Re: [Ace] Context-based Authorization

[Ludwig Seitz <[e-mail]>]

On 07/15/2014 05:19 AM, Likepeng wrote:
> Hi all,
>
> Personally I am wondering whether or not we should support context-based
> authorization indicated in
> http://tools.ietf.org/html/draft-seitz-ace-usecases-01.
>
> For U2.4, do we want to achieve something like this: if time is 9:00 ~
> 18:00, Client A is allowed to turn on a light, but Client B is not allowed?

Yes that's one example.

>
> To me, this is purely Resource Server side policy setting and
> enforcement. Does it require any information exchange with Authorization
> Server? Is it necessary?

We are moving away from requirements here and getting into solutions, 
but for the sake of clarification: I don't think this kind of policy 
should be on the RS, it should be maintained and managed by the AS, for 
the same reasons we want all the other authorization policies to be on 
the AS. The solution I have in mind are conditional authorization 
decisions in the style: "You are permitted to turn on the light, 
provided it is between 9:00 and 18:00".


> About presence, does it mean online / offline status? If yes, this
> should be covered by another requirement U5.2, which was discussed in
> another discussion thread “offline operation”.
>

No I meant physical presence, like "you get to control the HVAC if you 
are in the room, but from elsewhere"

>
> For U3.1, how to define an emergency context?

In medical access control scenarios there is the concept of 
"break-the-glass policies". This means that medical personnel can just 
declare an emergency context (similar to breaking the glass to access a 
fire alarm, see attached image) in order to get additional 
authorization. This declaration is then subject to auditing at a later 
point, to ensure that there really was an emergency situation.



/Ludwig

-- 
Ludwig Seitz, PhD
SICS Swedish ICT AB
Ideon Science Park
Building Beta 2
Scheelevägen 17
SE-223 70 Lund

Phone [phone]
http://www.sics.se