ANSI INCITS499-2013 Information technology - Next Generation Access Control - Functional Architecture (NGAC-FA)《信息技术.下一代访问控制.功能架构(NGAC-FA)》.pdf

1、American National StandardDeveloped byfor Information Technology Next Generation Access Control Functional Architecture (NGAC-FA)INCITS 499-2013INCITS 499-2013Copyright American National Standards Institute Provided by IHS under license with ANSI Not for ResaleNo reproduction or networking permitted

2、 without license from IHS-,-,-Copyright American National Standards Institute Provided by IHS under license with ANSI Not for ResaleNo reproduction or networking permitted without license from IHS-,-,-INCITS 499-2013American National Standardfor Information Technology Next Generation Access Control

3、Functional Architecture (NGAC-FA)SecretariatInformation Technology Industry CouncilApproved March 19, 2013American National Standards Institute, Inc.AbstractNext Generation Access Control (NGAC) is a fundamental reworking of traditional access control into a form that suits the needs of the modern d

4、istributed interconnected enterprise. NGAC is based on a flexible infrastructure that can provide access control services for a number of different types of resources, and when they are accessed by a number of different types of applications and users. That infrastructure is scalable, able to suppor

5、t policies of different types simultaneously, and remain manageable in the face of changing technology, organizational restructuring, and increasing data volumes. This standard defines the functional architecture that is the basis for all other NGAC standards.Copyright American National Standards In

6、stitute Provided by IHS under license with ANSI Not for ResaleNo reproduction or networking permitted without license from IHS-,-,-Approval of an American National Standard requires review by ANSI that therequirements for due process, consensus, and other criteria for approval havebeen met by the st

7、andards developer.Consensus is established when, in the judgement of the ANSI Board ofStandards Review, substantial agreement has been reached by directly andmaterially affected interests. Substantial agreement means much more thana simple majority, but not necessarily unanimity. Consensus requires

8、that allviews and objections be considered, and that a concerted effort be madetowards their resolution.The use of American National Standards is completely voluntary; theirexistence does not in any respect preclude anyone, whether he has approvedthe standards or not, from manufacturing, marketing,

9、purchasing, or usingproducts, processes, or procedures not conforming to the standards.The American National Standards Institute does not develop standards andwill in no circumstances give an interpretation of any American NationalStandard. Moreover, no person shall have the right or authority to is

10、sue aninterpretation of an American National Standard in the name of the AmericanNational Standards Institute. Requests for interpretations should beaddressed to the secretariat or sponsor whose name appears on the titlepage of this standard.CAUTION NOTICE: This American National Standard may be rev

11、ised orwithdrawn at any time. The procedures of the American National StandardsInstitute require that action be taken periodically to reaffirm, revise, orwithdraw this standard. Purchasers of American National Standards mayreceive current information on all standards by calling or writing the Americ

12、anNational Standards Institute.American National StandardPublished byAmerican National Standards Institute, Inc.25 West 43rd Street, New York, NY 10036Copyright 2013 by Information Technology Industry Council (ITI)All rights reserved.No part of this publication may be reproduced in anyform, in an el

13、ectronic retrieval system or otherwise,without prior written permission of ITI, 1101 K Street NW, Suite 610, Washington, DC 20005. Printed in the United States of AmericaCAUTION: The developers of this standard have requested that holders of patents that may berequired for the implementation of the

14、standard disclose such patents to the publisher. However,neither the developers nor the publisher have undertaken a patent search in order to identifywhich, if any, patents may apply to this standard. As of the date of publication of this standardand following calls for the identification of patents

15、 that may be required for the implementation ofthe standard, no such claims have been made. No further patent search is conducted by the de-veloper or publisher in respect to any standard it processes. No representation is made or impliedthat licenses are not required to avoid infringement in the us

16、e of this standard.Copyright American National Standards Institute Provided by IHS under license with ANSI Not for ResaleNo reproduction or networking permitted without license from IHS-,-,-iTable of ContentsPageForeword - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

17、 - - - - - - - - - - - - - - - - - - - - - - - - - - - viIntroduction - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - x1 Scope - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

18、 - - - - - - - - - - - - - - - - - - - - - - 12 Normative References - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 22.1 Normative references - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

19、 - - - - - 22.2 Approved references - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 22.3 References under development - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 22.4 OASIS references - - - -

20、- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 33 Definitions, symbols, abbreviations, and conventions - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 43.1 Definitions - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

21、 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 43.2 Established Access Control Lexicon - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 63.3 Symbols and acronyms - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

22、 - - - - - - - - 73.4 Keywords - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 73.5 Conventions - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 83.6 Not

23、ation for Procedures and Functions - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 84 Architecture - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 94.1 Introduction to Access Control - - -

24、 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 94.2 Functional Architecture - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -104.3 Operational overview - - - - - - - - - - - - - - - - - - - - - - - - - -

25、- - - - - - - - - - - - - - - - - - - - - - - - - - -114.3.1 Introduction - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -114.3.2 Resource Access - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

26、 - - - - - - - - - - - -114.3.3 Administration Access - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -124.4 Information Flows - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -124.4.1 In

27、troduction - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -124.4.2 Resource Access Information Flow - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -124.4.3 Administration Access Information Flow -

28、 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -144.4.4 Event Information Flow - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -154.5 Implementation Considerations - - - - - - - - - - - - - - - - - - - - - - - - - - - -

29、- - - - - - - - - - - - - - - - - -164.5.1 Introduction - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -164.5.2 Centralized Versus Distributed Approach - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -164.

30、5.3 Transaction Semantics - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -164.6 Use of Established Terminology - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -174.7 Interfaces - - - - - - - - - - - - - -

31、- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -175 Functional Entities - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -185.1 Overview - - - - - - - - - - - - - - - - - - - - - - - - - -

32、 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -185.2 Policy Enforcement Point (PEP) - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -185.3 Unprotected Resource Gate (URG) - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

33、- - - - - - - - - - - -185.4 Policy Decision Point (PDP) - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -185.5 Event Processing Point (EPP) - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -195.6 Policy Admin

34、istration Point (PAP) - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -195.7 Policy Information Point (PIP) - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -195.8 Resource server - - - - - - - - - - - - - - - - - - -

35、 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -196 NGAC Standards Family - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -206.1 Introduction - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

36、- - - - - - - - - - - - - - - - - - - - - - - -206.2 Overview of the NGAC Generic Operations b) descriptions of each entity in the block diagram;c) definitions of information flows between entities;d) overviews of the interfaces between entities; ande) overviews of other standards in the NGAC standa

37、rds family.Users of this standard are encouraged to determine if there are standards in develop-ment or new versions of this standard that may extend or clarify technical informationcontained in this standard.This standard contains four informative annexes, which are not considered part of thestanda

38、rd.Requests for interpretation, suggestions for improvement and addenda, or defect re-ports are welcome. They should be sent to the INCITS Secretariat, Information Tech-nology Industry Council, 1101 K Street NW, Suite 610, Washington, DC 20005.This standard was processed and approved for submittal t

39、o ANSI by the InterNation-al Committee for Information Technology Standards (INCITS). Committee approvalof the standard does not necessarily imply that all committee members voted for itsapproval. At the time of it approved this standard, INCITS had the following members:Philip Wennblom, ChairJennif

40、er Garner, SecretaryOrganization Represented Name of RepresentativeAdobe Systems, Inc. Scott Foshee Steve Zilles (Alt.)AIM Global, Inc. . Steve HallidayChuck Evanhoe (Alt.)Dan Kimball (Alt.)Apple . Helene WorkmanMarc Braner (Alt.)David Singer (Alt.)Distributed Management Task Force John Crandall Jef

41、f Hilland (Alt.)Lawrence Lamers (Alt.)EMC Corporation . Gary RobinsonStephen Diamond (Alt.)Copyright American National Standards Institute Provided by IHS under license with ANSI Not for ResaleNo reproduction or networking permitted without license from IHS-,-,-viiOrganization Represented Name of Re

42、presentativeFarance, Inc. .Frank FaranceTimothy Schoechle (Alt.)Futurewei Technologies, Inc. Yi ZhaoTimothy Jeffries (Alt.)Wilbert Adams (Alt.)GS1GO .Frank SharkeyCharles Biss (Alt.)Hewlett-Packard Company Karen Higginbottom Paul Jeran (Alt.)IBM Corporation .Alexander TarpinianRobert Weir (Alt.)Arna

43、ud Le Hors (Alt.)Steve Holbrook (Alt.)Gerald Lane (Alt.)IEEE Jodie HaaszTerry deCourcelle (Alt.)Bob Labelle (Alt.)Tina Alston (Alt)Intel Philip Wennblom Grace Wei (Alt.)Stephen Balogh (Alt.)Microsoft CorporationJim Hughes Dick Brackney (Alt.)John Calhoon (Alt.)National Institute of Standards approve

44、d international and regional standards (ISO and IEC); andapproved foreign standards (including JIS and DIN).For further information, contact the ANSI Customer Service Department:Phone +1 212-642-4900Fax: +1 212-302-1286Web: http:/www.ansi.orgE-mail: ansionlineansi.orgor the InterNational Committee f

45、or Information Technology Standards (INCITS):Phone: 202-626-5738Web: http:/www.incits.orgE-mail: incitsitic.orgAdditional availability contact information is provided below as needed.2.2 Approved referencesACF: ISO/IEC 10181-3:1996, Open Systems Interconnection - Security frameworks for open systems

46、: Access control framework)RBAC: ANSI INCITS 359-2004, Information technology Role Based Access ControlRBAC-REQ: ANSI INCITS 459-2010, Information technology Requirements for the Implementa-tion and Interoperability of Role Based Access Control2.3 References under developmentAt the time of publicati

47、on, the following referenced American National Standards were still under development. For information on the current status of the document, or regarding availability, contact the relevant standards body or other organization as shown.NGAC-IRPADS: INCITS Project 2193-D, Information technology Next

48、Generation Access Control - Implementation Requirements, Protocols and API Definitions (NGAC-IRPADS)NGAC-GOADS: INCITS Project 2195-D, Information technology Next Generation Access Control - Generic Operations And Data Structures (NGAC-GOADS)Copyright American National Standards Institute Provided b

49、y IHS under license with ANSI Not for ResaleNo reproduction or networking permitted without license from IHS-,-,-INCITS 499-201332.4 OASIS referencesCopies of the following approved OASIS standards may be obtained through the Organization for the Advancement of Structured Information Standards (OASIS) at http:/www.oasis-open.org.XACML: eXtensible Access Control Markup Language (XACML), Version 2.0 Cor