Access Control for a Federated Police Information System

Matthew Hudnall
Center for Advanced Public Safety The University of Alabama Tuscaloosa, AL 35487-0290 (001) 205-348-0856

Maury Mitchell
Alabama Criminal Justice Info. Center 201 South Union Street, Suite 300 Montgomery, AL 36130 (001) 334-517-2400

Allen Parrish
Center for Advanced Public Safety The University of Alabama Tuscaloosa, AL 35487-0290 (001) 205-348-3749

mhudnall@cs.ua.edu

maury.mitchell@alacop.gov

parrish@cs.ua.edu

ABSTRACT
In this paper, we present the elements of a system for demonstration that supports a federated infrastructure for a collection of police agencies.

Categories and Subject Descriptors

D.4.6 [Operating Systems]: Security and Protection Access controls, authentication.

As noted in the introduction, there are approximately 15,000 users in the ADAPT system. These users are generally police officers in one of Alabamas nearly 400 police agencies. Each agency manages its own users through an agency information security officer (AISO). The agencys AISO is responsible for adding new officers and deleting officers who have left the agency. The AISO also is responsible for administering privileges for each of the agencys users. Privileges are controlled by a hierarchy starting with the states central criminal justice technology agency the Alabama Criminal Justice Information Center (ACJIC). ACJIC grants the appropriate privileges to each of 8 region administrators; such privileges are granted at a level that permits further propagation. Each region administrator then propagates appropriate privileges across the region to each agencys AISO. The AISO also receives propagate permission, and is permitted to grant each privilege received (as appropriate) to each of his/her agencys users. Figure 1 shows how privileges are propagated across this hierarchy.

General Terms
Security

Keywords
Role-based authentication, federated systems.

1. INTRODUCTION
This proposal is for a demonstration of an access control system called ADAPT (Active Directory Authentication Processing Tool). ADAPT is used to control access to a group of applications that are part of the AlaCOP portal, which is a statewide police portal used within the State of Alabama. The AlaCOP portal is an umbrella for a number of police applications that are used on a statewide basis within Alabama. ADAPT provides single sign-on access to these applications to any registered police officer within Alabama; there are currently approximately 15,000 registered ADAPT users. ADAPT is a privilege-based system where privileges are assigned to officers based on roles. Privileges are customized for each application, and their degree of restrictiveness is determined by the application. ADAPT was developed in 2003 and has been the production system for access control for state-managed police applications within Alabama since that time. There are over 20 separate applications controlled by ADAPT.

Figure 1 Privilege Propagation To support this propagation, a given privilege may be granted at several different levels: Allow Full management/allow Limited assignment/allow Deny

2. SYSTEM ARCHITECTURE
There are three major components to the overall ADAPT system architecture: Users Privileges Applications

Copyright is held by the author/owner(s). SACMAT'11, June 1517, 2011, Innsbruck, Austria. ACM 978-1-4503-0688-1/11/06.

If a privilege is granted at the allow level, then the assignee simply inherits the privilege with no further propagation rights. Full management/allow gives the assignee the right to inherit the privilege, as well as the right to propagate all rights (including further propagation rights) to the privilege to assignees. Limited

149

assignment/allow gives the assignee the right to inherit the privilege, as well as the right to assign the privilege to others; however, the right to propagate the privilege to assignees for (potentially) further propagation is withheld. Deny explicitly denies a privilege for an assignee, and can be used to revoke privileges. Figure 2 shows the ADAPT screen for adding and removing user privileges.

Figure 3 Users, Privileges and Applications

3. DEMONSTRATION SCENARIOS
This application will be demonstrated using three basic scenarios: 1. 2. 3. Adding a new user Assigning user privileges Demonstration of an application for which privileges have been assigned.

Figure 2 User Privilege Assignment There are a number of different applications that are accessible through the portal. These applications each have controlling privileges that determine the level of access available to particular users. The semantics of a privilege are application-dependent; applications are implemented so that possession of a privilege controls the type of access to the application. For example, the privilege AllowHSAccess permits access to homeland security information within the AlaCOP application. The AlaCOP application is then coded in such a way that AlaCOP users without this privilege have access to the application, but without the homeland security information. Figure 3 depicts the overall relationship between users, privileges and applications. ADAPT is built using Microsoft Active Directory to manage user accounts. Privileges are stored in a SQL Server database that is external to the underlying Active Directory system. The system is constructed using a service-oriented architecture, which allows both Windows and Web-based applications to be controlled by this approach. This service-oriented architecture also allows the system to be adapted to standards such as GFIPM and other federated security standards as needed.

These three scenarios will demonstrate the full range of services provided by ADAPT. In particular, adding a user will show the full range of data maintained on a particular user. Assigning that user privileges will provide a sense of the types of privileges that are available for the various applications, and then demonstrating an application will show how the privileges are utilized by the various applications. 4.

SUMMARY

Demonstration of the ADAPT system will provide attendees with exposure to a real-world access control system that is widely used (with over 15,000 users) in a large-scale, geographically distributed environment. Police agencies using ADAPT are scattered over the entire State of Alabama. Applications controlled by ADAPT consist of both Windows and Web applications, and also include mobile applications that are designed to be used in a network disconnected setting (in cases where field cellular data service is weak or spotty). Managing access in such a variety of settings over a broad area to a large number of users presents unique challenges that will be discussed in the course of this presentation.

150