jose J. Zhang Internet-Draft C. Jiang Intended status: Informational L. Ji Expires: 30 August 2024 China Unicom 27 February 2024 JSON Fine Grained Access draft-zhang-jose-json-fine-grained-access-00 Abstract This document defines a JSON-based fine-grained access (JSON-FA) method, which aims to provide a flexible and easy-to-implement way to achieve fine-grained access control in JSON data. Status of This Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at https://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on 30 August 2024. Copyright Notice Copyright (c) 2024 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/ license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License. Zhang, et al. Expires 30 August 2024 [Page 1] Internet-Draft Network Function Virtualization February 2024 Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 2 3. Background . . . . . . . . . . . . . . . . . . . . . . . . . 3 4. JSON-FA Data Structure . . . . . . . . . . . . . . . . . . . 3 4.1. JSON-FA Data Elements . . . . . . . . . . . . . . . . . . 3 4.2. JSON-FA Data Structure Example . . . . . . . . . . . . . 4 5. JSON-FA process flow . . . . . . . . . . . . . . . . . . . . 4 5.1. CP-ABE algorithm . . . . . . . . . . . . . . . . . . . . 5 5.2. Access Control Process . . . . . . . . . . . . . . . . . 6 6. Security Consideration . . . . . . . . . . . . . . . . . . . 7 7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 8 8. Informative References . . . . . . . . . . . . . . . . . . . 8 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 8 1. Introduction With the rapid development of information technology, data has become a core asset for enterprises and organizations. However, frequent occurrences of data breaches and unauthorized accesses have made data security an urgent issue. Traditional access control methods, such as Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC), although protecting data security to some extent, gradually show their limitations when dealing with complex and dynamic data access requirements. To address this issue, this paper proposes a JSON-based fine-grained access control method that can be applied to various scenarios such as web services, cloud computing, and the Internet of Things. 2. Terminology The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119][RFC8174]. JSON, A lightweight data exchange format. RBAC, A popular access control strategy that associates access privileges with specific roles rather than directly with users or user groups. ABAC, A more granular and flexible access control method. In ABAC, access decisions are not only based on the identity or role of the user, but also on various attributes related to the access request. Zhang, et al. Expires 30 August 2024 [Page 2] Internet-Draft Network Function Virtualization February 2024 Fine-Grained Access Control, A security mechanism used to precisely control and manage access privileges to system resources. 3. Background Fine-grained access control enables permission control for individual data items or data attributes, providing more precise protection for data. At the same time, the lightweight and easy-to-read/write nature of JSON (JavaScript Object Notation), along with its structured and nested characteristics, facilitates the simple description of complex data structures. The conciseness, readability, and structured nature of JSON make it an ideal choice for describing data structures. This document proposes a JSON-based fine-grained access (JSON-FA) control method that fully utilizes the formatting characteristics of JSON. It describes the attributes of the accessing subject in JSON format,and utilizes the data structure of an access control tree to represent fine-grained access control policies on the resource server side.This approach makes the access control method more flexible, manageable, and extensible. We hope to provide a more flexible, precise, and efficient solution in the field of data security through this method. 4. JSON-FA Data Structure JSON-FA (JSON-based Fine-Grained Access Control) data format is a standardized format used to initiate access requests to access control systems. This format allows clients (such as users or applications) to explicitly specify the resources they wish to access, the operations they intend to perform, and fine-grained access attributes (including identity, role, and other attribute information). 4.1. JSON-FA Data Elements The JSON-FA data structure mainly consists of a JSON object that contains the requested access resources and their fine-grained access conditions, including the following fields: * requestId: The identifier of the request. * subject: Identifiers representing the access subject. * operation: indicates the action identifier of the request body, such as "read", "write", "update", and so on. Zhang, et al. Expires 30 August 2024 [Page 3] Internet-Draft Network Function Virtualization February 2024 * resource: Indicates the identifier of the accessed resource. Contains a list of information about accessing the resource. The accessed resource object includes the following fields: - resourceType: Describes the type of the resource, such as files, databases, and so on. - attributes: is an object that contains the static attributes of the resource, such as file name, file type, creation date, and so on. * condition: Refers to the fine-grained attributes of the access subject, and is an optional field. 4.2. JSON-FA Data Structure Example This example describes the request where User123 submits a request named request123 through an access control server. The request is for read-only access to a specific file named "document.txt". Additionally, when submitting the request, User123 provides fine- grained attributes related to the request, including his role and department. { "requestId": "request23", "subject": "user123", "operation": "read", "resource": { "resourceType": "file", "attributes": { "fileName": "document.txt", "fileType": "text/plain" } } "condition": { "role": "manager", "department": "finance" } } 5. JSON-FA process flow In this article, CP-ABE (Ciphertext-Policy Attribute-Based Encryption) is chosen as the encryption algorithm to achieve fine- grained access control. While role-based access control and attribute-based access control can control whether users have access permissions to view data, they do not guarantee the security of the data itself. CP-ABE encrypts the data based on access control Zhang, et al. Expires 30 August 2024 [Page 4] Internet-Draft Network Function Virtualization February 2024 policies, meaning that even if an attacker intercepts the ciphertext, they cannot decrypt the file without the corresponding permissions and keys. This ensures the security of the data and makes fine- grained access control more effective. 5.1. CP-ABE algorithm Ciphertext-policy Attribute-Based Encryption (CP-ABE) algorithm allows data owners to define access policies based on the attributes of data receivers. These policies are encrypted within the ciphertext, while the receivers' attributes are encoded in their private keys.?Only receivers with attributes that meet the access policies encrypted in the ciphertext can decrypt and access the original data. This encryption method provides fine-grained access control, providing a balance between data security and flexibility. The CP-ABE algorithm works as follows: 1. Setup: This step takes an implicit security parameter ? as input. It outputs public parameters PK and master key MK.?The public parameters are made available to all, while the master key is kept secret. 2. Encrypt(PK, M, A): Inputs the public parameters PK, a message M, and an access structure A. It encrypts the message M to generate a ciphertext CT. Only data receivers with attributes that meet the access structure can decrypt the message. The access structure A is implicitly contained in the ciphertext. 3. Key Generation(MK, S): Inputs the master key MK and a set of attributes S for the data receiver. It outputs a private key SK. The SK is determined by the attribute set S. 4. Decrypt(PK, CT, SK): Inputs the public parameters PK, the ciphertext CT containing the access structure A, and the private key SK. If the attribute set S meets the access structure A, it decrypts the ciphertext CT and returns the message M. Algorithm Parameters: 1. Security Parameter (?): An input parameter that determines the security level of the algorithm. Typically, a larger value of the security parameter provides higher security, but also increases computational complexity and key length. Zhang, et al. Expires 30 August 2024 [Page 5] Internet-Draft Network Function Virtualization February 2024 2. Public parameters (PK) and Master Key (MK): These two crucial parameters are generated during the initialization phase (Setup). The public parameters PK is public and used for encryption operations, while the master key MK is secret and used to generate private keys for data receivers. 3. Attribute Set (S): Set by the data owner, defining the attributes of the data receiver, which can be their identity, role, permissions, etc. 4. Access Structure (A): Set by the data owner, defining the access control policy that describes the attribute sets which can access the encrypted data. The access structure A is typically represented using an access tree structure, where each node represents an attribute or a set of attributes. 5. Plaintext Message (M): The original data that needs to be encrypted. During the encryption phase, the algorithm uses the Public parameters PK, plaintext message M, and access structure A to generate the ciphertext CT. 6. Ciphertext (CT): The encrypted data. 7. Private Key (SK): Generated based on the data receiver's attributes set S and the master key MK. The private key SK contains the data receiver's attributes and the decryption capabilities associated with those attributes. During the decryption phase, the data receiver uses their own private key to decrypt the ciphertext. 5.2. Access Control Process 1. The client sends authentication information to the server to apply for registration and authorization. The server verifies these information and returns a JWT token. 2. The request sent by the client includes a JWT token, and the payload of the token contains information about the accessing subject, accessed resources, and attributes. This is represented by the data structure mentioned in 5.2. Zhang, et al. Expires 30 August 2024 [Page 6] Internet-Draft Network Function Virtualization February 2024 3. Resource servers set fine-grained access control policies for different resources, which are represented by an Access Control Tree (Access Tree). Each leaf node in the access control tree represents an attribute, while non-leaf nodes are threshold gates/nodes. The data format inside a threshold node is (n, t), indicating that the node has a total of n child nodes, and the node is considered satisfied if at least t child nodes meet the conditions. 4. The access control tree provides a precise and convenient way to control access permissions for different accessing subjects to specific resources based on attributes and access rules. It satisfies complex and changing data access requirements while offering a descriptive format for access control. 5. The resource server validates the authenticity of the token carried in the request. Once the token is validated, the server parses the payload information to extract the accessing subject, accessed resource, access action, and attribute information. 6. Based on the extracted information and the predefined access control policies, the resource server determines whether there is a matching fine-grained access control policy. If a matching policy is found, the server checks if the access conditions are met. If the conditions are satisfied, access is granted; otherwise, access is denied. 7. The resource server encrypts the requested resource using the CP- ABE (Ciphertext-Policy Attribute-Based Encryption) algorithm. The encryption process incorporates the access control policy corresponding to the accessed resource. The encrypted ciphertext is then sent back to the client. 8. The client generates a decryption private key based on the set of attributes included in the request using the CP-ABE (Ciphertext- Policy Attribute-Based Encryption) algorithm. After receiving the encrypted ciphertext, the client verifies that the attributes in the attribute set can satisfy the access control policy. Only if the attributes meet the policy can the client decrypt and access the resource. 6. Security Consideration To ensure the security of JSON-FA, the following points need to be considered: Data encryption: Encrypt the transmitted JSON data to prevent data tampering. Zhang, et al. Expires 30 August 2024 [Page 7] Internet-Draft Network Function Virtualization February 2024 Access Control Rule Management: Regularly manage and maintain access control rules to prevent their leakage and tampering. Logging and Auditing: Record all successful and failed authentication attempts, regularly audit and perform security analysis on access control logs to promptly detect and address abnormal access behaviors. 7. IANA Considerations This document has no IANA actions. 8. Informative References [CP-ABE] Bethencourt, J., Sahai, A., and B. Waters, "Ciphertext- Policy Attribute-Based Encryption", May 2007. [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", March 1997. [RFC7519] Jones, M., Bradley, J., and N. Sakimura, "JSON Web Token (JWT)", May 2015, . [RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", May 2017, . [RFC8259] Bray, T., Ed., "The JavaScript Object Notation (JSON) Data Interchange Format", December 2017, . Authors' Addresses jinling Zhang China Unicom Beijing 100176 China Email: 904631019@qq.com cheng Jiang China Unicom Beijing 100176 China Email: jiangc12@chinaunicom.cn Zhang, et al. Expires 30 August 2024 [Page 8] Internet-Draft Network Function Virtualization February 2024 lingling Ji China Unicom Beijing 100176 China Email: jill32@chinaunicom.cn Zhang, et al. Expires 30 August 2024 [Page 9]