Cyber-Identity and Authorization in an Uncertain World

1
Cyber-Identity and Authorizationin an Uncertain
World

• Ravi Sandhu
• Laboratory for Information Security Technology
  www.list.gmu.edu
• Department of Information and Software
  Engineering
• School of Information Technology and Engineering
• George Mason University
• sandhu_at_gmu.edu
• 703-993-1659

2
What is Cyber-Security?

• Fighting fires
• Keeping the bad guys out
• Firewalls, Intrusion Detection, Virus scans, Spam
  filters, Content filters
• Increasing productivity
• Letting the good guys in
• Cyber-Identity and Authorization

STOP
GO
3
What is Cyber-Security?
EASY
SECURE
PRACTICAL
4
An Uncertain World

• Uncertain threat
• We are always fighting the last war
• Technological change
• Pervasive (ubiquitous) computing
• Peer-to-peer, grid and utility computing
• Intels LaGrande and Microsofts Longhorn
• The next Intel, Microsoft, Cisco, .
• Business change
• Outsourcing and globalization

5
Cyber-Identity Megatrends

• Federated identity
• Identity relying party is NOT the identity
  provider
• Who will be the DMV in cyberspace?
• Grades of identity
• Identity vetting, authentication strength,
  purpose, privacy
• A single infrastructure to drive all grades

6
Cyber-Identity Mega-Challenges

• Pervasive (ubiquitous) computing
• How can a user get effective control of identity
  in a pervasive environment
• Ad-hoc peer-to-peer computing
• First responders in an emergency
• Trustworthy computing
• Will Intels LaGrande technology or Microsofts
  Longhorn help us save the day

7
RBAC96 Model
8
Usage Control (UCON) Coverage

• Protection Objectives
• Sensitive information protection
• IPR protection
• Privacy protection
• Protection Architectures
• Server-side reference monitor
• Client-side reference monitor
• SRM CRM

9
UCON_ABC Models

• Continuity
• Decision can be made during usage for continuous
  enforcement
• Mutability
• Attributes can be updated as side-effects of
  subjects actions

10
Conclusion

• Managing cyber-identity and authorization in an
  uncertain world is one of our nations foremost
  cyber-security problems
• RBAC and UCON will be essential underpinnings of
  the solutions
• GMU is a world leader in this sector