Access rights in T2S. 07 May Rudi Verschaeren

Transcription

1 07 May 2015 Rudi Verschaeren

2 Basics T2S user function: all the possible actions a user can trigger in: A2a mode via XML messages U2a mode via the T2S GUI Privilege: the capability to trigger one or several T2S user functions Basic element to assign access rights to a user A user can only trigger a T2S function if the privilege to do so was previously granted - e.g. initiate a liquidity transfer Distinction between System privilege: no dynamic data involved e.g. query on the current phase of the settlement day Object privilege: applicable on specific static or dynamic data object e.g. right to display postings on a DCA User also needs access to the specific secured object e.g. right to view postings on a specific DCA 2 / 14

3 Basics Role: a set of privileges Created by T2S operator or by system entity Possibility to grant multiple privileges at the same time T2S hierarchical party model - default data scope Level1: T2S operator Visibility on all static and dynamic data Can act on behalf level2 and level3 Level2: CSDs and Central Banks Visibility on static and dynamic data of its system entity Can act on behalf and level3 Defined by set of BIC11 : TRGTXE2SXXX.NBBEBEBB203 Level3: payment banks and CSD clients Visibility on static and dynamic data objects linked to this party Defined by set of BIC11 : NBBEBEBB203.ABCDBEBBXXX 3 / 14

4 Basics Distinguished name: Name used to connect to T2S: Structure depends on the definition of the VAN provider: SIA Colt : DNQ=999 + SURNAME=ABCD + GIVENNAME=EFGHIJ + CN=ABCDEFGHIJ+ SERIALNUMBER=IT:RBNMNL99A09H901X, O=Banca d'italia/ , C=IT SWIFT: CN=gg1user, OU=t2stest, OU=snlid31652, O=nbbebebb, O=swift To be defined by the local VAN security officer Certificate distinguished name: (defined at VAN level) Distinguished name with a valid Public key Private key stored on a USB token 4 / 14

5 Basics User: individual or application that interacts with T2S Defined by a system user reference (SUR) Must be linked to a certificate in the T2S static data Administrator user: Owns privileges/roles granted to the party Able to create new users that by default will be linked to the same party Can grant privileges/roles to each of his individual users Granting of roles/privileges to payment bank is a two step approach: By CB to a party By administrator user of the payment bank to a user 5 / 14

6 Create payment bank - CB tasks Central Banks to create Party Payment Bank Pre-defined roles that are granted to the party in two or four eyes as requested by the payment bank via form eyes example: 6 / 14

7 Create payment bank - CB tasks Create the administrator user of this party that is granted the basic access rights administrator role in two eyes mode form 7200 Link this administrator user to a distinguished name (certificate) form 7200 Feed the T2S static data with all other relevant information provided by the payment bank via the registration forms DCA s; primary CMB, 7 / 14

8 Payment bank administrator user tasks Grant to himself in order to create users: reading role in two eyes acces rights admin advanced role in two or four eyes 8 / 14

9 Payment bank administrator user tasks Create the users of the PB Add the distinguished name to be used by this user to the list of certificates in T2S 9 / 14

10 Payment bank administrator user tasks Link the certificate to the user Grant the user the roles needed Liquidity manager 10 / 14

11 Payment bank user - example Based on the granted roles, GEBA PB user 01 has access to following cash functionalities 11 / 14

12 Payment bank user - example The same user will not be able to grant/revoke privileges /roles Access to the users is limited to visibility: no option to create new users 12 / 14

13 Roles to be granted to normal users 13 / 14

14 Miscellaneous All privileges included in a role can be granted on an individual basis by the administrator user Modifications to T2S access are Managed within the system Valid as from the next login Not managed at the level of the VAN provider The basic access rights are granted to the payment bank administrator user in 2 eyes mode by default Change request proposed by Bundesbank (not for wave1) 4 eyes workaround currently possible Default data scope can be reduced/extended by the owner of the object One step approach: receiver owns the privilege Two step approach : receiver must first be granted privilege 14 / 14