Integration of Physical Access Security and Logical Access Security using Microsoft Active ...

83 Pages·2006·1.92 MB·English

Integration of Physical Access Security and
Logical Access Security using Microsoft Active
Directory
Edward Stead
Computing and Management
2005/2006
Thecandidateconfirmsthattheworksubmittedistheirownandtheappropriatecredithasbeengivenwhere
referencehasbeenmadetotheworkofothers.
I understand that failure to attribute material which is obtained from another source may be considered as
plagiarism.
(Signatureofstudent)
IntegrationofPhysicalAccessSecurityandLogicalAccessSecurityusingMicrosoftActiveDirectory
Summary
With heightened security concerns, small to large enterprises and institutions [1], across the globe are
looking for ways to effectively secure their facilities [2] and manage access to both their physical and
logicalresources[3]. Companieshavemultiplesolutionsthathaveevolvedseparatelycreatinggapsintheir
securityarmor[4]. Consolidationandeconomiesofscaleholdthepromiseofreducingadministrationcosts,
while providing better governance of policy, people and infrastructure. Convergence of technologies such
asdirectoryservices,identityandaccessmanagementandphysicalaccesscomponentssuchassmartcards
are already paving the way. [5]. This report develops a proof of concept solution for integrating physical
andlogicalaccesssecurityusingaworkingMicrosoftActiveDirectoryenvironment.
EdwardStead-jhs2ets i
IntegrationofPhysicalAccessSecurityandLogicalAccessSecurityusingMicrosoftActiveDirectory
Acknowledgements
I’d like to thank Sarah Fores for being able to convince me that it can be done ’just one step at a time’
andhercontinuingsupportthroughouttheentiretyoftheproject.
ThankstoPritpalRehalforprovidinginspirationandtechnicalbackupateverystageoftheproject.
Thanks to Karim Djemame for his comments and guidance at some of the most crucial stages of the
project.
Many thanks go to Paul Brackenridge for giving me the support and encouragement that made this
projectpossible.
Alsothanksgotomyfamilyandfriendswhohavesupportedthroughoutthisprojectandmytimeatthe
UniversityofLeeds.
EdwardStead-jhs2ets ii
Contents
1 Introduction 1
1.1 ProjectAim . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
1.2 Methodology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
1.2.1 Schedule . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
2 AnalysisandInvestigation 3
2.1 ResearchAims . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
2.2 SoCCurrentSystems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
2.2.1 SoCPhysicalAccessSystem . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
2.2.2 SoCSystemEvaluation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
2.3 LogicalAccessControl . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
2.4 IdentityManagement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
2.4.1 IdentityManagementFoundationComponents . . . . . . . . . . . . . . . . . . . . 6
2.4.1.1 Repository . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
2.4.1.2 Authenticationprovider . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
2.4.1.3 Policycontrol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
2.4.1.4 Auditing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
2.4.2 IdentityManagementConsumableValueComponents . . . . . . . . . . . . . . . . 6
2.4.2.1 SingleSign-On . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
2.4.2.2 AccessManagement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
2.5 PhysicalAccessControl . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
2.5.1 Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
2.5.2 AccessControlTechnologies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
iii
IntegrationofPhysicalAccessSecurityandLogicalAccessSecurityusingMicrosoftActiveDirectory
2.5.2.1 SmartCards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
2.5.2.2 Biometric . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
2.5.2.3 RFID . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
2.5.3 Authorisation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
2.5.4 AccessControlTechniques . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
2.5.4.1 DiscretionaryRBAC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
2.5.4.2 Role-basedAccessControlRBAC . . . . . . . . . . . . . . . . . . . . . 12
2.5.4.3 HierarchicalRBAC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
2.6 NetworkSecurity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
2.6.1 Encryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
2.6.2 SSL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
2.7 ResearchonPreviousProjects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
2.8 ResearchonConvergentSystems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
2.8.1 SunMicrosystem’sIntegrationofPhysicalandAccessSecurity . . . . . . . . . . . 15
2.8.2 MicrosoftUnifiedAdministrationModel . . . . . . . . . . . . . . . . . . . . . . . 15
2.9 AdvantagesandDisadvantagesofanIntegratedSecuritySystem . . . . . . . . . . . . . . . 16
2.9.1 Advantages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
2.9.2 Disadvantages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
2.10 ExistingTechnologies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
2.10.1 MicrosoftActiveDirectory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
2.10.2 LightweightDirectoryAccessProtocol . . . . . . . . . . . . . . . . . . . . . . . . 19
2.10.3 ADSI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
2.10.4 .NETFramework . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
2.11 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
3 Design 23
3.1 ProposedFunctionality . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
3.1.1 InterfacetoRepresentaPhysicalAccessMedium . . . . . . . . . . . . . . . . . . . 24
3.1.2 FunctionalitytoAuthenticateaUserAgainstActiveDirectory . . . . . . . . . . . . 24
3.1.3 Functionality to Authorise a User Depending on the Resource They Are Trying to
Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
EdwardStead-jhs2ets iv
IntegrationofPhysicalAccessSecurityandLogicalAccessSecurityusingMicrosoftActiveDirectory
3.1.3.1 Option1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
3.1.3.2 Option2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
3.1.3.3 ChoiceofOption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
3.1.4 FunctionalitytoRecordAuthenticationandAuthorisationinformation . . . . . . . . 27
3.2 DesignSummary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
4 ImplementationandTesting 29
4.1 OverviewoftheSystem . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
4.1.1 TestDomainEnvironment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
4.1.2 ActiveDirectoryImplementation . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
4.2 SystemExplanation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
4.3 InputForm . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
4.3.1 Logon.aspxForm . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
4.4 AuthenticationFunctionality . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
4.4.1 LdapAuthenticationClass . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
4.4.1.1 LdapAuthentication.IsAuthenticatedFunction . . . . . . . . . . . . . . . 36
4.4.1.2 LdapAuthentication.GetGroupsFunction . . . . . . . . . . . . . . . . . . 38
4.4.1.3 LdapAuthentication.GetUsernameFunction . . . . . . . . . . . . . . . . 38
4.4.2 Global.asax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
4.4.3 CustomPrincipalClass . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
4.4.4 IDAuthClass . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
4.5 AuthorisationFunctionality . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
4.5.1 GroupsAuthClass . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
4.6 InformationForm . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
4.6.1 Default.aspxForm . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
4.6.2 Logout.aspxForm . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
4.7 Administration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
4.8 SecurityInformationFile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
4.8.1 XMLFileMakerClass . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
4.9 Testing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
4.9.1 FunctionalityTesting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
EdwardStead-jhs2ets v
IntegrationofPhysicalAccessSecurityandLogicalAccessSecurityusingMicrosoftActiveDirectory
4.9.1.1 AuthenticationandAuthorisationFunctionality . . . . . . . . . . . . . . 44
4.9.1.2 AdministrationFunctionality . . . . . . . . . . . . . . . . . . . . . . . . 45
4.9.2 Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
5 Evaluation 47
5.1 EvaluationCriteria . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
5.2 EvaluationofModelSystem . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
5.2.1 UserApproachesaDoorTheyWishtoAccess . . . . . . . . . . . . . . . . . . . . 48
5.2.2 UserisConfrontedbyaSmartCardReader . . . . . . . . . . . . . . . . . . . . . . 48
5.2.3 UserSwipesCardHoldingUsernameandPasswordThroughReader . . . . . . . . 48
5.2.4 AccesstoaDoorisAllowed/Denied . . . . . . . . . . . . . . . . . . . . . . . . . . 49
5.3 EvaluationofFunctionality . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
5.3.1 AuthenticationFunctionality . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
5.3.2 AuthorisationFunctionality . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
5.3.3 AdministrationFunctionality . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
5.3.4 SecurityInformationFile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
5.4 EvaluationAgainstaPreviousSolution . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
5.5 EvaluationAgainstAdvantagesofaConvergentSystem. . . . . . . . . . . . . . . . . . . . 51
5.5.1 SingleInterface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
5.5.2 SimplifiesAccessandAdministrationProcesses . . . . . . . . . . . . . . . . . . . 52
5.5.3 EaseofAdministration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
5.5.4 ConsolidatedIdentity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
5.5.5 MonitoringofEvents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
5.5.6 LowerOperationCosts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
5.5.7 HelpsCombatPotentialSecurityBreaches . . . . . . . . . . . . . . . . . . . . . . 53
5.5.8 AdvocatesSingleSign-on . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
5.6 SummaryofFurtherWork . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
5.7 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
6 AppendixA 56
6.1 ProjectReflection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
6.2 LessonsLearntandGuidance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
EdwardStead-jhs2ets vi
IntegrationofPhysicalAccessSecurityandLogicalAccessSecurityusingMicrosoftActiveDirectory
7 AppendixB 59
7.1 SoCPhysicalAccessSystem . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
8 AppendixC 60
8.1 ExtendingtheActiveDirectorySchemaToTrackCustomInfo . . . . . . . . . . . . . . . . 60
9 AppendixD 64
9.1 FunctionalTesting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64
10 AppendixE 66
10.1 RevisionstoSchedule . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66
10.2 InitialPlan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66
10.3 RevisedPlan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66
11 AppendixF 69
12 AppendixG 70
12.1 AdministrationForm . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70
Bibliography 71
EdwardStead-jhs2ets vii
Chapter 1
Introduction
Organisationstypicallygrowinsucharapid,organicmanner[6]thatchallengesareincreasinglycreatedfor
protectingdataandassets,suchasinformation,PCs,servers,buildingsandpeople[7]. Manyorganisations
achievesecuritywithadiverseandcomplexarrayofphysicalaccessandlogicalsolutions,butthephysical
and IT policies, processes and systems of a company’s security program are often designed, implemented
andoperatedbyseparatevendors[8]. TheSchoolofComputing(SoC)attheUniversityofLeedscurrently
operates two separate systems, a logical access control system based on Microsoft Active Directory and a
proprietary physical access control system. As a result, the overall security program is less effective and
lessefficientthanitcouldbe[8]. Someintegratedsystemscompaniesoffercomprehensivesystemservices
including hardware, software, installation, consulting, and systems design and engineering services [9].
The SoC, like many organisations, would like to use the security systems already in place but may find
the costs of services from such specialist integration companies out of line with their budgets. Another
option is to implement some sort of middleware solution to bring together the separate systems in play; a
convergentsystem. Ideallythesolutiondevelopedwouldbegeneric,sothatitcouldbeportedtoanumberof
different organisations without the need for configuration by specialist contractors. Sun Microsystems has
only recently (13th March 2006) produced a solution to combine access to physical (building) and logical
(network and application) resources onto a single system [10]. The system is based on Sun’s own smart
card system named Java Card and the solution combines Sun’s Java System Identity Management Suite
1
IntegrationofPhysicalAccessSecurityandLogicalAccessSecurityusingMicrosoftActiveDirectory
with ActivIdentity’s Card Management System (CMS). This report describes a project to combine SoC’s
physicalandlogicalsecurityusingMicrosoftActiveDirectoryanddiscussesaworkingsolutiontomovea
steptowardsintegratingsecuritysystemswithinanorganisation.
1.1 Project Aim
The aim of the project is to develop a proof of concept solution for integrating physical and logical access
securityusingaworkingMicrosoftActiveDirectoryenvironment.
1.2 Methodology
In order to test the feasibility of integrating physical and logical access security it is necessary to research
the current systems in place at the School of Computing, current state-of-the-art convergent systems and
previous attempts to solve the problem. The research will develop a set a of functional requirements and
prioritiesforanintegratedsystemthatcanbeusedtobuildasolutionthatdemonstratesthefunctionalityof
a‘real-life’integratedsystem.
1.2.1 Schedule
SeeAppendixE,Figure10.1forinitialprojectplan.
EdwardStead-jhs2ets 2