Access Control for an Organization Connected by Insecure Public Networks

摘要

An organization may divide its subjects and objects into different groups. Each group has different security clearance or level. In order to prevent sensitive information accessed by irrelevant users, an access control policy is defined to specify the eligible information flows among groups. If the organization is within a secure private network, either access control lists attached on objects or capability lists attached on subjects are enough to regulate information flows. However, for an organization with different sites connected by insecure public networks, a trusted third party may be necessary to act as an authorization/authentication server. The functionality of this server is to provide authorization and authentication services, and possibly to distribute a session key to protect data during transmission. Kerberos is a typical system that provides these services in a network using a trusted third party. In Kerberos, every communication session between two parties needs to get an access ticket from the server first. This is not efficient in the sense that a two-way communication needs a three-way communication effort. This paper proposes a key assignment scheme to enforce access control policies of an organization connected by insecure public networks without the involvement of any trusted third party. As a result, the efficiency could be enhanced tremendously.