April 13, 1995

John Lowry
Senior Member of the Technical Staff

Bolt Beranek and Newman, Inc.
70 Fawcett St
Cambridge, MA.  02138  

email: jlowry@bbn.com

(617) 873-2435 Direct
(617) 873-4086 Fax


Project: Location Independent Information Object Security
(IOS)

Bolt Beranek and Newman, Inc. (BBN), under contract to the
Advanced Research Projects Agency (ARPA), has developed the
Information Object Security (IOS) Tools.  These tools use
object identifiers which are registered as Computer Security
Objects.  ARPA has unlimited rights in the software
containing the objects.  BBN specified, created, and named
the objects under contract to ARPA, and remains the primary
point of contact on all questions regarding naming
conflicts.  The NIST Computer Security Objects Register
(CSOR) assumes no responsibility pertaining to any inquiry
regarding ownership or naming conflicts. 

The IOS software is publicly available and can be obtained
on the Internet for anonymous ftp at ests.bbn.com. 

Object naming information
-------------------------

   IOS Access Control Component: 2.16.840.101.3.3.0.1
     
      iosp (3) components (0) accessControlComponent (1)

   id-ios-accessControlComponent


Object definition and description
---------------------------------

The access control component is one of several components
defined by the Location Independent Information Object
Security (IOS) project.  The IOS components are used singly
or in combination with others to achieve a variety of
security services.

This is a syntax that denotes an IOS access control
component.  The access control component is used to specify
an identity-based access control list to an application or
third party provider.

   AccessControlComponent ::= SEQUENCE {
     dataID          DataID,
     referenceID     ReferenceID,
     list            AccessControlList }

   DataID ::= SEQUENCE {
     componentType   OBJECT IDENTIFIER,
     time            GeneralizedTime,
     random          OCTET STRING SIZE (2..2),
     name            EntityName,

   EntityName ::= SEQUENCE {
     formal          Name OPTIONAL,
     informal        OCTET STRING OPTIONAL}

   ReferenceID ::= SEQUENCE OF DataID

   AccessControlList ::= SEQUENCE OF AccessEntities
     
   AccessEntities ::= SEQUENCE {
     name            EntityName,
     period          GenValidity,
     accessType      AccessType TABLE AccessTable,
     permissions     ANY DEFINED BY accessType }

   GenValidity ::= SEQUENCE {
     begin           GeneralizedTime,
     end             GeneralizedTime }

   AccessType ::= ENUMERATED {
     basic       (1) }

   AccessTable ::= TABLE {
     basic   1   AccessPermissions }

   AccessPermissions ::= BIT STRING {
     forbid(0),
     read(1),
     write(2),
     modify(3),
     remove(4) }


Object usage and rules
-----------------------

Access control components contain a DataID with the object
identifier that defines the type of component.  The DataID
provides a unique identification for a component by the
combination of the componentType, time, random, and name
items.  The random element distinguishes among components
created at the same time by the same user, with the
EntityName.  The informal name field is provided for those
users who do not have Names.  Such users must take care to
supply an informal name that they can be certain is unique,
such as an RFC822 address.

The reference ID points to one or more components, typically 
DataComponents, but it can point to any component containing
a matching DataID.  

The Access Control List is a list of sequences containing
the name of the entity or application, the period of time
for which the access permissions are in effect, and a mask
specifying exactly what permission(s) are granted to that
entity.  If the forbid bit in the mask is FALSE, the other
bits grant the indicated permissions, but  if it is TRUE,
the other bits deny the indicated permission.