Yahoo announced Athenz, an open-source platform for fine-grained access control, to the community. Athenz is a Role-Bsed Access Control [RBAC] solution, providing trusted relationships between applications and services deployed within an organization requiring authorized access.

If you need to grant access to a set of resources that your applications or services manage, Athenz provides both a centralized and a decentralized authorization model to do so. Whether you are using container or VM technology independently or on bare metal, you may need a dynamic and scalable authorization solution.

Athenz supports moving workloads from one node to another and gives new compute resources authorization to connect to other services within minutes, as opposed to relying on IP and network ACL solutions that take time to propagate within a large system. Moreover, in very high-scale situations, you may run out of the limited number of network ACL rules that your hardware can support.

Prior to creating Athenz, we had multiple ways of managing permissions and access control across all services within Yahoo. To simplify, we built a fine-grained, role-based authorization solution that would satisfy the feature and performance requirements our products demand. Athenz was built with open source in mind so as to share it with the community and further its development.

At Yahoo, Athenz authorizes the dynamic creation of compute instances and containerized workloads, secures builds and deployment of their artifacts to our Docker registry, and among other uses, manages the data access from our centralized key management system to an authorized application or service.

Athenz provides a REST-based set of APIs modeled in Resource Description Language [RDL] to manage all aspects of the authorization system, and includes Java and Go client libraries to quickly and easily integrate your application with Athenz. It allows product administrators to manage what roles are allowed or denied to their applications or services in a centralized management system through a self-serve UI.

Access Control Models

Athenz provides two authorization access control models based on your applications’ or services’ performance needs. More commonly used, the centralized access control model is ideal for provisioning and configuration needs. In instances where performance is absolutely critical for your applications or services, we provide a unique decentralized access control model that provides on-box enforcement of authorization.  

Athenz’s authorization system utilizes two types of tokens: principal tokens [N-Tokens] and role tokens [Z-Tokens]. The principal token is an identity token that identifies either a user or a service. A service generates its principal token using that service’s private key. Role tokens authorize a given principal to assume some number of roles in a domain for a limited period of time. Like principal tokens, they are signed to prevent tampering. The name ‘Athenz’ is derived from ‘Auth’ and the ‘N’ and ‘Z’ tokens.

Centralized Access Control : The centralized access control model requires any Athenz-enabled application to contact the Athenz Management Service directly to determine if a specific authenticated principal [user and/or service] has been authorized to carry out the given action on the requested resource. A service receives a simple Boolean answer whether or not the request should be processed or rejected. In this model, the Athenz Management Service is the only component that needs to be deployed and managed within your environment. Therefore, it is suitable for provisioning and configuration use cases where the number of requests processed by the server is small and the latency for authorization checks is not important.

The diagram below shows a typical control plane-provisioning request handled by an Athenz-protected service.

Decentralized Access Control : This approach is ideal where the application is required to handle large number of requests per second and latency is a concern. It’s far more efficient to check authorization on the host itself and avoid the synchronous network call to a centralized Athenz Management Service. Athenz provides a way to do this with its decentralized service using a local policy engine library on the local box.

The authorization policies defining which roles have been authorized to carry out specific actions on resources, are asynchronously updated on application hosts and used by the Athenz local policy engine to evaluate the authorization check. In this model, a principal needs to contact the Athenz Token Service first to retrieve an authorization role token for the request and submit that token as part of its request to the Athenz protected service. The same role token can then be re-used for its lifetime.

The diagram below shows a typical decentralized authorization request handled by an Athenz-protected service.

With the power of an RBAC system in which you can choose a model to deploy according your performance latency needs, and the flexibility to choose either or both of the models in a complex environment of hosting platforms or products, it gives you the ability to run your business with agility and scale.

Looking to the Future

Yahoo is actively engaged in pushing the scale and reliability boundaries of Athenz. As Yahoo enhances Athenz, it looks forward to working with the community on the following features:

• Using local CA signed TLS certificates
• Extending Athenz with a generalized model for service providers to launch instances with bootstrapped Athenz service identity TLS certificates
• Integration with public cloud services like AWS. For example, launching an EC2 instance with a configured Athenz service identity or obtaining AWS temporary credentials based on authorization policies defined in ZMS.

Their goal is to integrate Athenz with other open source projects that require authorization support and we welcome contributions from the community to make that happen. It is available under Apache License Version 2.0. To evaluate Athenz, we provide both AWS AMI and Docker images so that you can quickly have a test development environment up and running with ZMS [Athenz Management Service], ZTS [Athenz Token Service], and UI services. For more information, please visit Athenz

Ever since the unprecedented malware named Wannacry wreaked havoc around the globe, IT security experts world-wide are listing-out preventive measures to protect computers from the ransomware attack.

In a most severe malware attack so far, WannaCry is believed to have attacked more than 150 countries and 200,000 systems around the world between Friday to Monday, demanding ransom in crypto currency bitcoin in 28 languages. It has already affected many multi-national companies and Microsoft has also released the patch for windows platform.

Sannttosh S Ahuja, Managing Director of BigMotions Technologies Pvt. Ltd, a leading  website designing company and a subsidiary of Global Ocean Logistics Pvt. Ltd, alerts computer users to read application polices, terms & conditions before they click to ‘Agree’- an imperative step towards securing PCs against virus threats and risking security.

Sannttosh S Ahuja, Managing Director of BigMotions Technologies Pvt. Ltd said

It doesn’t get triggered without clicking on it. A computer is an input and output device, thus nothing enters your system unless permitted to, whether knowingly or unknowingly, either from an external device such as router or Wi-Fi networks or through internal downloads. Therefore, safety of your computer lies in your hands. Without reading what is mentioned, when one agrees to terms & conditions, unwanted crypt can get into your system.

Ignorance among most computer users as the key reason behind the success of such malwares. Technology today is easy; everybody wants to go digitized without concerning about how their safety is getting compromised. Along with learning and using computer, the focus should also be on being safe and securing your privacy on the internet.

Today, an internet user is intimidated with excessive advertising to the extent one feels stalked. Sannttosh urges Indian government to establish a regulatory body to monitor websites. He suggests hosting companies can create policies for websites. Lastly, as a measure against virus threats, he strongly recommends companies to keep their network secure and not to make it public.

Ransomware such as Wanncrypt attacks vulnerable systems and encrypts the data with its own algorithm and to decrypt the data back to its original form it prompts user to pay ransom of USD 300 within 3 days, after which amount doubles to USD 600, however if not paid within 7 days all data is lost and permanently deleted from the device.

A lot of anti-virus companies are working hard to decrypt the files to control the malware as most of the formats it’s affecting is used commonly by the systems like .mpeg, docs, .iso, .JAVA, .jpg, .jpeg, .mp4 and various other extensions.

There is no solution as of now available to this malware however if one is lucky enough and the PC is not attacked yet, experts suggests to install critical updates from windows and install anti-malware on the PC.