SNIP_ADAPTIVE_CAN_FIGURE_Figure_3_93

Figure 3.93: Access policy enforcement based on the Subject ID from the network binding The access control process aims at enforcing policies on the relation between a “Subject” and an “Object”. In the example where an remote Machine makes calls to a service interface, the remote Machine is the Subject and the method of a ServiceInterface is the Object. The access control process comprises of the two main operations, namely , Authentication and Authorization, which are mostly independent. During the authentication process the identity of the subject is verified and an authentic identifier is resolved. Authentication is an essential part of the chain to ensure that different subjects cannot impersonate each other. In the next step, during Authorization, the identity of the Subject is checked upon the rules and policies defined for the accessing the Object to verify if the Subject’s request is legitimate. These policies shall be defined by the system or the resource owner. The authentication of the remote subject is based on the network binding. When a secure channel is established, the remote peer has already gone through an authentication protocol. Therefore, the identity information can be forwarded to the IAM to apply the corresponding defined policies that are defined for the requests coming from that channel as depicted in Figure 3.93. The remote subject is modeled as a specialization of AbstractIamRemoteSubject. The different specializations will be presented in the following sections. Class AbstractIamRemoteSubject (abstract) Package M2::AUTOSART emplates::AdaptivePlatform::SCREIAM Note This abstract meta-class defines the proxy information about the remote node. Tags: atp.Status=candidate Base ARElement, ARObject, CollectableElement, Identifiable, MultilanguageReferrable, Packageable Element, Referrable, UploadableDeploymentElement, UploadablePackageElement Subclasses IPSecIamRemoteSubject, IpIamRemoteSubject, TlsIamRemoteSubject Aggregated by ARPackage.element Attribute Type Mult. Kind Note – – – – – Table 3.200: AbstractIamRemoteSubject