Requirements for Message Access Control
draft-freeman-plasma-requirements-08

The information below is for an old version of the document
Document Type Active Internet-Draft (individual)
Authors Trevor Freeman  , Jim Schaad  , Patrick Patterson 
Last updated 2013-10-21
Replaces draft-freeman-message-access-control-req
Stream (None)
Intended RFC status (None)
Formats pdf htmlized (tools) htmlized bibtex
Stream Stream state (No stream defined)
Consensus Boilerplate Unknown
RFC Editor Note (None)
IESG IESG state I-D Exists
Telechat date
Responsible AD (None)
Send notices to (None)
Network Working Group                                         T. Freeman
Internet-Draft                                           Microsoft Corp.
Intended status: Informational                                 J. Schaad
Expires: April 24, 2014                          Soaring Hawk Consulting
                                                            P. Patterson
                                       Carillon Information Security Inc
                                                        October 21, 2013

                Requirements for Message Access Control
                  draft-freeman-plasma-requirements-08

Abstract 

   There are many situations where organizations want to protect
   information with robust access control, either for implementation of
   intellectual property right protections, enforcement of contractual
   confidentiality agreements or because of legal regulations.  The
   Enhanced Security Services (ESS) for S/MIME defines an access control
   mechanism for email which is enforced by the recipient's client after
   decryption of the message. The ESS mechanism therefore is dependent
   on the correct access policy configuration of every recipient's
   client. This mechanism also provides full access to the data to all
   recipients prior to the access control check, which is considered to
   be inadequate for robust access control due to the difficulty in
   demonstrating policy compliance. 

   This document lays out the deficiencies of the current ESS security
   label, and presents requirements for a new model for providing access
   control to messages where the access check is performed prior to
   message content decryption. This new model also does not require
   policy configuration on the client thereby simplifying deployment and
   compliance verification. 

   The proposed model additionally provides a method where non-X.509
   certificate credentials can be used for encryption/decryption of
   S/MIME messages.

   The name Plasma was assigned to this effort as part of the IETF
   process. It is derived from PoLicy enhAnced Secure eMAil.

Status of this Memo

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
 

Freeman, et al.          Expires April 24, 2014                 [Page 1]
Internet-Draft  Requirements for Message Access Control October 21, 2013

   Task Force (IETF).  Note that other groups may also distribute
   working documents as Internet-Drafts.  The list of current Internet-
   Drafts is at http://datatracker.ietf.org/drafts/current/.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   This Internet-Draft will expire on January 20, 2012. 99

Copyright Notice

   Copyright (c) 2013 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (http://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as
   described in the Simplified BSD License.

 

Freeman, et al.          Expires April 24, 2014                 [Page 2]
Internet-Draft  Requirements for Message Access Control October 21, 2013

Table of Contents

   1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . .  4
     1.1  Data Access Control . . . . . . . . . . . . . . . . . . . .  4
     1.2  Encrypted E-Mail Using Web-based Credentials  . . . . . . .  5
     1.3  Vocabulary  . . . . . . . . . . . . . . . . . . . . . . . .  6
     1.4 Keywords . . . . . . . . . . . . . . . . . . . . . . . . . . 11
   2 Background . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
     2.1.  ESS Security Labels  . . . . . . . . . . . . . . . . . . . 13
     2.2.  Access Control and the Web . . . . . . . . . . . . . . . . 14
     2.3.  Information Asset Protection . . . . . . . . . . . . . . . 17
     2.4.  Authentication Assurance Frameworks  . . . . . . . . . . . 18
     2.5 Electronic Signatures:  Authentication vs. Authorization . . 18
   3.  Use Case Scenarios . . . . . . . . . . . . . . . . . . . . . . 19
     3.1 Consumer to Consumer Secure Email  . . . . . . . . . . . . . 19
     3.2.  Business to Consumer Secure Email  . . . . . . . . . . . . 20
Show full document text