A User-oriented Multi-service Access Control System

1 Keywords: Access Control, Digital Certificates, Security, Smart Cards Abstract Web-based services have become a major commodity. As an increasing number of ISPs make available an even more increasing number of remote services, security becomes a major concern in order to accomplish a fair exchange of commodities in insecure environments. An exchange of services, in order to be fair and secure, usually involves the service provider, the service requestor and a trusted third party on whose impartiality both rely. In order to provide and receive secure web-based services, trust can be accomplished by means of thorough identification and strong authentication of all the participants. The use of electronic credentials is one way of formal identification and authentication and the adoption of a unique worldwide-accepted digital credential stored in a smart card will provide a higher level of security while allowing total mobility with secure transactions over the web. While this adoption does not take place, the widespread use of digital credentials will inevitably lead to each service requestor having to be in possession of many smart cards just for storing the different electronic credentials needed for all the services he uses. We present a new approach for the use of smart cards as a basis for secure management of web-based services leading to the use of only one smart card per user in a perfectly transparent manner, thus contributing for a more generalized use of the technology.

I. Introduction The enormous amount of services available through remote access is not yet used to its full extent mainly because issues such as fairness, overall security and trust are perceived by the potential users as not being completely solved.

Any exchange of services is considered to be fair if the risk of any party suffering a disadvantage is absent or reduced to a minimum [1]. In order to achieve that degree of fairness, two major requisites have to be fulfilled: overall security and trust.

Overall security is an issue that is defined differently depending on the perspective of who is evaluating it. In the context of this paper, we shall assume that the security issue is solved to everyone’s content if there is little or no risk of the information exchanged by all parties involved in the service being misused by any other party. The

A User-oriented Multi-service Access Control System

J. Cândido B. Santos1, José Luís Oliveira2, Carlos Costa3

1Instituto Superior de Engenharia de Coimbra, DEE, Coimbra (jcandido@isec.pt)2Universidade de Aveiro, DET, 3810 Aveiro (jlo@det.ua.pt) 3Universidade de Aveiro, IEETA, 3810 Aveiro (ccosta@ieeta.pt) 2

best way to ensure this is by effectively denying any eavesdropping on the communications, since the information exchanged can be of a private nature.

In insecure environments such as the internet where all the participants in an exchange of services frequently do not know each other in advance [2], trust is established by means of thorough identification and strong authentication of all the parties involved which, inevitably, leads to the presentation of electronic credentials of some sort to each other in order to ensure each participant that the other is who, in fact, he claims to be and that the transaction will be carried out in a proper manner. In order to achieve this, the service provider must identify and authenticate the client who is requesting access to the services in order to apply the access control policies pre-established by the organization.

In most cases, the ISP does not authenticate itself to the client but the process can be perfectly symmetrical.

Digital certificates are an excellent tool for performing such identification and authentication in the computer world while being also a good mean of exchanging other kinds of information such as cryptographic keys that can be used to establish a secure channel of communication.

Technologies such as cryptography, that are thoroughly tested and easily deployed without the need to deeply understand their mathematical or technological basis, allow the establishment of secure communications, namely public key cryptography (PKC) [3].

A digital certificate, which also relies heavily on PKC, establishes a trust relationship between its designated subject (the user) and the holder of a secret cryptographic key by means of the issuing organization, a reliable certification authority (CA). A higher level of security can be granted to the whole certification system through the use of smart cards as possession tokens that have the means for storage of the user’s secret key and the digital certificate, providing unrestricted user mobility.