Information Technology Reference
In-Depth Information
17.7 Data Access and Security
Authorization defines whether a given subject is allowed to perform a specific action
on a resource and must be proven before the requested action could be executed.
In CASPAR this was done by the Data Access Manager and Security module
through the definition and evaluation of access control policies. For each resource,
an access control policy can be declared within the security manager, binding users
(aggregated into authorized communities) to permissions (rights to execute oper-
ations). The DAMS acts effectively both as a Policy Enforcement Point and a
Policy Definition Point, as it lets administrator define policies and then assures the
enforcement of these policies.
Authorization must be handled at two different levels: a static one that defines
basic policies for accessing services and content, and a dynamic one that overrides
the static policies if particular conditions are required (e.g. a license is required for
getting the content). Thus this functionality is linked to the DRM module. When an
actor tries to access a service or content the following procedure must be followed:
•
the content or service is checked against the related security policy;
•
a check is made to verify if the user has the right to perform the required operation
according to the static permissions;
•
when content is governed by copyright restrictions, a check is made if the user
has a valid license to access/use the content.
CASPAR access control model is mainly based on the Rule Role-based access con-
trol (RBAC) approach. RBAC provides user authorization and access control in an
elegant way. This model is however modified and extended to encompass allowing
the ability to personalize the concept of role and to preserve and re-use the sys-
tem in the future. In this sense the concept of role, which is the key point of this
model, has been modified into that of Authorized Community. In this interpretation
an Authorized Community is just an aggregation of any kind of users and does not
need to refer to the already registered system users. It can be defined extensionally,
namely by listing explicitly the members (e.g. a list of full names) or intentionally,
by specifying the membership criteria (e.g. to be a member of an association, rela-
tives of a certain person, citizens of a precise country that have reached a certain age,
etc.). Membership evaluation might be complex and require human intervention.
The introduction of this novel concept of Authorised Community allows us to
face the main challenge in the preservation of users and access policies: authorisa-
tion policies which are defined today must apply to the possible users of tomorrow.
CASPAR DAMS implementation addresses this challenge by introducing proper
mechanisms to define Authorised Communities, policies and authorisation verifi-
cation processes. In the definition of an access policy it is possible to associate
permissions to Authorized Communities. A user can access services and resources
according to the permissions granted in the policies to the Authorized Community
(s)he belongs to.
