Access Control Status Report Group Name: ARC/SEC Source: Dragan Vujcic, Oberthur Technologies, Meeting Date: 09/12/2013 Agenda Item:

Slides:

Advertisements

Similar presentations

Access Control Mechanism Discussion

Advertisements

SEC Clarification Group Name: WG4 (SEC-2014-xxxx) Decision  Meeting Date: Discussion  Source: OBERTHUR Technologies Information  Contact:

Access Control Mechanism for User Group Name: SEC WG Source: Seongyoon Kim, LG Electronics, Meeting Date: Agenda Item:

Problem of Current Notification Group Name: ARC WG Source: Heedong Choi, LG Electronics, Meeting Date: ARC 9.0 Agenda Item: TBD.

Service Layer Session Management Group Name: WG2-ARC Source: IDCC, LGE, ZTE Meeting Date: TP16 Agenda Item:

Computer Security: Principles and Practice EECS710: Information Security Professor Hossein Saiedian Fall 2014 Chapter 4: Access Control.

Role Based Access Control Models Presented By Ankit Shah 2 nd Year Master’s Student.

Configuration Management

Lecture slides prepared for “Computer Security: Principles and Practice”, 2/e, by William Stallings and Lawrie Brown, Chapter 4 “Overview”.

SPC204 Security Problems in SharePoint 2010 Authentication and Authorization.

1 © Talend 2014 XACML Authorization Training Slides 2014 Jan Bernhardt Zsolt Beothy-Elo

Survey of Identity Repository Security Models JSR 351, Sep 2012.

2-levels Access control for HTTP binding Group Name: WG4 (& WG2/WG3 for information) Source: Shingo Fujimoto, FUJITSU, Meeting.

Switch off your Mobiles Phones or Change Profile to Silent Mode.

App-ID Use Cases, Syntax and Attributes SEC App-ID_Use_Cases,_Syntax_and_Attributes Group Name: Architecture Source: Darold Hemphill, iconectiv,

In-Band Access Control Framework Group Name: WG4 SEC Source: Qualcomm Meeting Date: Agenda Item:

CSCE 201 Introduction to Information Security Fall 2010 Access Control.

In-Band Access Control Framework Group Name: WG4 SEC Source: Qualcomm Meeting Date: Agenda Item:

G53SEC 1 Access Control principals, objects and their operations.

Management of CMDH Policies Group Name: WG5-MAS Source: Wolfgang Granzow, Qualcomm, Meeting Date: Agenda Item: Management.

Extensible Access Control Framework for Cloud Applications KTH-SEECS Applied Information Security Lab SEECS NUST Implementation Perspective.

Supporting long polling Group Name: ARC WG Source: SeungMyeong, LG Electronics, Meeting Date: x-xx Agenda Item: TBD.

Access Control Status Report Group Name: ARC/SEC Source: Dragan Vujcic, Oberthur Technologies, Meeting Date: 09/12/2013 Agenda Item:

By: Nikhil Bendre Gauri Jape.  What is Identity?  Digital Identity  Attributes  Role  Relationship.

Step by step approach Group Name: WG2 Source: Michael hs. Yang, LG uplus, Jaeseung Song, NEC Europe, Meeting.

Status Report on Access TP8 Group Name: WG2 Decision  Meeting Date: Discussion  Source: OBERTHUR Technologies Information  Contact:

Academic Year 2014 Spring Academic Year 2014 Spring.

App-ID Use Cases, Syntax and Attributes ARC R01-App-ID_Use_Cases,_Syntax_and_Attributes Group Name: Architecture Source: Darold Hemphill, iconectiv,

Introducing WI Proposal about Authorization Architecture and Policy Group Name: WG4 Source: Wei Zhou, Datang, Meeting Date: Agenda Item:

Introducing WI Proposal about Authorization Architecture and Policy Group Name: WG4 Source: Wei Zhou, Datang, Meeting Date: Agenda Item:

Interworking with an External Dynamic Authorization System Group Name: SEC WG Source: Qualcomm Inc., Wolfgang Granzow & Phil Hawkes Meeting Date: SEC#20.2,

SEC Conference calls following TP#11 Group Name: WG4 (SEC ) Decision  Meeting Date: Discussion  Source: OBERTHUR Technologies Information.

Role Based Access Control In oneM2m

Computer Security: Principles and Practice

M2M Service Session Management (SSM) CSF

Comments on Procedures for RBAC (doc#0056) Group Name: WG4(SEC), WG2(ARC) and WG5(MAS) Source: Suresh Nair, Alcatel-Lucent,

WG-2 - ARC TP #18 Status Report Group Name: oneM2M TP #18 Source: WG2 Chair (Nicolas Damour – Meeting Date: Agenda.

M2M Service Subscription Profile Discussion Group Name: oneM2M TP #19.2 Source: LG Electronics Meeting Date: Agenda Item:

Introducing Event handler Group Name: SEC & ARC Source: FUJITSU Meeting Date: Agenda Item: Device Configuration.

Discussion about RESTful Admin API Group Name: SEC & ARC Source: FUJITSU Meeting Date: Agenda Item: Device Configuration.

Security API discussion Group Name: SEC Source: Shingo Fujimoto, FUJITSU Meeting Date: Agenda Item: Security API.

M2M Service Layer – DM Server Security Group Name: OMA-BBF-oneM2M Adhoc Source: Timothy Carey, Meeting Date:

SEC #11 WG4 Status & Release 1 Outlook Group Name: Source:,, Meeting Date: Agenda Item:

M2M Service Session Management (SSM) CSF Group Name: WG2-ARC Source: IDCC, LGE, ZTE Meeting Date: TP8 Agenda Item:

Attribute-level access control Group Name: ARC WG Source: Yuan Tao, Mitch Tseng, Huawei Technologies Meeting Date: ARC 16 Agenda Item: TBD.

WG2 - ARC TP #20 Status Report Group Name: oneM2M TP #20 Source: WG2 Chair (Nicolas Damour – Meeting Date: Agenda.

Clarification of Access Control Mechanism on Rel-1 & Rel-2 Group Name: SEC ( ARC & PRO for information) Source: FUJITSU Meeting Date: Agenda.

Issues of Current Access Control Rule and New Proposal Introduction Group Name: ARC 21 Source: Wei Zhou, Datang, Meeting Date:

Authorization Architecture Discussion Group Name: SEC WG Source: Seongyoon Kim, LG Electronics, Meeting Date: 28 MAY, 2014 Agenda.

Draft way Forward on Access Control Model and associated Terminology Group Name: SEC Source: Dragan Vujcic, Oberthur Technologies,

TP WG1 - REQ Progress Report at TP #14 Group Name: WG1 REQ (Requirements) Source: WG1 Vice Chair (Joerg Swetina, NEC), Secretary Changho RYOO,

Consideration Security Issues on Registration Group Name: WG4 (SEC) Source: Shingo Fujimoto, FUJITSU, Meeting Date:

WG5 – MAS#22 Status Report Group Name: WG5 MAS (Management, Abstraction & Semantics) Source: Tim Carey(Alcatel-Lucent, WG5 Vice Chair) Meeting Date:

Chapter 4 Access Control. Access Control Principles RFC 4949 defines computer security as: “Measures that implement and assure security services in a.

DM Collaboration – OMA & BBF: Deployment Scenarios Group Name: WG5 - MAS Source: Tim Carey, ALU, Meeting Date:

1 Authorization Federation in Multi-Tenant Multi-Cloud IaaS Navid Pustchi Advisor: Prof. Ravi Sandhu.

Windows Active Directory – What is it? Definition - Active Directory is a centralized and standardized system that automates network management of user.

Introducing User’s Role concept Group Name: WG2(ARC) and WG4(SEC) Source: Shingo Fujimoto, FUJITSU, Meeting Date:

Specifying the Address of Management Client of Managed Entity Group Name: ARC Source: Hongbeom Ahn, SK Telecom, Meeting Date: TP#21 Agenda.

Adding Role to ACPs Group Name: SEC Source: OBERTHUR Technologies, Dragan Vujcic Meeting Date: Agenda Item: RBAC.

Survey of Identity Repository Security Models JSR 351, Sep 2012.

Identity and Access Management

Discussion about Use Case and Architecture in Developer Guide

Proposed design principles for modelling interworked devices

MAF&MEF Interface Specification discussion of the next steps

WPM ad-hoc group report TP#25

Considering issues regarding handling token

Service Layer Dynamic Authorization [SLDA]

Ashish Pandit Louis Zelus

Access Control What’s New?

Presentation transcript:

Access Control Status Report Group Name: ARC/SEC Source: Dragan Vujcic, Oberthur Technologies, Meeting Date: 09/12/2013 Agenda Item:

Status This status reflects the discussions of the Ad-Hoc AC/ACL/RBAC calls between TP#7 and TP#8 Contribution submitted © 2012 oneM2M Partners 2 SEC Terminologies and Procedures for RBACFUJITSUDiscussed Revision expected SEC R01 In-Band Access Control FrameworkQualcommDiscussed Revision expected SEC ALU Comments on SEC Alcatel- Lucent Discussed Requirements for approval SEC Draft way Forward on Access control Model and associated Terminology OberthurPostponed

USER concept USER of Application (Application Domain) – Is seen to be out of scope of the oneM2M Access Control Management (User Authentication at AE) – Access Control decision and Security impacts at CSE is to be considered- FFS USER of Service Layer (Service Layer Domain) – Using/Consuming the CSE Service/Resources. – USER as OWNER of the application – USER is Role based (RBAC principle) – Roles Authentication and Authorization at CSE © 2012 oneM2M Partners 3

In/Out Band Access Control In Band Access control – Authentication and Authorization at Service Layer ( CSE ) – FFS for Authorization Enforcement and Decision CSE Out Band Access control – External Authentication and Authorization – E.g.: OAuth, OpenID Both to be supported by oneM2M TBD if both or prioritize one at Rel.1 timeframe © 2012 oneM2M Partners 4

Attribute-Based Access Control RBAC+ABAC – Access Control Decision based on Roles and additional attributes. – Attributes may be characteristics of a role requesting access, as well as attributes of the resources being requested, against a policy that defines who is allowed to receive access and under what conditions Support for ABAC in Rel.2 TBD if needed at Rel.1 timeframe © 2012 oneM2M Partners 5

Delegation Concept Delegated operation – Authorization access to resources are delegated with delegating identity of the Resource Owner – External Authentication and Authorization( outBand access control) done by the Application Server (OAuth, OpenID, etC..). Token based Permission – The Security issues and threats have been raised – Some Security Requirements identified FFS on the use cases. Concept to be in Rel.1 TBD what should be specified at Rel.1 timeframe ? © 2012 oneM2M Partners 6

Where we’re going Approval of specific operation on a specific resource ARC work is ongoing on Resources (through ACLs) Resource (or Data) is within an Object Operation (e.g.: CRUD) is ability to do something on Objects Lead ARC + support ALL User Active Entity Attributes OPERA TIONS OBJECTS Privileges (ActE) Active Entity Assignment (PA) Permission Assignment Sess- ions activeEntity_sessions session_attributes Authorization Evaluation FFS: Data Structure for decision f (ID, rôle, Access Rights subscription, service, etc…) Lead SEC + supp.ALL Controlled Access to Permissions Security features before access to resources is granted – Identification, – Authentication – Managemnt of assignments and activation Sessions Attributes Permissions.. Lead SEC Resources of Entity being accessed