for specifying RBAC policies. It is important to examine how digital rights and attribute certificates can work together for monitoring malicious activities on access violations by a client.

6 Conclusion

We discussed the issues involved with the design and rapid deployment of large scale secure information sharing systems for coordination involved with multiple agencies. Procedures and tools were developed for setting up PKI and PMI quickly for the multi-agency SIS systems. A multi-agency SIS testbed based on LDAP servers and web servers was built to explore the use of the attribute certificate, public key digital certificate, and role-base access control for secure access and efficient authorization. LDAP servers were enhanced to accept attribute certificate. The LDAP module for the apache web server was extended to submit LDAP query based on the subject field of the client certificate, and to authorize the web access based on the attribute certificate return from a LDAP server. Performance of the prototype shows that the techniques and tools developed can rapidly set up the public key infrastructure and privilege management infrastructure for a large scale multi-agency, web-based, secure information sharing system and support secure web access based on the effective role-base access control and authorization. They can be used to support the critical information and communication needs of a joint task force assembled for unexpected natural disasters, nuclear/chemical accidents, or terrorist attacks.