Protecting information over the web is today becoming a primary need. Although many accesscontrolmodels have been so far proposed to address the specific protection requirements of the web environment, no comparable...
详细信息
ISBN:
(纸本)9781595930453
Protecting information over the web is today becoming a primary need. Although many accesscontrolmodels have been so far proposed to address the specific protection requirements of the web environment, no comparable amount of work has been done for finding efficient techniques for performing accesscontrol. We believe that the availability of techniques for speeding-up accesscontrol is a key issue to make an accesscontrol model widely acceptable. this is particularly crucial in an environment such as the web, characterized by thousands of users and thousands of documents. For these reasons, in this paper we propose a technique for speeding-up accesscontrol, which can be applied to credential-based accesscontrolmodels. We propose a data structure that keeps track of the policies that apply to the various portions of a data source, and which does not require the scanning of the policy base for performing accesscontrol. In the paper, besides giving the algorithms for building such data structure and for performing accesscontrol, we present a complexity analysis of the proposed approach, which demonstrates the benefits with respect to traditional methods. Copyright 2005 acm.
Electronic transactions regularly occur between business partners in separate security domains. Trust negotiation is an approach that provides an open authentication and access-control environment for such transaction...
详细信息
ISBN:
(纸本)9781595930453
Electronic transactions regularly occur between business partners in separate security domains. Trust negotiation is an approach that provides an open authentication and access-control environment for such transactions, but it is vulnerable to malicious attacks leading to denial of service or leakage of sensitive information. this paper introduces an Adaptive Trust Negotiation and accesscontrol (ATNAC) framework to solve these problems. the framework combines two existing systems, TrustBuilder and GAA-AP1, to create a system with more flexibility and responsiveness to attack than either system currently provides. Copyright 2005 acm.
We describe a model, independent of any underlying accesscontrol paradigm, for specifying authorization constraints such as separation of duty and cardinality constraints in workflow systems. We present a number of r...
详细信息
ISBN:
(纸本)9781595930453
We describe a model, independent of any underlying accesscontrol paradigm, for specifying authorization constraints such as separation of duty and cardinality constraints in workflow systems. We present a number of results enabling us to simplify the set of authorization constraints. these results form the theoretical foundation for an algorithm that can be used to determine whether a given constrained work-flow can be satisfied: that is. does there exist an assignment of authorized users to workflow tasks that satisfies the authorization constraints? We show that this algorithm can be incorporated into a workflow reference monitor that guarantees that every workflow instance can complete. We derive the computational complexity of our algorithm and compare its performance to comparable work in the literature. Copyright 2005 acm.
We investigate the practical feasibility of using context information for controlling access to services. Based solely on situational context, we show that users can be transparently provided anonymous access to servi...
详细信息
ISBN:
(纸本)9781595930453
We investigate the practical feasibility of using context information for controlling access to services. Based solely on situational context, we show that users can be transparently provided anonymous access to services and that service providers can still impose various security levels. thereto, we propose context-sensitive verification methods that allow checking the user's claimed authenticity in various ways and to various degrees. More precisely, conventional information management approaches are used to compare historic contextual (service usage) data of an individual user or group. the result is a relatively strong, less intrusive and more flexible accesscontrol process that mimics our natural way of authentication and authorization in the physical world. Copyright 2005 acm.
the administration of users and access rights in large enterprises is a complex and challenging task. Role-based accesscontrol (RBAC) is a powerful concept for simplifying accesscontrol. In particular. Enterprise Ro...
详细信息
ISBN:
(纸本)9781595930453
the administration of users and access rights in large enterprises is a complex and challenging task. Role-based accesscontrol (RBAC) is a powerful concept for simplifying accesscontrol. In particular. Enterprise Roles spanning across different IT systems are increasingly used as a basis for company-wide security management. However, the administration of roles in large organisations can become quite cumbersome and needs to be automated. During the past years, rules have been used to support automation of user and access rights administration. We discuss different rule-based approaches and propose a new method called rule-based provisioning of roles which combines the advantages of rules and roles. Experiences made during implementation of this approach are presented in two case studies. the results are evaluated and show that role-based accesscontrol in combination with rule-based provisioning can be successfully used in practice. A high level of automation can be achieved. Copyright 2005 acm.
this work describes the declaration and enforcement of geospatial access restrictions for the infrastructure of heterogenous and distributed geospatial information objects, as they are accessible via the service-orien...
详细信息
ISBN:
(纸本)9781595930453
this work describes the declaration and enforcement of geospatial access restrictions for the infrastructure of heterogenous and distributed geospatial information objects, as they are accessible via the service-oriented geospatial data infrastructure (GDI). Assuming a valid XML markup of the objects and their geometry using the Geographic Markup Language (GML). which is an international standard of the Open GIS Consortium, Inc. (OGC), a solution is introduced that allows the declaration and enforcement of access restrictions, encoded in GeoXacmL. GeoXacmL is a geospatial extension to the OASIS standard extensible accesscontrol Markup Language (XacmL). Due to the nature of the introduced restrictions, the declaration of access restrictions can result in different kinds of inconsistencies. this work describes a mechanism for the detection and classification of contrary permissions. this work also describes a prototype implementation and an illustrating demonstration. Copyright 2005 acm.
Integration of version and accesscontrol of XML documents has the benefit of regulating access to rapidly growing archives of XML documents. Versioned XML documents provide us with valuable informations on dependenci...
详细信息
ISBN:
(纸本)9781595930453
Integration of version and accesscontrol of XML documents has the benefit of regulating access to rapidly growing archives of XML documents. Versioned XML documents provide us with valuable informations on dependencies between document nodes, but at the same time presenting the risk of undesirable data disclosure. In this paper we introduce the notion of relevancy-based accesscontrol, which realizes protection of versioned XML documents by various types of relevancy, such as version dependencies, schema similarities and temporal proximity. We define a new path query language XVerPath over XML document versions, which can be utilized for specifying relevancy-based accesscontrol policies. We also introduce the notion of relevancy class, for collectively and compactly specifying relevancy-based policies. Copyright 2005 acm.
As privacy becomes a major concern for both consumers and enterprises, many research efforts have been devoted to the development, of privacy protecting technology. We recently proposed a privacy preserving access con...
详细信息
ISBN:
(纸本)9781595930453
As privacy becomes a major concern for both consumers and enterprises, many research efforts have been devoted to the development, of privacy protecting technology. We recently proposed a privacy preserving accesscontrol model for relational databases, where purpose information associated with a given data element specifies the intended use of the data element. In this paper, we extend our previous work to handle other advanced data management systems, such as the ones based on XML and the ones based on the object-relational data model. Another contribution of our paper is that we address the problem of how to determine the purpose for which certain data are accessed by a given user. Our proposed solution relics on the well-known RBAC model as well as the notion of conditional role which is based on the notions of role attribute and system attribute. Copyright 2005 acm.
this paper addresses the issues surrounding user-to-user delegation in RBAC. We show how delegations can be incorporated into the RBAC model in a simple and straightforward manner. A special feature of the model is th...
详细信息
ISBN:
(纸本)9781595930453
this paper addresses the issues surrounding user-to-user delegation in RBAC. We show how delegations can be incorporated into the RBAC model in a simple and straightforward manner. A special feature of the model is that it allows fine-grained control over what rights a user wishes to delegate as opposed to delegation at the role level where all the rights of a role must be delegated. In addition, the model provides a rich set of controls regarding further delegations of a right, generic constraints that further control delegations, and an innovative model for revocations. Properties of both delegation and revocation are discussed, and our work is compared with other related research. Copyright 2005 acm.
With continuously growing numbers of applications, enterprises face the problem of efficiently managing the assignment of access permissions to their users. On the one hand, security demands a tight regime on permissi...
详细信息
ISBN:
(纸本)9781595930453
With continuously growing numbers of applications, enterprises face the problem of efficiently managing the assignment of access permissions to their users. On the one hand, security demands a tight regime on permissions;on the other hand, users need permissions to perform their tasks. Role-based accesscontrol (RBAC) has proven to be a solution to this problem but relies on a well-defined set of role definitions, a role concept for the enterprise in question. the definition of a role concept (role engineering) is a difficult task traditionally performed via interviews and workshops. However, often users already have the permissions that they need to do their jobs, and roles can be derived from these permission assignments using data mining technology, thus giving the process of role concept definition a head-start. In this paper, we present the ORCA role mining tool and its algorithm. the algorithm performs a cluster analysis on permission assignments to build a hierarchy of permission clusters and presents the results to the user in graphical form. It allows the user to interactively add expert knowledge to guide the clustering algorithm. the tool provides valuable insights into the permission structures of an enterprise and delivers an initial role hierarchy for the definition of an enterprise role concept using a bottom-up approach. Copyright 2005 acm.
暂无评论