Applying the NGAC approach to FAR-EDGE
To meet the need in FAR-EDGE for a flexible, portable, powerful, scalable, and dynamic protection scheme that can operate coherently over a diverse and distributed platform we apply an emerging standard known as Next Generation Access Control (NGAC).
NGAC is a flexible and expressive approach to specifying and enforcing a wide variety of policies over distributed systems. NGAC enables diverse access control policies to be simultaneously defined and enforced independently or in combinations. In NGAC the policy is completely separate from the enforcement mechanism. A reference implementation known as the Policy Machine (PM) is publicly available.
Manufacturing IIoT systems present formidable challenges for security and safety, which are both still universally recognized as difficult, if not unsolved, problems. NGAC has not to our knowledge been applied previously in industrial manufacturing or any Industrial Internet of Things (IIoT) environment.
The application of NGAC to IIoT in general and FAR-EDGE in particular involves adaptation and extension of the NGAC reference implementation “PM”. The functional architecture of NGAC is shown in the Figure
NGAC functional architecture
The NGAC functional architecture consists of:
- Multiple Policy Enforcement Points (PEP)
- Multiple Resource Access Points (RAP)
- At least one Policy Decision Point (PDP)
- One Policy Access Point (PAP)
- One Policy Information Point (PIP)
- An optional Event Processing Point (EPP)
The reference implementation (Policy Machine, “PM”) of the NGAC standard consists primarily of the components: the PM server, the PM admin tool, the Kernel Simulator, and the Session Manager. These components are implemented in Java and communicate over SSL sockets.
The main components of the PM are shown in the following figure
NGAC reference implementation (PM)
Extension of NGAC to an IIoT environment is shown below
NGAC provides the ability to represent and enforce arbitrary fine-grained attributed-based access control (ABAC) policies within a common framework. The approach is sufficiently expressive to be able to represent other well-known access control schemes, such as discretionary access control (DAC), mandatory access control (MAC), and role-based access control (RBAC). New types of objects or resources may easily be added to the language, and corresponding access methods may be integrated into the enforcement mechanisms by extending the reference implementation.