1、American National StandardDeveloped byfor Information Technology Next Generation Access Control Functional Architecture (NGAC-FA)INCITS 499-2013INCITS 499-2013INCITS 499-2013American National Standardfor Information Technology Next Generation Access Control Functional Architecture (NGAC-FA)Secretari
2、atInformation Technology Industry CouncilApproved March 19, 2013American National Standards Institute, Inc.AbstractNext Generation Access Control (NGAC) is a fundamental reworking of traditional access control into a form that suits the needs of the modern distributed interconnected enterprise. NGAC
3、 is based on a flexible infrastructure that can provide access control services for a number of different types of resources, and when they are accessed by a number of different types of applications and users. That infrastructure is scalable, able to support policies of different types simultaneous
4、ly, and remain manageable in the face of changing technology, organizational restructuring, and increasing data volumes. This standard defines the functional architecture that is the basis for all other NGAC standards.Approval of an American National Standard requires review by ANSI that therequirem
5、ents for due process, consensus, and other criteria for approval havebeen met by the standards developer.Consensus is established when, in the judgement of the ANSI Board ofStandards Review, substantial agreement has been reached by directly andmaterially affected interests. Substantial agreement me
6、ans much more thana simple majority, but not necessarily unanimity. Consensus requires that allviews and objections be considered, and that a concerted effort be madetowards their resolution.The use of American National Standards is completely voluntary; theirexistence does not in any respect preclu
7、de anyone, whether he has approvedthe standards or not, from manufacturing, marketing, purchasing, or usingproducts, processes, or procedures not conforming to the standards.The American National Standards Institute does not develop standards andwill in no circumstances give an interpretation of any
8、 American NationalStandard. Moreover, no person shall have the right or authority to issue aninterpretation of an American National Standard in the name of the AmericanNational Standards Institute. Requests for interpretations should beaddressed to the secretariat or sponsor whose name appears on th
9、e titlepage of this standard.CAUTION NOTICE: This American National Standard may be revised orwithdrawn at any time. The procedures of the American National StandardsInstitute require that action be taken periodically to reaffirm, revise, orwithdraw this standard. Purchasers of American National Sta
10、ndards mayreceive current information on all standards by calling or writing the AmericanNational Standards Institute.American National StandardPublished byAmerican National Standards Institute, Inc.25 West 43rd Street, New York, NY 10036Copyright 2013 by Information Technology Industry Council (ITI
11、)All rights reserved.No part of this publication may be reproduced in anyform, in an electronic retrieval system or otherwise,without prior written permission of ITI, 1101 K Street NW, Suite 610, Washington, DC 20005. Printed in the United States of AmericaCAUTION: The developers of this standard ha
12、ve requested that holders of patents that may berequired for the implementation of the standard disclose such patents to the publisher. However,neither the developers nor the publisher have undertaken a patent search in order to identifywhich, if any, patents may apply to this standard. As of the da
13、te of publication of this standardand following calls for the identification of patents that may be required for the implementation ofthe standard, no such claims have been made. No further patent search is conducted by the de-veloper or publisher in respect to any standard it processes. No represen
14、tation is made or impliedthat licenses are not required to avoid infringement in the use of this standard.iTable of ContentsPageForeword - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - viIntroduction - - - - - - -
15、- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - x1 Scope - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 12 Normative References - - - - - - - -
16、 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 22.1 Normative references - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 22.2 Approved references - - - - - - - - - - - - - - - - - - - - - - - -
17、- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 22.3 References under development - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 22.4 OASIS references - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
18、- - - - - - - - - - 33 Definitions, symbols, abbreviations, and conventions - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 43.1 Definitions - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 43.2 Established Access
19、 Control Lexicon - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 63.3 Symbols and acronyms - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 73.4 Keywords - - - - - - - - - - - - - - - - - - - - - - - - - - -
20、 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 73.5 Conventions - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 83.6 Notation for Procedures and Functions - - - - - - - - - - - - - - - - - - - - - - - - -
21、 - - - - - - - - - - - - - - - - 84 Architecture - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 94.1 Introduction to Access Control - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
22、 - - 94.2 Functional Architecture - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -104.3 Operational overview - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -114.3.1 Introduction - - - - -
23、- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -114.3.2 Resource Access - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -114.3.3 Administration Access - - - - - - - - - - - - - - -
24、- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -124.4 Information Flows - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -124.4.1 Introduction - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
25、 - - - - - - - - - - - - - - - - - - - - - -124.4.2 Resource Access Information Flow - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -124.4.3 Administration Access Information Flow - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -144.4.4
26、Event Information Flow - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -154.5 Implementation Considerations - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -164.5.1 Introduction - - - - - - - - - - - - - -
27、- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -164.5.2 Centralized Versus Distributed Approach - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -164.5.3 Transaction Semantics - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
28、- - - - - - - - - - - - - - - - - - - - - -164.6 Use of Established Terminology - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -174.7 Interfaces - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
29、- - - - - -175 Functional Entities - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -185.1 Overview - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -185.2 Policy
30、 Enforcement Point (PEP) - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -185.3 Unprotected Resource Gate (URG) - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -185.4 Policy Decision Point (PDP) - - - - - - - - - - - - - -
31、 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -185.5 Event Processing Point (EPP) - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -195.6 Policy Administration Point (PAP) - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
32、- - - - - - - - - - - - - -195.7 Policy Information Point (PIP) - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -195.8 Resource server - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -196 NGAC
33、 Standards Family - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -206.1 Introduction - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -206.2 Overview of the NGAC Generic Op
34、erations b) descriptions of each entity in the block diagram;c) definitions of information flows between entities;d) overviews of the interfaces between entities; ande) overviews of other standards in the NGAC standards family.Users of this standard are encouraged to determine if there are standards
35、 in develop-ment or new versions of this standard that may extend or clarify technical informationcontained in this standard.This standard contains four informative annexes, which are not considered part of thestandard.Requests for interpretation, suggestions for improvement and addenda, or defect r
36、e-ports are welcome. They should be sent to the INCITS Secretariat, Information Tech-nology Industry Council, 1101 K Street NW, Suite 610, Washington, DC 20005.This standard was processed and approved for submittal to ANSI by the InterNation-al Committee for Information Technology Standards (INCITS)
37、. Committee approvalof the standard does not necessarily imply that all committee members voted for itsapproval. At the time of it approved this standard, INCITS had the following members:Philip Wennblom, ChairJennifer Garner, SecretaryOrganization Represented Name of RepresentativeAdobe Systems, In
38、c. Scott Foshee Steve Zilles (Alt.)AIM Global, Inc. . Steve HallidayChuck Evanhoe (Alt.)Dan Kimball (Alt.)Apple . Helene WorkmanMarc Braner (Alt.)David Singer (Alt.)Distributed Management Task Force John Crandall Jeff Hilland (Alt.)Lawrence Lamers (Alt.)EMC Corporation . Gary RobinsonStephen Diamond
39、 (Alt.)viiOrganization Represented Name of RepresentativeFarance, Inc. .Frank FaranceTimothy Schoechle (Alt.)Futurewei Technologies, Inc. Yi ZhaoTimothy Jeffries (Alt.)Wilbert Adams (Alt.)GS1GO .Frank SharkeyCharles Biss (Alt.)Hewlett-Packard Company Karen Higginbottom Paul Jeran (Alt.)IBM Corporati
40、on .Alexander TarpinianRobert Weir (Alt.)Arnaud Le Hors (Alt.)Steve Holbrook (Alt.)Gerald Lane (Alt.)IEEE Jodie HaaszTerry deCourcelle (Alt.)Bob Labelle (Alt.)Tina Alston (Alt)Intel Philip Wennblom Grace Wei (Alt.)Stephen Balogh (Alt.)Microsoft CorporationJim Hughes Dick Brackney (Alt.)John Calhoon
41、(Alt.)National Institute of Standards approved international and regional standards (ISO and IEC); andapproved foreign standards (including JIS and DIN).For further information, contact the ANSI Customer Service Department:Phone +1 212-642-4900Fax: +1 212-302-1286Web: http:/www.ansi.orgE-mail: ansio
42、nlineansi.orgor the InterNational Committee for Information Technology Standards (INCITS):Phone: 202-626-5738Web: http:/www.incits.orgE-mail: incitsitic.orgAdditional availability contact information is provided below as needed.2.2 Approved referencesACF: ISO/IEC 10181-3:1996, Open Systems Interconn
43、ection - Security frameworks for open systems: Access control framework)RBAC: ANSI INCITS 359-2004, Information technology Role Based Access ControlRBAC-REQ: ANSI INCITS 459-2010, Information technology Requirements for the Implementa-tion and Interoperability of Role Based Access Control2.3 Referen
44、ces under developmentAt the time of publication, the following referenced American National Standards were still under development. For information on the current status of the document, or regarding availability, contact the relevant standards body or other organization as shown.NGAC-IRPADS: INCITS
45、 Project 2193-D, Information technology Next Generation Access Control - Implementation Requirements, Protocols and API Definitions (NGAC-IRPADS)NGAC-GOADS: INCITS Project 2195-D, Information technology Next Generation Access Control - Generic Operations And Data Structures (NGAC-GOADS)INCITS 499-20
46、1332.4 OASIS referencesCopies of the following approved OASIS standards may be obtained through the Organization for the Advancement of Structured Information Standards (OASIS) at http:/www.oasis-open.org.XACML: eXtensible Access Control Markup Language (XACML), Version 2.0 Core spec, Feb-ruary 1, 2
47、005XACML-RBAC: UCore and hierarchical role based access control (RBAC) profile of XACML v2.0, February 1, 2005.INCITS 499-201343 Definitions, symbols, abbreviations, and conventions3.1 Definitions3.1.1 access control entry of an object: A type of derived relation (see 3.1.12) that defines a user and
48、an operation that he can perform on that object in the absence of any relevant prohibition (see 3.1.35). See6.2.2.4.3.4.3.1.2 access request: The information received from a process (see 3.1.34) on behalf of a user (see3.2.7) containing the name (see 3.1.24) of an object (see 3.2.3) and an operation
49、 (see 3.2.4) to beperformed on the resource referenced by the named object.3.1.3 ascendant of an item: Another item that is a member (see 3.1.22) of that item as a result of a chainof assignments (see 3.1.9).3.1.4 assignment: A type of configured relation (see 3.1.10) that establishes membership within acontainer. See 6.2.2.4.2.3.1.5 association: A type of configured relation (see 3.1.10) that establishes one or more privileges (see6.2.2.4.3.2). See 6.2.2.4.33.1.6 attribute: A type of container (see 3.1.8), that may be either a user attribute (see 3.1.44) or anobject attr
