Usable access control enabled by Sensing Enterprise architectures

Transcription

1 Usable access control enabled by Sensing Enterprise architectures IWEI 2015 Nimes, France, May 27-29th Mikel Uriarte Itzazelaia, 27/05/2015

2 Application domain: Seaports

3 The need Port processes under stress throughput must be improved 2 or 3 times WITHOUT infrastructure investments AND full traceability of people & assets, keeping and evolving legacy systems Traceability vs efficiency

4 The need Port processes under stress throughput must be improved 2 or 3 times WITHOUT infrastructure investments AND full traceability of people & assets, keeping and evolving legacy systems Traceability vs efficiency

5 The problem... Port of Valencia is required to identify the daily 4000 users, by Spanish Authorities

6 A problem indeed

7 Valencia Port in figures Unified messaging system: PCS +400 user companies +100 million of transactions Savings in time and cost Activity Companies Freight forwarders 122 Shipping agents 64 Truck carrier 224 Container terminals 5 Other terminals 8 Depots 17 Total 440 Checking a 5000 movements list takes only 3 minutes (4 hours before having this tool)

8 Valencia Port in Europe 10 th port in EU, in number of tons (Eurostat, 2011) 8

9 Seaport needs and challenges (I) 1. Weak physical access control of people (drivers, passengers, port employees or other workers, visitors and ship crews), as stated in Directive 2005/65/EC 2. Lack of control of other vehicle passengers (copilot seat) 3. Insufficient definition in information systems (PCS or other) to enter information for access control of people. 4. Transport companies can inform about drivers, other companies inform about employees or other workers, but currently this information is optional.

10 Seaport needs and challenges (II) 5. Port authorities need fluidity in access points in order to not slow down traffic and commercial activity. 6. Access requirements may vary depending on the port sub-area and security levels. 7. Need to make a liaison with cargo control, vehicle and driver. 8. Different authorizer agent for each type of subarea (port terminal, port authority, depot, warehouse, etc.) 9. Different information provider for each element (logistic operator for containers and cargo, transport company for vehicles and drivers, shipper for passengers, companies for employees, etc.)

11 Solution approach Digital port business processes efficiency under control Port efficiency challenge: Usability challenge: Access control challenge: Access control slows down business process execution Physical-Digital world data synchronization & exchange Multi-domain, contextsensitive seamless access control for fast decision making Augment AC with Sensing Capabilities

12 Sensing AC covered processes Freight transport access control Authorized workers access control Freight operations communications access control Outsourced workers and visitors access control Port authority activity awareness Passengers access control...looking at usability and AC effectiveness

13 Solution approach principles Automate data acquisition (people, goods, vehicles, services). Accelerate muti-domain cross system and cross platform data exchange. Fast & easy multi-factor access control policy delegation with traceability. Big data context-related segmentation for fast analysis. Seamless Physical-digital world cloud-based data exchange management. Digital evidence management and auditing.

14 Contextualizing the approach, new networking levels An Internet of Everything brings together people, process, data and things to make networked connections turning information into actions more valuable and relevant

15 Future enterprise evolution

16 Contextualizing the approach

17 Sensing enterprise reference architecture SERVICE MANAGER Real World DEVICES AND OBJECTS DEVICES/ OBJECTS INTERFACE RW SENSORS AND ACTUATORS SENSOR/ ACTUATOR ABSTRACTION REAL-WORLD BUS INTER-WORLD ROUTER SERVICE MANAGER MULTIMEDIA CONTENT SERVICE USER CONTENT SERVICE SERVICE MANAGER DW SENSORS AND ACTUATORS SENSOR/ ACTUATOR ABSTRACTION DIGITAL-WORLD BUS AR/VR APPLICATIONS AR/VR INTERFACE Virtual World VW SENSORS AND ACTUATORS SENSOR/ ACTUATOR ABSTRACTION VIRTUAL-WORLD BUS INTER-WORLD ROUTER INNER- CONTEXT WORLD MANAGER SERVICE INNER- CONTEXT WORLD MANAGER SERVICE INNER- CONTEXT WORLD MANAGER SERVICE INTER-WORLD ROUTER Digital World

18 Sensing access control architecture Data bus Authorization Server

19 Sensing AC features In motion identification Multifactor authentication Centralized, dynamic and holistic AC related decision making system Smart enforcers Multidomain context integration in AC decision Real time sensoring integration in AC decision Activity tracking and processing Cloud oriented architecture Tight and adaptive enforcement Usability and fluency Policy manageability Awareness Anomaly detection Auditability Forensic analysis

20 Sensing AC implementation

21 Message brokering and policy decision making detail

22 Message flow

23 Testing scenario Source of data: in motion identification and geolocation message simulator (VW) Inter world bus activity: message brokering cluster (2 instances) (DW) Processing and analysis cluster: parallel and chained analysis threats for authorization decision making, deviation detection, accounting (2 instances) (DW) Output: authorization enforcement and recording (RW) Up to messages per second Topless 100 messaging topics Up to 4 chained threats Topless 30 addressed enforcers

24 Testing scenario Source of data: in motion identification and geolocation message simulator (VW) Inter world bus activity: message brokering cluster (2 instances) (DW) Processing and analysis cluster: parallel and chained analysis threats for authorization decision making, deviation detection, accounting (2 instances) (DW) Output: authorization enforcement and recording (RW) Up to messages per second Topless 100 messaging topics Up to 4 chained threats Topless 30 addressed enforcers Measurement reference: sensing terminal on Valencia port states an stimated flow of 8000 messages per second

25 Testing output Sensing terminal on Valencia port states an estimated flow of 8000 msg/s msg/s. Validation output states that 35% of CPU load is reached to process msg/s 8000 msg/s.

26 Conclusions Sensing AC enables: Integrated AC Holistic AC Sensing AC s performance is beyond of nowadays requirements Modularity and scalability of the ACIO solution enable high density sensitivity deployments

27 AC in organizations as a project Partners Duration 30 months Project Budget 522,660 Effort in Person Years 39,07

28 Thank you, Merci beaucoup Mikel Uriarte Itzazelaia IWEI 2015, Nimes, France 27/05/2015 Follow us!