COMPACFLT - EDAC

Enterprise Dynamic Access Control (EDAC)

Point of Contact:

Richard Fernandez(808) 474-9270

Approved for public release; distribution is unlimited.

"The United States Government has certain intellectual property rights in the Enterprise Dynamic Access Control software.  This intellectual property is available for licensing for commercial purposes.  Licensing and technical inquiries should be directed to the Office of Patent Counsel, Space and Naval Warfare Systems Center, San Diego, Code

20012, San Diego, CA, 92152; telephone (619) 553-3001, facsimile (619) 553-3821.  Reference Navy Case Numbers 96217, 97188, 97189."

COMPACFLT - EDAC

For licensing information contact: Stephen Lieberman Voice:  (619) 553-2778 Mobile:  (619) 606- 5940 Email:  stephen.lieberman@navy.mil

For comments regarding this product contact:Richard FernandezVoice: (808) 474-9270Email:  richard.r.fernandez@navy.mil

"The United States Government has certain intellectual property rights in the Enterprise Dynamic Access Control software.  This intellectual property is available for licensing for commercial purposes.  Licensing and technical inquiries should be directed to the Office of Patent Counsel, Space and Naval Warfare Systems Center, San Diego, Code

20012, San Diego, CA, 92152; telephone (619) 553-3001, facsimile (619) 553-3821.  Reference Navy Case Numbers 96217, 97188, 97189."

Outline

Access control backgroundAccess control listsGroupsNIST RBAC standard

SEAC RBACCustomer furnished and maintained assetsHow it worksProduct overviewInteroperability

"The United States Government has certain intellectual property rights in the Enterprise Dynamic Access Control software.  This intellectual property is available for licensing for commercial purposes.  Licensing and technical inquiries should be directed to the Office of Patent Counsel, Space and Naval Warfare Systems Center, San Diego, Code

20012, San Diego, CA, 92152; telephone (619) 553-3001, facsimile (619) 553-3821.  Reference Navy Case Numbers 96217, 97188, 97189."

Access Control Lists (ACL)

User name or unique identifier associates access to resources

Project Tracker ACL

Peter SmithEd JonesSteve HallJohn Doe

Peter Smith

Project Tracker(resource)

Peter Smith

Project Tracker ACL

Peter SmithEd JonesSteve HallJohn Doe

Tim Watts

Project Tracker(resource)

Tim Watts

"The United States Government has certain intellectual property rights in the Enterprise Dynamic Access Control software.  This intellectual property is available for licensing for commercial purposes.  Licensing and technical inquiries should be directed to the Office of Patent Counsel, Space and Naval Warfare Systems Center, San Diego, Code

20012, San Diego, CA, 92152; telephone (619) 553-3001, facsimile (619) 553-3821.  Reference Navy Case Numbers 96217, 97188, 97189."

Groups

User associated to a group and group associated to resources

Project TrackerGroups

COMPACFLTCOMNAVREGCOMSUBPAC

Project Tracker(resource)

Peter Smith

COMPACFLT Group

Peter SmithEd JonesSteve Hall

COMPACFLTCOMPACFLT

Project TrackerGroups

COMPACFLTCOMNAVREGCOMSUBPAC

Project Tracker(resource)

Ed Jones

MIDPAC Group

Peter SmithEd JonesSteve Hall

MIDPAC MIDPAC

"The United States Government has certain intellectual property rights in the Enterprise Dynamic Access Control software.  This intellectual property is available for licensing for commercial purposes.  Licensing and technical inquiries should be directed to the Office of Patent Counsel, Space and Naval Warfare Systems Center, San Diego, Code

20012, San Diego, CA, 92152; telephone (619) 553-3001, facsimile (619) 553-3821.  Reference Navy Case Numbers 96217, 97188, 97189."

Essentials for resource access

Necessary requirement to access resources:

•Not a user name•Not a unique identifier•Not a group association

•List of user characteristics

"The United States Government has certain intellectual property rights in the Enterprise Dynamic Access Control software.  This intellectual property is available for licensing for commercial purposes.  Licensing and technical inquiries should be directed to the Office of Patent Counsel, Space and Naval Warfare Systems Center, San Diego, Code

20012, San Diego, CA, 92152; telephone (619) 553-3001, facsimile (619) 553-3821.  Reference Navy Case Numbers 96217, 97188, 97189."

What are user characteristics

User characteristics (user profile)

•Where client works: organization•What security credentials: clearance•What pay category: pay grade•What branch : service•What vocation: job function•etc

"The United States Government has certain intellectual property rights in the Enterprise Dynamic Access Control software.  This intellectual property is available for licensing for commercial purposes.  Licensing and technical inquiries should be directed to the Office of Patent Counsel, Space and Naval Warfare Systems Center, San Diego, Code

20012, San Diego, CA, 92152; telephone (619) 553-3001, facsimile (619) 553-3821.  Reference Navy Case Numbers 96217, 97188, 97189."

Examples of User Profiles

Categories COMPACFLT USNROrganization: CPF N65 Naval IntelClearance: Secret Top SecretPaygrade: DP3 02Service: DoD DoNRFunction: Program Manager Intelligence

•User profile is a unique list of user characteristics.•A client may have more than one user profile.•User attributes should be compiled from an authoritative data source(s) on a real-time basis.

"The United States Government has certain intellectual property rights in the Enterprise Dynamic Access Control software.  This intellectual property is available for licensing for commercial purposes.  Licensing and technical inquiries should be directed to the Office of Patent Counsel, Space and Naval Warfare Systems Center, San Diego, Code

20012, San Diego, CA, 92152; telephone (619) 553-3001, facsimile (619) 553-3821.  Reference Navy Case Numbers 96217, 97188, 97189."

Impact on resource access

The following can affect resource access:

•Transfer to another organization •Loss of security clearance•Change in job title•Job promotion

"The United States Government has certain intellectual property rights in the Enterprise Dynamic Access Control software.  This intellectual property is available for licensing for commercial purposes.  Licensing and technical inquiries should be directed to the Office of Patent Counsel, Space and Naval Warfare Systems Center, San Diego, Code

20012, San Diego, CA, 92152; telephone (619) 553-3001, facsimile (619) 553-3821.  Reference Navy Case Numbers 96217, 97188, 97189."

Problems with ACLs and Groups

Maintaining an updated ACL or group is time consuming.

Situation worsens when:

•Number of users increase•Number of resources increase

Resource accessmanagement

manhours

Number of Users andResources

"The United States Government has certain intellectual property rights in the Enterprise Dynamic Access Control software.  This intellectual property is available for licensing for commercial purposes.  Licensing and technical inquiries should be directed to the Office of Patent Counsel, Space and Naval Warfare Systems Center, San Diego, Code

20012, San Diego, CA, 92152; telephone (619) 553-3001, facsimile (619) 553-3821.  Reference Navy Case Numbers 96217, 97188, 97189."

NIST RBAC compliance

Because of ACL and group limitations:

The National Institute of Standards and Technology (NIST) RBAC is an American National Standard - ANSI INCITS 359-2004 (approved 19 Feb 04)

"The United States Government has certain intellectual property rights in the Enterprise Dynamic Access Control software.  This intellectual property is available for licensing for commercial purposes.  Licensing and technical inquiries should be directed to the Office of Patent Counsel, Space and Naval Warfare Systems Center, San Diego, Code

20012, San Diego, CA, 92152; telephone (619) 553-3001, facsimile (619) 553-3821.  Reference Navy Case Numbers 96217, 97188, 97189."

NIST RBAC standard

Definitions:

Users and Roles: “…access decisions are based on the roles that individual users have as part of an organization.

"Access rights are grouped by role name…

Role hierarchies: "Under RBAC, roles can have overlapping responsibilities and privileges;

Roles and Operations: "Organizations can establish

the rules for the association of operations with roles. "The United States Government has certain intellectual property rights in the Enterprise Dynamic Access Control software.  This intellectual property is available for licensing for

commercial purposes.  Licensing and technical inquiries should be directed to the Office of Patent Counsel, Space and Naval Warfare Systems Center, San Diego, Code 20012, San Diego, CA, 92152; telephone (619) 553-3001, facsimile (619) 553-3821.  Reference Navy Case Numbers 96217, 97188, 97189."

Access control comparison

How access control solutions can simultaneously evaluate user characteristics.

"The United States Government has certain intellectual property rights in the Enterprise Dynamic Access Control software.  This intellectual property is available for licensing for commercial purposes.  Licensing and technical inquiries should be directed to the Office of Patent Counsel, Space and Naval Warfare Systems Center, San Diego, Code

20012, San Diego, CA, 92152; telephone (619) 553-3001, facsimile (619) 553-3821.  Reference Navy Case Numbers 96217, 97188, 97189."

ACLs

Groups

EDAC

Simultaneous evaluationof multiple objectcharacteristics &environmentals

0

1

Unlimited

Simultaneousevaluation of multipleobject characteristic &

environmentalhierarchies

No

No

Yes

Real-timedetection of object

characteristicchanges, thus

affecting resourceaccess

No

No

Yes

Customer meta-database background

o=Enterprise

ou=Clearance ou=fouo ou=confidential ou=secret ou=top secret

ou=Billettitle ou=developer ou=project ou=manager ou=welder ou=chef ou=plumber

ou=Paygrade ou=GS1 ou=GS2 ou=GS3 ou=GS4 ou=GS5 ou=GS6

o=Local

ou=Organization ou=finance ou=budgeting ou=accounting ou=marketing ou=sales ou=advertisement ou=opertions ou=quality control ou=manufacturing

Customer Meta-Database(s)

Customer PersonnelDatabase(s)

Billettitledeveloperproject managerwelderchefplumber

PaygradeGS1GS2GS3GS4GS5GS6

Organizationfinancemarketingoperations

Clearancefouoconfidentialsecrettop secret

Relational database data duplicated on a directory service.

"The United States Government has certain intellectual property rights in the Enterprise Dynamic Access Control software.  This intellectual property is available for licensing for commercial purposes.  Licensing and technical inquiries should be directed to the Office of Patent Counsel, Space and Naval Warfare Systems Center, San Diego, Code

20012, San Diego, CA, 92152; telephone (619) 553-3001, facsimile (619) 553-3821.  Reference Navy Case Numbers 96217, 97188, 97189."

Customer meta-database specificationso=EnterpriseName assignedto referencedirectory. Adirectory name isassigned anX500 "o"attribute.

ou=BranchReferencecategory directlyunderneathdirectory domainname. Allreferencedescriptors areassigned anX500 "ou"attribute.

ou=FRGNReference valuedirectlyunderneathreferencecategory in a flatstructure. Allreference valuesare assigned anX500 "ou"attribute.

ou=SecretReference value directlyunderneath Clerancereference category in ahierarchal structure. Allreference values areassigned an X500 "ou"attribute.

•Customer meta-database•LDAP v 3/DSML directory•X500 class objects• organization• organizationalUnit•Scalable• unlimited entries• modifications allowed•Structure designation• domain• reference category• values•Structure• flat• hierarchal•Maintained• local commands• regional commands

"The United States Government has certain intellectual property rights in the Enterprise Dynamic Access Control software.  This intellectual property is available for licensing for commercial purposes.  Licensing and technical inquiries should be directed to the Office of Patent Counsel, Space and Naval Warfare Systems Center, San Diego, Code

20012, San Diego, CA, 92152; telephone (619) 553-3001, facsimile (619) 553-3821.  Reference Navy Case Numbers 96217, 97188, 97189."

Customermeta-database domain

Globalcustomer meta

database 1customer meta

database nRegion B

customer metadatabase 1

customer metadatabase nRegion A

customer metadatabase 1

customer metadatabase n

Customer meta-database domain

Domain consist of global and regional directories.

"The United States Government has certain intellectual property rights in the Enterprise Dynamic Access Control software.  This intellectual property is available for licensing for commercial purposes.  Licensing and technical inquiries should be directed to the Office of Patent Counsel, Space and Naval Warfare Systems Center, San Diego, Code

20012, San Diego, CA, 92152; telephone (619) 553-3001, facsimile (619) 553-3821.  Reference Navy Case Numbers 96217, 97188, 97189."

CustomerPersonnel

Database(s)

Billettitledeveloperproject managerwelderchefplumber

PaygradeGS1GS2GS3GS4GS5GS6

Organizationfinancemarketingoperations

Clearancefouoconfidentialsecrettop secret

SPAWAR Profileclearance: secretorganization: engineeringbillettitle: project managerpaygrade: GS13

COMPACFLT Profileclearance: top secretorganization: engineeringbillettitle: developerpaygrade: GS13

User selects a profile

CustomerUser Profile Manager service

EDAC1 3

2

User Profile Manager

User selects a profile to determine resource access.Mgmt constraints on user profile selections

"The United States Government has certain intellectual property rights in the Enterprise Dynamic Access Control software.  This intellectual property is available for licensing for commercial purposes.  Licensing and technical inquiries should be directed to the Office of Patent Counsel, Space and Naval Warfare Systems Center, San Diego, Code

20012, San Diego, CA, 92152; telephone (619) 553-3001, facsimile (619) 553-3821.  Reference Navy Case Numbers 96217, 97188, 97189."

How the EDAC worksStep 1: Resource manager establishes a set of conditions to access a resource. These set of conditions represent a resource profile.

Customer Meta-Database

RBACConditionManagerInterface

RBACResourceDirectory

Resource Profileou=N65, ou=N6, ou=CPF, ou=assignedCommand, o=CPFou=secret, ou=confidential, ou=fouo, ou=clearance, o=Enterprise

T

"The United States Government has certain intellectual property rights in the Enterprise Dynamic Access Control software.  This intellectual property is available for licensing for commercial purposes.  Licensing and technical inquiries should be directed to the Office of Patent Counsel, Space and Naval Warfare Systems Center, San Diego, Code

20012, San Diego, CA, 92152; telephone (619) 553-3001, facsimile (619) 553-3821.  Reference Navy Case Numbers 96217, 97188, 97189."

How the EDAC worksStep 2:An effective RBAC requires real-time creation of user profile(s) from authoritative data source(s).

User Profileou=N65, ou=N6, ou=CPF, ou=assignedCommand, o=CPFou=secret, ou=confidential, ou=fouo, ou=clearance, o=Enterpriseou=GS3, ou=GS2, ou=GS1, ou=Paygrade, o=Enterprise

Customer Meta-Database

StructureFormatService

Reference CategoriesassignedCommand

clearancepaygrade

AttributesN65SecretGS3

Customer PersonnelDatabase

Customer UserProfile Manager

Interface

"The United States Government has certain intellectual property rights in the Enterprise Dynamic Access Control software.  This intellectual property is available for licensing for commercial purposes.  Licensing and technical inquiries should be directed to the Office of Patent Counsel, Space and Naval Warfare Systems Center, San Diego, Code

20012, San Diego, CA, 92152; telephone (619) 553-3001, facsimile (619) 553-3821.  Reference Navy Case Numbers 96217, 97188, 97189."

How the EDAC worksStep 3:The RBAC Rules Engine compares User and Resource Profiles to determine resource access.

RBACRules Engine

Repository Service

Customer ResourceDatabase

Project Tracker (resource)

HR Service (resource)

Payroll Application(resource)

Project Tracker Resource Profileou=N65, ou=N6, ou=CPF, ou=assignedCommand, o=CPFou=secret, ou=confidential, ou=fouo, ou=clearance, o=Enterprise

T

User Profileou=N65, ou=N6, ou=CPF, ou=assignedCommand, o=CPFou=secret, ou=confidential, ou=fouo, ou=clearance, o=Enterpriseou=GS3, ou=GS2, ou=GS1, ou=Paygrade, o=Enterprise

Access token forProject Tracker

"The United States Government has certain intellectual property rights in the Enterprise Dynamic Access Control software.  This intellectual property is available for licensing for commercial purposes.  Licensing and technical inquiries should be directed to the Office of Patent Counsel, Space and Naval Warfare Systems Center, San Diego, Code

20012, San Diego, CA, 92152; telephone (619) 553-3001, facsimile (619) 553-3821.  Reference Navy Case Numbers 96217, 97188, 97189."

EDAC – Resource profiles

Guest

CSP Guest

N7

CPF Guest

COMPACFLT

CNR Guests

User

Administrator

GS12

CPF N6 Users

CPF N6

CPF Admin Deny CPF N65 Admin

Resource ProfilesResource Roles

forProject Tracker

Secret

T

Deny Contr Users

Tuesdays1700 -2300

CPF N65

Mon & Thurs0800 -1300

CPF N65T

TST

T

T

CONTR

CONTR

CPF N6T

COMNAVREGT

COMSUBPACT

Mon & Thurs0800 -1300

DoD

•Resource roles•Allow & Deny profiles•Exact and subtree conditions•Time constraints

"The United States Government has certain intellectual property rights in the Enterprise Dynamic Access Control software.  This intellectual property is available for licensing for commercial purposes.  Licensing and technical inquiries should be directed to the Office of Patent Counsel, Space and Naval Warfare Systems Center, San Diego, Code

20012, San Diego, CA, 92152; telephone (619) 553-3001, facsimile (619) 553-3821.  Reference Navy Case Numbers 96217, 97188, 97189."

EDAC – Resource profiles

"The United States Government has certain intellectual property rights in the Enterprise Dynamic Access Control software.  This intellectual property is available for licensing for commercial purposes.  Licensing and technical inquiries should be directed to the Office of Patent Counsel, Space and Naval Warfare Systems Center, San Diego, Code

20012, San Diego, CA, 92152; telephone (619) 553-3001, facsimile (619) 553-3821.  Reference Navy Case Numbers 96217, 97188, 97189."

ACME Corporation

Finance

Accounting

Payroll

Marketing

Surveyors

Advertising

Operations

Assembly Line

Parts

Maintenance

Sales

Pre-sales

Post-sales

DenyResource

Profile

AllowResource

Profile

EDAC – Security levels

INFOCON A

Guest

CSP Guest

N7

CPFGuest

CNRGuests

User

Admin

CPF N6Users

CPFAdmin

Deny CPFN65 Admin

T

Deny ContrUsers

T

T

T

T T

TT

INFOCON B

Guest

CSP Guest

N7

CPFGuest

CNRGuests

User

Admin

CPF N6Users

CPFAdmin

Deny CPFN65 Admin

T

Deny ContrUsers

T

T

T

T T

TT

INFOCON C

Guest

CSP Guest

N7

CPFGuest

CNRGuests

User

Admin

CPF N6Users

CPFAdmin

Deny CPFN65 Admin

T

Deny ContrUsers

T

T

T

T T

TT

INFOCON D

Guest

CSP Guest

N7

CPFGuest

CNRGuests

User

Admin

CPF N6Users

CPFAdmin

Deny CPFN65 Admin

T

Deny ContrUsers

T

T

T

T T

TT

INFOCON A

Guest

CSP Guest

N7

CPFGuest

CNRGuests

User

Admin

CPF N6Users

CPFAdmin

Deny CPFN65 Admin

T

Deny ContrUsers

T

T

T

T T

TT

INFOCON B

Guest

CSP Guest

N7

CPFGuest

CNRGuests

User

Admin

CPF N6Users

CPFAdmin

Deny CPFN65 Admin

T

Deny ContrUsers

T

T

T

T T

TT

INFOCON C

Guest

CSP Guest

N7

CPFGuest

CNRGuests

User

Admin

CPF N6Users

CPFAdmin

Deny CPFN65 Admin

T

Deny ContrUsers

T

T

T

T T

TT

INFOCON D

Guest

CSP Guest

N7

CPFGuest

CNRGuests

User

Admin

CPF N6Users

CPFAdmin

Deny CPFN65 Admin

T

Deny ContrUsers

T

T

T

T T

TT

During INFOCON B During INFOCON C

•Pre-configure conditions under each security level.•RBAC Rules Engine evaluates only conditions for prevailing security level.

"The United States Government has certain intellectual property rights in the Enterprise Dynamic Access Control software.  This intellectual property is available for licensing for commercial purposes.  Licensing and technical inquiries should be directed to the Office of Patent Counsel, Space and Naval Warfare Systems Center, San Diego, Code

20012, San Diego, CA, 92152; telephone (619) 553-3001, facsimile (619) 553-3821.  Reference Navy Case Numbers 96217, 97188, 97189."

"The United States Government has certain intellectual property rights in the Enterprise Dynamic Access Control software.  This intellectual property is available for licensing for commercial purposes.  Licensing and technical inquiries should be directed to the Office of Patent Counsel, Space and Naval Warfare Systems Center, San Diego, Code

20012, San Diego, CA, 92152; telephone (619) 553-3001, facsimile (619) 553-3821.  Reference Navy Case Numbers 96217, 97188, 97189."

EDAC – Model

EDAC standard initiative:

•Interchangeable modular access control components•Minimum salient features•Protocol between components•Standard tie-ins between customer assets and access control system

EDAC - Model

"The United States Government has certain intellectual property rights in the Enterprise Dynamic Access Control software.  This intellectual property is available for licensing for commercial purposes.  Licensing and technical inquiries should be directed to the Office of Patent Counsel, Space and Naval Warfare Systems Center, San Diego, Code

20012, San Diego, CA, 92152; telephone (619) 553-3001, facsimile (619) 553-3821.  Reference Navy Case Numbers 96217, 97188, 97189."

RepositoryService

Enterprise DynamicAccess Control (EDAC)

AdministrativeService

A1

Customer furnished andmaintained assets

EDAC Process(A) Administrative Service -establishes resourcecontainers, CMD referrals,RM accounts.

EDAC - Model

"The United States Government has certain intellectual property rights in the Enterprise Dynamic Access Control software.  This intellectual property is available for licensing for commercial purposes.  Licensing and technical inquiries should be directed to the Office of Patent Counsel, Space and Naval Warfare Systems Center, San Diego, Code

20012, San Diego, CA, 92152; telephone (619) 553-3001, facsimile (619) 553-3821.  Reference Navy Case Numbers 96217, 97188, 97189."

ConditionManagerService

CustomerMeta-

Database(CMD)

RepositoryService

AdministrativeService

Enterprise DynamicAccess Control (EDAC)

B2

A1

B1

Customer furnishedand maintained assets

EDAC Process(B) Condition managerService - Establishesand edits conditions toaccess resources.

EDAC - Model

"The United States Government has certain intellectual property rights in the Enterprise Dynamic Access Control software.  This intellectual property is available for licensing for commercial purposes.  Licensing and technical inquiries should be directed to the Office of Patent Counsel, Space and Naval Warfare Systems Center, San Diego, Code

20012, San Diego, CA, 92152; telephone (619) 553-3001, facsimile (619) 553-3821.  Reference Navy Case Numbers 96217, 97188, 97189."

ConditionManagerService

CustomerMeta-

Database(CMD)

RepositoryService

AdministrativeService

Enterprise DynamicAccess Control (EDAC)

B2

A1

B1

Customer furnishedand maintained assets EDAC Process

(C) Conditiondeprecator Service -listens for CMD contentchanges and flagsunmatched orunreachable conditions.

ConditionDeprecator

Service

C2 C1

EDAC - Model

"The United States Government has certain intellectual property rights in the Enterprise Dynamic Access Control software.  This intellectual property is available for licensing for commercial purposes.  Licensing and technical inquiries should be directed to the Office of Patent Counsel, Space and Naval Warfare Systems Center, San Diego, Code

20012, San Diego, CA, 92152; telephone (619) 553-3001, facsimile (619) 553-3821.  Reference Navy Case Numbers 96217, 97188, 97189."

ConditionManagerService

CustomerMeta-

Database(CMD)

RepositoryService

AdministrativeService

Enterprise DynamicAccess Control (EDAC)

B2

A1

B1

Customer furnishedand maintained assets EDAC Process

(D) CustomerEnvironmental Interface- furnishesenvironmental updates.

C2 C1

EnvironmentalInterface(s)

D1

ConditionDeprecator

Service

EDAC - Model

"The United States Government has certain intellectual property rights in the Enterprise Dynamic Access Control software.  This intellectual property is available for licensing for commercial purposes.  Licensing and technical inquiries should be directed to the Office of Patent Counsel, Space and Naval Warfare Systems Center, San Diego, Code

20012, San Diego, CA, 92152; telephone (619) 553-3001, facsimile (619) 553-3821.  Reference Navy Case Numbers 96217, 97188, 97189."

ConditionManagerService

CustomerMeta-

Database(CMD)

RepositoryService

AdministrativeService

Enterprise DynamicAccess Control (EDAC)

B2

A1

B1

Customer furnishedand maintained assets EDAC Process

(E) Customer Objectprofile manager Service- object characteristiccompilation, selectionand formatting.

C2 C1

EnvironmentalInterface(s)

D1

CustomerPersonnelDatabase

ObjectProfile

ManagerService

E2

E3

E4

RulesEngineService

StructureFormatService

E1

E5

ConditionDeprecator

Service

EDAC - Model

"The United States Government has certain intellectual property rights in the Enterprise Dynamic Access Control software.  This intellectual property is available for licensing for commercial purposes.  Licensing and technical inquiries should be directed to the Office of Patent Counsel, Space and Naval Warfare Systems Center, San Diego, Code

20012, San Diego, CA, 92152; telephone (619) 553-3001, facsimile (619) 553-3821.  Reference Navy Case Numbers 96217, 97188, 97189."

ConditionManagerService

CustomerMeta-

Database(CMD)

RepositoryService

AdministrativeService

Enterprise DynamicAccess Control (EDAC)

B2

A1

B1

Customer furnishedand maintained assets EDAC Process

(F) Rules EngineService - evaluatesobject and conditions todetermine objectresource access.

C2 C1

EnvironmentalInterface(s)

D1

CustomerPersonnelDatabase

ObjectProfile

ManagerService

E2

E3

E4

RulesEngineService

StructureFormatService

E1

E5

CustomerPortal

CustomerResources

(Applications)

F1

F2

F3

ConditionDeprecator

Service

"The United States Government has certain intellectual property rights in the Enterprise Dynamic Access Control software.  This intellectual property is available for licensing for commercial purposes.  Licensing and technical inquiries should be directed to the Office of Patent Counsel, Space and Naval Warfare Systems Center, San Diego, Code

20012, San Diego, CA, 92152; telephone (619) 553-3001, facsimile (619) 553-3821.  Reference Navy Case Numbers 96217, 97188, 97189."

EDAC – Interoperability

EDAC interoperable among regions:

•Set conditional access for remote users•Domain customer meta-databases

EDAC - Interoperability

Pearl Harbor: resource profile created for local resource access.

PearlHarbor

customermeta-

database

ConditionManagerInterface

Enterprise

customermeta-

database

Resource Profile CPFCPF N651Top SecretGS12

Pearl Harbor DoD

"The United States Government has certain intellectual property rights in the Enterprise Dynamic Access Control software.  This intellectual property is available for licensing for commercial purposes.  Licensing and technical inquiries should be directed to the Office of Patent Counsel, Space and Naval Warfare Systems Center, San Diego, Code

20012, San Diego, CA, 92152; telephone (619) 553-3001, facsimile (619) 553-3821.  Reference Navy Case Numbers 96217, 97188, 97189."

EDAC - InteroperabilityPearl Harbor: local user profile is generated to access a local resource.

PearlHarbor

customermeta-

database

Condition SettingInterface

Enterprise

customermeta-

database

Resource Profile CPFCPF N651Top SecretGS12

CPF User ProfileCPF N651Top SecretGS12Program Manager

Pearl Harbor DoD

"The United States Government has certain intellectual property rights in the Enterprise Dynamic Access Control software.  This intellectual property is available for licensing for commercial purposes.  Licensing and technical inquiries should be directed to the Office of Patent Counsel, Space and Naval Warfare Systems Center, San Diego, Code

20012, San Diego, CA, 92152; telephone (619) 553-3001, facsimile (619) 553-3821.  Reference Navy Case Numbers 96217, 97188, 97189."

EDAC - Interoperability

Pearl Harbor: user and resource profiles are evaluated by rules engine to determine local resource access.

PearlHarbor

customermeta-

database

Condition SettingInterface

Enterprise

customermeta-

database

Resource Profile CPFCPF N651Top SecretGS12

PearlHarborRBAC

PearlHarbor

Customerresources

CPF User ProfileCPF N651Top SecretGS12Program Manager

Pearl Harbor DoD

"The United States Government has certain intellectual property rights in the Enterprise Dynamic Access Control software.  This intellectual property is available for licensing for commercial purposes.  Licensing and technical inquiries should be directed to the Office of Patent Counsel, Space and Naval Warfare Systems Center, San Diego, Code

20012, San Diego, CA, 92152; telephone (619) 553-3001, facsimile (619) 553-3821.  Reference Navy Case Numbers 96217, 97188, 97189."

EDAC - Interoperability

Pearl Harbor: A resource profile to allow remote users access to local resources.

SanDiego

customermeta-

database

ConditionManagerInterface

Enterprise

customermeta-

database

Resource Profile SDSD N651Top SecretGS12

Pearl Harbor San DiegoDoD

"The United States Government has certain intellectual property rights in the Enterprise Dynamic Access Control software.  This intellectual property is available for licensing for commercial purposes.  Licensing and technical inquiries should be directed to the Office of Patent Counsel, Space and Naval Warfare Systems Center, San Diego, Code

20012, San Diego, CA, 92152; telephone (619) 553-3001, facsimile (619) 553-3821.  Reference Navy Case Numbers 96217, 97188, 97189."

EDAC - Interoperability

San Diego: user profile generated.

SanDiego

customermeta-

database

ConditionManagerInterface

Enterprise

customermeta-

database

Resource Profile SDSD N651Top SecretGS12

Pearl Harbor San DiegoDoD

SD User ProfileSD N651Top SecretGS12Developer

"The United States Government has certain intellectual property rights in the Enterprise Dynamic Access Control software.  This intellectual property is available for licensing for commercial purposes.  Licensing and technical inquiries should be directed to the Office of Patent Counsel, Space and Naval Warfare Systems Center, San Diego, Code

20012, San Diego, CA, 92152; telephone (619) 553-3001, facsimile (619) 553-3821.  Reference Navy Case Numbers 96217, 97188, 97189."

EDAC - InteroperabilityPearl Harbor: San Diego user evaluated for Pearl Harbor resource access.

SanDiego

customermeta-

database

ConditionManagerInterface

Enterprise

customermeta-

database

Resource Profile SDSD N651Top SecretGS12

PearlHarborRBAC

PearlHarbor

Customerresources

SD User ProfileSD N651Top SecretGS12Developer

Pearl Harbor San DiegoDoD

"The United States Government has certain intellectual property rights in the Enterprise Dynamic Access Control software.  This intellectual property is available for licensing for commercial purposes.  Licensing and technical inquiries should be directed to the Office of Patent Counsel, Space and Naval Warfare Systems Center, San Diego, Code

20012, San Diego, CA, 92152; telephone (619) 553-3001, facsimile (619) 553-3821.  Reference Navy Case Numbers 96217, 97188, 97189."

EDAC - Interoperability

San Diego: same user evaluated for San Diego resource access.

SanDiego

customermeta-

database

ConditionManagerInterface

Enterprise

customermeta-

database

SD User ProfileSD N651Top SecretGS12Developer

San Diego

Resource Profile SDSD N651Top SecretGS12

San DiegoRBAC

SanDiego

Customerresources

DoD

"The United States Government has certain intellectual property rights in the Enterprise Dynamic Access Control software.  This intellectual property is available for licensing for commercial purposes.  Licensing and technical inquiries should be directed to the Office of Patent Counsel, Space and Naval Warfare Systems Center, San Diego, Code

20012, San Diego, CA, 92152; telephone (619) 553-3001, facsimile (619) 553-3821.  Reference Navy Case Numbers 96217, 97188, 97189."

EDAC – Interoperability

"The United States Government has certain intellectual property rights in the Enterprise Dynamic Access Control software.  This intellectual property is available for licensing for commercial purposes.  Licensing and technical inquiries should be directed to the Office of Patent Counsel, Space and Naval Warfare Systems Center, San Diego, Code 20012, San Diego, CA, 92152;

telephone (619) 553-3001, facsimile (619) 553-3821.  Reference Navy Case Numbers 96217, 97188, 97189."

SanDiego

customermeta-

database

PearlHarbor

customermeta-

database

Condition SettingInterface

Condition SettingInterface

Enterprise

customermeta-

database

Resource Profile CPFCPF N651Top SecretGS12

Resource Profile SDSD N651Top SecretGS12

PearlHarborRBAC

Pearl Harbor

Customerresources

CPF User ProfileCPF N651Top SecretGS12Program Manager

SD User ProfileSD N651Top SecretGS12Developer

Pearl Harbor San Diego

Resource Profile CPFCPF N651Top SecretGS12

Resource Profile SDSD N651Top SecretGS12

San DiegoRBAC

SanDiego

Customerresources

DoD

"The United States Government has certain intellectual property rights in the Enterprise Dynamic Access Control software.  This intellectual property is available for licensing for commercial purposes.  Licensing and technical inquiries should be

directed to the Office of Patent Counsel, Space and Naval Warfare Systems Center, San Diego, Code 20012, San Diego, CA, 92152; telephone (619) 553-3001,

facsimile (619) 553-3821.  Reference Navy Case Numbers 96217, 97188, 97189."

San Diego, CA 92152-5001

Approved for public release; distribution is unlimited.