Access Control Package

Abstract

Contents

• Introduction
  
• Overview of the Access Control Service
  
• Authentication of Subjects
  
• Authorization of Subjects
  
• Capabilities
  
• Roles
  
• Using the Access Control Service
  

Overview of the Access Control Service

Business Applications <-> Business Applications

Business Applications -> Modules

Module <-> Module.

Applications are implemented by JAVA classes. Only classes that implement the ControlledApplication interface can register with the access control service as Business Applications. Exactly one controlling class in each Business Application distribution has to register as a controlled Application.

The ControlledApplication interface allows the access control service to retrieve the application profile through the properties associated with the Controlled Application in a distribution, and to transfer the constructed access control handle to the Controlled Application in a secure manner (using storeAccessControlHandle() ).

To register an application, the controlling class is passed to registerSignedApplication() . The registration process will read the properties for the class, created during installation, from the Archieve and return the application customized with its properties as an instance of the class ControlledApplication. Calling its main() method will start the application.

Modules

All JAVA classes wishing to act as Module must be a subsclass of the ControlledModule to be able to register with the access control service as a module. Exactly one controlling class in each module distribution has to register. The ControlledModule class allows the access control service to retrieve the application profile through the properties associated with the Controlled Module in a distribution, and to transfer the constructed access control handle to the Controlled Module in a secure manner using storeAccessControlHandle() .

To register a module, the controlling class is passed to registerSignedModule() . An instance of the class ControlledModule. is created. This instance of the module will actually never run, but will deliver an access control handle to later loads of the module.

When the module is called (as an object with respect to access control terms) it will have the subjects access control handle passed and it will be able to get its own handle calling getAccessControlHandle() .

Authorization of Subjects

All capability types are subclasses of the abstract class Capability

Currently the access control service provides four types of capabilities, that differ in the way they get enabled:

• EnabledCapability : these are always enabled.
• DisabledCapability : these are always disabled.
• TimeOutCapability : these are only enabled for a limited amount of time, a time-out. After that time, the capability becomes disabled. To enable it again, a simple confirmation suffices to enable it for the duration of the time-out.
• PassWordCapability : these are only valid for one use. To enable them again the user has to enter a password.

To guard access to data, the capability necessary to retrieve it can be stored together with the data. When the data is later retrieved, validity of that capability can be checked as described above .

Standard SEMPER Capabilities

• AccessMan.CoreCapability : the default for uncertified applications. Type: User Role.

All role types are subclasses of the abstract class Role

The current access control service provides three types of roles, that differ in the way they get enabled:

• UserRole : are only enabled for one time use. For each use the role becomes disabled. To enable it again, a simple confirmation suffices to enable it again
• SignatureRole : are enabled as longs as the signature used to sign the distribution or the controlling class is valid.
• EnabledRole : are always enabled

Standard SEMPER Roles

• AccessMan.NoTrustRole : the default for uncertified applications. Type: User Role.
• AccessMan.CoreRole : the default role for core modules. Type: Enabled Role. Contains always the Core capability created in the access control service and no other capabilities.

The current role can be retrieved calling ach.popCurrentRole(role) and a new current role created using ach.pushCurrentRole(role)

A new empty access control handle is created with new AccessControlHandle(master_ach). The new handle is populated with ach.addRole(Role). If only the name of the role is known, the role object can be retrived with ach.getRole(role_name). or ach.getRoleNames(). This requires an ach with the role object as member is available.

For emergency stop the operations ach.freeze(), ach.wakeup() and ach.isFrozen() are available.

Business Application

     ControlledApplication ca = 
	AccessMan.registerSignedApplication
        	("name_of_controlling_class_for_business_application");
      
      ca.main() ; // call the business application

Application registration would normally happen from applications menu, but the registration can be made from anywhere at any time.
 

Modules

Register a Module like:

      AccessMan.registerSignedModule
	("name_of_controlling_class_for_business_applicatio") ; 

Module registration would normally happen from Library.init or the Installation module but the registration can be made from anywhere at any time.

Objects create the capabilities they need, and insert them in the appropriate roles, as in the following example.

  pwc = new PassWordCapability
        ("my_capa", "Testing", "test" ) ;
  pwc.addToRole(subject_ach.getLoginRole()) ;

Then, the object can protect its actions by guarding them with an if-statement whose guard checks whether the corresponding capability is valid. For this check the service calls hasRight() on the access control handle of the subject, with the capability needed to perform the action as parameter.

  if (subject_ach.hasRight("my_capa"))
    perform action ;
  else 
    reject action ;

It should be noted that the capability object is needed to add a capability to a role, while only its name is needed to check it in an access control handle.

Object have normally two handles: Its own and the handle passed from the subject. It is not mandatory for the object to have a handle if it's not accessing protected resources besides its own resources. Object can run as static or instantiated classes. The example below show parts of the code where a business application call an instantiated module class.

The business application

public class LoadedApplication implements ControlledApplication {

  private static AccessControlHandle __my_ach =  null ;
  private static boolean __called_before =  false ;
  
  // other interface methods

  public void storeAccessControlHandle(AccessControlHandle ach)  
  {
    // called when business application registers, check that
    // it is only called once.
    if (!__called_before) {
      __called_before = true;
      __my_ach = ach ;
    }
  }

  public void main()
  { 
    // LoadedModule is instantiated and called
    LoadedModule m1 =  new LoadedModule(__my_ach) ;
    // do something in m1, that requires a right in the handle
    m1.action1() ;
  }
}

The module. One method where it act as object for access control, and a second method where it acts as subject for access control. The business application can choose to limit the rights in the access control handle before passing it to the module (m1.action1()).

public class LoadedModule extends ControlledModule {

  // my own handle
  private AccessControlHandle _my_handle = null;  
  // subjects handle
  private AccessControlHandle _handle = null;  
 
  // Constructor, called from the application creating
  // the new module instance

  public LoadedModule(AccessControlHandle subject_handle) {
    this._handle = subject_handle ;
  }

  public void action1() {

   // I act as object.
   if (this._handle.hasRight("my_capa"))
    perform action ;
  else 
    reject action ;

  }
 
 public void action2() {

  // I act as subject
  this._my_handle = getAccessControlHandle();

  // ms.actionx is a method in a static module class

  // I act as my self 
  ms.actionx(this._my_handle) ;


  // or I act as the subject from action1 
  ms.actionx(this._handle) ;
 }
}

The short examples above gives hopefully a feeling of the possibilities in the ACM. Full blown examples will be available in the Test directory.