Research on System of Enterprises＇ Information Management Based on Attribute Certificate

Abstract: In order to accommodate the complex network data of large scale companies， this thesis analyses PMI， strategy and role hierarchical model. On such a basis， the thesis proposes an applicable plan for access control of enterprises’ information system based on attribute certificate.

Key words: PKI; PMI; access control; attribute certificate

中圖分類號:TP311文獻標識碼:A 文章編號:1009-3044(2009)36-10590-02

1 Introduction

Currently the technology of information and network develops rapidly. As a result， e-commerce， e-government and e-office prevail over our society and have become a part of our life. This situation enhances the efficiency of work and changes our lifestyle， meanwhile， a large amount of problems regarding information security have been caused consequently. Under the circumstances， PKI (public key infrastructure) is more and more indispensable in security support system with regard to a variety of network applications. However， as the growing complexity of the network structure as well as the expansion and penetration of usage of network， mere identity of user will no longer meet our requirements， instead， we are going to need a new security system， in which the identity of user and its permission can be confirmed. Therefore the notion of PMI (Privileges Management Infrastructure) has been raised in X.509v4 (2000)， which provides us with a new idea for the authorization management of network security system.

2 Problems in permission management mechanism

At present in companies of large scale， different systems， to protect their own resources， apply different ways for permission management and control， which is inevitably causing lots of problems. In the inner aspect， data from different system has different ways in permission distribution， lacking of a unified management， and causes confusions among different management systems. Furthermore， in order to secure the permission under their own management systems， more work will be done by the administrators of different systems as a whole， which will certainly decrease the efficiency of permission management. In the external aspect， due to the large number of the staff and the customers of a company， it won’t be easy for different systems to work as a whole to accommodate the continuous changes of the status and the permissions of users. In view of this， enterprises need to work out a more considerate permission management system， with an unified strategy and implement.

3 PMI architecture

On the basis of PKI， PMI raises a new notion of information protection infrastructure that can integrate with PKI. As a new set of infrastructure， PMI can process specific authorization to authorized users.

PKI and PMI aim at different requirements， either of them plays an important role in security infrastructure. PKI weight more in identifying users. Whereas， PMI is focusing on authorization and access control， identifying whether or not a user is authorized. Obviously， this kind of difference decides their different functions. A substantial condition for activating an authorization is the pre-confirmation of a user and its identity， which forms a substantial condition for the access control. Compared with traditional access control strategy， PMI can be accomplished independently apart from concrete applications， meanwhile， provide various network applications with centralized and efficient authorization management mechanism， which is the sharpest edge. It is the superior dominant that PMI can play a role in the flexibility and suitability of the application of access control， as well as reduce the cost of management.

The access control RBAC which based on the roles is a significant way for attribute certificate to be efficient. As known to all that an actor can act more than one role in a play， but the concept of the so-called role in the process of permission management is somewhat different， which operates on a many-many basis. The role in the process of permission management can be deemed as a set of operations， including viewing， modifying and deleting etc.， those operations are commonly assigned to roles by the administrator. In other words， an authorization is actually a process of assigning roles to users， and a n user may undertake several roles in reality. Once an user is assigned to one role， then the user will be entitled to do all operations within the limitation of the role. Such a many-many model makes the authorizations more flexible. The role hierarchy model is shown in figure 1.

4 Design of the application system

For these problems aforementioned， I designed a security access control system that includes several modules: PKI， PMI and application support module etc.， it is shown in figure 2.

1) PMI module

The system contains SOA， AA， LDAP， ARA， certificate databases， authenticate identities， permission analysis etc..

SOA: Service-Oriented Architecture， it is the core of management;

AA: the authorized service center of SOA;

LDAP: Lightweight Directory Access Protocol， it is designed to store the attribute certificate and attribute certificate revocation list;

Certificate Database: it is designed to store authentications， CA root certificates， AA public key certificates， certificate revocation lists， AC of roles etc..

2) Application support module

The strategy for an authorized access control is defined by corresponding application systems， and such kind of policies will be stored in LDAP servers in the form of ADC after signed by SOA and AA. The strategy module is at the top of information security and authorization system. Moreover， the strategy module is the principle for authorization， which constitutes information for such authorization as well. Practically， the strategy can be adjusted and modified in accordance with changing requirements.

3) Workflow

First， the administrator shall assign attribute certificates to users， or the users may apply for attribute certificates from ARA. Then， LDAP shall submit public key certificates and AC to certificate database. After receiving applications for accessing， identity authentication will verify the CA root certificates and the certificate revocation list (both from certificates database). Once the authenticity is confirmed， AC will be sent to permission analysis.

Second， permission analysis shall verify the AA public key certificates (from certificate database)， in order to check its authenticity， and analyze the role/roles for certain user.

Finally， permission analysis shall obtain the authorized operation(s) collections of users by checking their roles and their corresponding AC， to control user’ access to data.

5 Conclusion

This thesis designs an attribute certificate based model for access control. Basically， PKI plays the role of identity authentication and PMI plays the role of permission control， basing on a role-oriented access control strategy. Under the circumstances， the expenses for network communication will be reduced. Moreover， the distribution of resources， including human resources， will be mostly optimized. Besides， the operation and management will be less difficult then ever. Flexibility， safety and convenience will promise it a great future. However， improvements should to be done to accommodate an extended use of network access security management.

Reference:

[1] Chadwick D W. An X.509 Role-based Privilege Management Infrastructure[R].U.K.:University of Salford， 2002.

[2] David F， Ravi S， Serban G， et al. Proposed NIST Standard for Role-based Access Control[J]. ACM Transactions on Information and System Security， 2001， 14(3): 224-274.

[3] ITU-T Recommendation X.509. Information Technology Open System Interconnection The Directory: Publick Key and Attribute Certificate Framework. 2000.

[4] Farrell S， Housley R. An Internet Attribute Certificate Profile for Authorization. Rfc3281. 2002.