Access control for inter-organizational computer network environment

Abstract

The Internet has evolved into an interconnection of networks on an organizational basis from the early stages where the interconnection was primarily on a network basis. The original protocol architecture, which essentially sought ubiquitous connectivity, has little scope for incorporating access control, a feature for which the demand increases with connectivity. In this work, we have taken up this issue. We have examined- how one can provide a transparent network, while preserving security of organizations by implementing and maintaining strict access control using firewalls.

We propose a “User Access Domain (UAD)” to provide user-level grouping, and a „Access Domain Control Layer (ADCL)” to support the user level domain over the organizational networks with firewalls. While the User Access Domain provides the framework for virtual private networks the Access Domain Control Layer provides firewall-transparent TCP/UDP connectivity in what appears to be a seamless logical network spanning the User Access Domain.

Moreover, the access-control policy can be formulated in more relevant terms like user identity, user role, source-destination, service etc. A proof-of-concept prototype is presently operational. The access-control framework is managed and maintained using the SNMP protocol. Appropriate MIBs have been defined and are in the process of being implemented.