ACCESS-CONTROL AND SECURITY FOR A DISTRIBUTED CONTROL-SYSTEM

The control system of the European Synchrotron Radiation Facility (ESRF) is object-oriented and distributed. Device access is based on the client-server model. To protect sensitive hardware devices an access control and security system has been added. This offers users read, write, super-user or single-user access to hardware objects, families or even whole areas of the facility. A memory-based security database, accessed by an internal control system service, combines device names, access rights, user IDs, group IDs and host/network addresses. Access rights must be requested al connection time and are guaranteed by a fast access key mechanism. The paper describes the design and discusses the needs for the implemented access rights and protection possibilities.