Xml-based distributed access control system

Abstract. Extensions of the role based access control (RBAC) paradigm have been proposed based in the use of attribute certificates. In order to overcome some of the limitations of RBAC and be able to implement security requirements such as the “originator controlled ” (ORCON) policy, the concept of mobile policy has been recently prop osed. Mobile policies are attached to the data that they control and are enforced by their execution in trusted servers. In this paper we present an extension of this idea that allows the execution of the policies in untrusted systems. We also extend the scheme to allow the policies to be linked to the data but not attached to it. By this modification security administrators are able to change policies dynamically and transparently. Finally, we introduce X-ACS, a XML-based language designed to express policies in a simple and unambiguous way overcoming the limitations of other approaches. Important features of X-ACS are that it allows the automated validation of policies and can be used by processors with limited capacity such as smartcards.