Policy-Carrying, Policy-Enforcing Digital Objects

Abstract. We describe the motivation for moving policy enforcement for access control down to the digital object level. The reasons for this include handling of item-specific behaviors, adapting to evolution of digital objects, and permitting objects to move among repositories and portable devices. We then describe our experiments that integrate the Fedora architecture for digital objects and repositories and the PoET implementation of security automata to effect such objectcentric policy enforcement. 1 From Traditional Access Control to Flexible Policy Enforcement Access control in digital libraries must be scalable, flexible, and extensible – accommodating a wide range of objects and usage scenarios. This stands in contrast to traditional access control models, which are limited to a relatively fixed set of operating system abstractions (e.g., files) and computing actions (e.g., read, write). The limitation of these models has motivated the programming language, operating systems, and security communities to develop alternative and richer methods, including an approach known as language-based security [1]