ICN 2015 : The Fourteenth International Conference on Networks ACROSS-FI: Attribute-Based Access Control with Distributed Policies for Future Internet Testbeds Edelberto Franco Silva Natalia Fernandes Castro Debora´ C. Muchaluat Saade Institute of Computing Dept. of Telecommunications Engineering Institute of Computing Fluminense Federal University (UFF) Fluminense Federal University (UFF) Fluminense Federal University (UFF) M´ıdiaCom Laboratory M´ıdiaCom Laboratory M´ıdiaCom Laboratory Niteroi,´ RJ, Brazil Niteroi,´ RJ, Brazil Niteroi,´ RJ, Brazil Email: [email protected] Email: [email protected] Email: [email protected] Abstract—Interests in access control authorization methods tities of the CAFe academic federation [4]. Hence, there is no for distributed resources have been growing as more shared need to duplicate user information in local databases. resources environments and resource federations have been made available, both in academy and in industry. Different propos- The Federated Identity Management (FIM) is the basis als aiming at creating a granular and scalable access control of this work, when users from many institutions can access in those distributed environments have been presented in the services provided by other partner institutions. A federated and literature. The standardization of access control models based distributed identity service depends on the ability of any ser- on roles and attributes are examples of that effort. However, vice provider to trust the credentials provided to them by other none of the existing proposals or standards present a complete entities. In this scenario, IdM appears as a strong requirement authentication and authorization framework that can be adapted for different distributed environments. This work presents an for establishing the trust environment among participants, as authentication and authorization framework based on policies to share tools or resources among each other. and attribute aggregation for controlling access into Future Important examples of such environments are the initia- Internet (FI) distributed testbeds. A generic solution for attribute- based access control in Future Internet testbeds federation is tives for experimental facilities for the Future Internet (FI) implemented and evaluated, providing a generic interface to allow research [5][6]. New network architectural proposals depend communication between the FI resource federation and our access on exhaustive tests before they are implemented in the real control proposal. Based on user and resource’s attributes, policies world. Thus, various experimental facilities, or testbeds, were are dynamically applied to control which resources a user may developed [7][8]. Researchers, however, realized that intercon- require. This work has been validated in an experimental identity necting those testbeds is a requirement in order to carry out real management laboratory (GIdLab) enabling the use of identity experiments in geographically dispersed scenarios. This brings management services offered in an academic identity federation up many management challenges, because communication and and in an experimental environment for the Future Internet. access control agreements are necessary. The need to specify Keywords—future internet; authorization; authentication; an IdM architecture in this context draws attention. attribute-based access control. There are some proposals for federating FI testbeds. Among them, we highlight the Slice-Based Federation Archi- I. INTRODUCTION tecture (SFA) [9], which is currently in use in testbeds such as OneLab, FIBRE Project (Future Internet testbeds experi- Identity Management (IdM) is the set of processes and mentation between BRazil and Europe) [10], and PlanetLab. technologies used for guaranteeing the identity of an entity. In SFA-based FI testbeds, users supply their credentials to get IdM ensures the quality of identity information such as identi- access authorization to a set of resources located in different fiers, credentials, and attributes and uses it for authentication, institutions, such as a set of computers and a minimal specified authorization, and accounting processes [1]. bandwidth. Although SFA is the most important initiative to Authentication procedures focus on confirming the identity create a federation of FI testbeds, it presents open issues related of an entity, that is, checking that an entity is who it claims to A&A. Briefly, this occurs because its proposal is focused to be. Authorization mechanisms define the access rights to on interconnecting resources through a resource federation. resources associated to an identity. Authorization procedures The A&A ends up in background, composed only of a simple describe these access rights to ensure that they are obeyed. Fi- authentication mechanism based on X.509 certificates and nally, accounting refers to track network resource consumption static profiles. by users for capacity planning and billing. To illustrate our proposal a component architecture is In recent years, the use of academic authentication and shown in Figure 1. On top the identity federation is responsible authorization (A&A) federations to control access to resources for authenticating users. In the middle all components of a became popular [2][3]. In Brazil, for instance, academic re- federated resource environment are depicted, with an attribute searchers access scientific publication repositories using iden- provider, an access control component, a credential translation Copyright (c) IARIA, 2015. ISBN: 978-1-61208-398-8 198 ICN 2015 : The Fourteenth International Conference on Networks component (necessary to translate the credential from the presents current results. In Section VI, conclusions and future identity federation to the testbed federation, which is presented works are described. in [11]), a service provider and the resource federation (i.e., FI testbeds or islands). II. RELATED WORK There are many initiatives to federate testbeds, such as GENI (Global Environment for Network Innovations), OneLab and FED4FIRE [5]–[8][16]. A recent initiative for creation of testbeds in Brazil and Europe is the FIBRE Project [10]. FIBRE proposes the con- struction of a network for large-scale experimentation, which includes wired and wireless environments, through the inter- connection of small testbeds, called islands, in various parts of Brazil and Europe. Thus, FIBRE is strongly grounded in building a federated environment. Although these proposals are strongly based on the resource federation, using tools such as SFA, they present open issues related to identity management. These projects integrate testbeds using different control and management frameworks, each of them using a different user database and different authentication and access control methods. Tools such as SFA do not provide a proper A&A federation architecture to integrate such different environments. Related work, in general, proposes the introduction of a standardized model (such as RBAC [17], ABAC [15]) for Figure 1. Proposed component architecture for authentication and resource distributed environments such as grid computing, and authorization. more recently, cloud computing. The area where there is more related work is undoubtedly grid computating. We can cite works as [18][19], on which role-based access control models In this work, we propose a new authorization method (RBAC) are applied. More recent works in cloud computing for SFA-based testbeds. Our proposal integrates A&A feder- use ABAC for access control, such as [20]. However, we ations based on Shibboleth [12] and a authorization frame- must emphasize the need to know how access control in these work based on Extensible Access Control Markup Language environments has been employed, but each distributed resource (XACML) [13]. Shibboleth implements the Security Assertion environment has its particularities. Markup Language (SAML) standard [14] and also supports Attribute-Based Access Control (ABAC), which has become a In this paper, we present the first proposal for policy standard in 2014 [15]. Using ABAC, it is possible to implement and Attribute-Based Access Control in FI testbeds, different more granular and dynamic access policies. Moreover, Shib- of GENI ABAC proposal (the other – and only – similar boleth is used by the Brazilian academic federation, named proposal), when attributes are used to restrict and delegate CAFe, and also by eduGAIN. Our proposal allows the user to access [21], introducing a new way to represent the resources, allocate resources in testbed federations based on attributes attributes and policies in this enviroment. arising from an identity federation. We propose a generic III. BACKGROUND framework for ABAC using an aggregate attribute mechanism that associates points for user attributes and resource attributes. This section presents an introduction of technologies and Our goal is to use the access control proposal in the FIBRE concepts needed to understand the solution proposed by this testbed, which is an initiative of federated testbeds between work. Brazil and Europe, using CAFe and eduGAIN for authentica- tion. A. SAML and Shibboleth We implemented the proposed A&A architecture using a The Security Assertion Markup Language (SAML) stan- real experimentation laboratory called GIdLab. GIdLab pro- dard [14] presents a set of specifications to define an infras- vides a mirror of the CAFe federation, which serves as an tructure for dynamic exchange of security