An Xml-based Policy Model For Access Control In Web Applications

Organizational Information Systems (IS) collect, store, and manage personal and business data. Due to regulation laws and to protect the privacy of users, clients, and business partners, these data must be kept private. This paper proposes a model and a mechanism that allows defining access control policies based on the user profile, the time period, the mode and the location from where data can be accessed. The proposed policy model is simple enough to be used by a business manager, yet it has the flexibility to define complex restrictions. At runtime, a protection layer monitors data accesses and enforces existing policies. A prototype tool was implemented to run an experimental evaluation, which showed that the tool is able to enforce access control with minimal performance impact, while assuring scalability both in terms of the number of users and the number of policies. © 2013 Springer-Verlag.8056 LNCSPART 2274288Bertino, E., Lin, D., Jiang, W., A Survey of Quantification of Privacy Preserving Data Mining Algorithms (2008) Privacy-Preserving Data Mining, 34, pp. 183-205. , Aggarwal, C.C., Yu, P.S., Elmagarmid, A.K. (eds.) Springer, UShttp://www.ietf.org/, accessed: September 07, 2012Bertino, E., Ghinita, G., Kamra, A., (2011) Access Control for Databases: Concepts and Systems, , Now Publishers IncSandhu, R.S., Role-based Access Control (1998) Advances in Computers, 46, pp. 237-286. , ElsevierNi, Q., Bertino, E., Lobo, J., Calo, S.B., Privacy-Aware Role-Based Access Control (2009) IEEE Security Privacy, 7 (4), pp. 35-43OASIS EXtensible Access Control Markup Language (XACML) TC | OASIS, , https://www.oasis-open.org/committees/tc_home.php?wg_abbrev=xacml, accessed: September 07, 2012Masi, M., Pugliese, R., Tiezzi, F., Formalisation and Implementation of the XACML Access Control Mechanism (2012) LNCS, 7159, pp. 60-74. , Barthe, G., Livshits, B., Scandariato, R. (eds.) ESSoS 2012. Springer, HeidelbergBernard Stepien, S.M., (2011) Advantages of a Non-Technical XACML Notation in Role-Based Models, pp. 193-200Samarati, P., De, S., Di Vimercati, C., Access Control: Policies, Models, and Mechanisms (2001) Foundations of Security Analysis and Design (Tutorial Lectures), pp. 137-196Bernard Stepien, S.M., (2011) Advantages of a Non-Technical XACML Notation in Role-Based Models, pp. 193-200Turkmen, F., Crispo, B., Performance evaluation of XACML PDP implementations (2008) Proceedings of the 2008 ACM Workshop on Secure Web Services, New York, NY, USA, pp. 37-44Michael Butler, J., Extending Role Based Access Control - A SANS Whitepaper, , http://www.sans.org/reading_room/analysts_program/access-control-foxt.pdf, accessed: February15, 2013P3P: The Platform for Privacy Preferences, , http://www.w3.org/P3P/, accessed: September 04, 2012Byun, J.-W., Li, N., Purpose based access control for privacy protection in relational database systems (2008) The VLDB Journal, 17 (4), pp. 603-619Agrawal, R., Bird, P., Grandison, T., Kiernan, J., Logan, S., Rjaibi, W., Extending Relational Database Systems to Automatically Enforce Privacy Policies (2005) Proceedings of the 21st International Conference on Data Engineering, Washington, DC, USA, pp. 1013-1022Agrawal, R., Kiernan, J., Srikant, R., Xu, Y., Hippocratic databases 28th Int'l Conference on Very Large Databases, Hong Kong (2002)Sandhu, R.S., Coyne, E.J., Feinstein, H.L., Youman, C.E., Role-based access control models (1996) Computer, 29 (2), pp. 38-47Arora, S., Song, E., Kim, Y., Modified hierarchical privacy-aware role based access control model (2012) Proceedings of the 2012 ACM Research in Applied Computation Symposium, New York, NY, USA, pp. 344-347Ni, Q., Bertino, E., (2007) Conditional Privacy-Aware Role Based Access Control, , Springer, HeidelbergBeznosov, K., Requirements for access control: US Healthcare domain Proceedings of the Third ACM Workshop on Role-Based Access Control, New York, NY, USA (1998)Bertino, E., Carminati, B., Ferrari, E., Access control for XML documents and data (2004) Inf. Secur. Tech. Rep., 9 (3), pp. 19-34. , JulyLu, Y., Zhang, L., Sun, J., Task-activity based access control for process collaboration environments (2009) Comput. Ind., 60 (6), pp. 403-415Tolone, W., Ahn, G.-J., Pai, T., Hong, S.-P., Access control in collaborative systems (2005) ACM Comput. Surv., 37 (1), pp. 29-41De Capitani Di Vimercati, S., Samarati, P., Jajodia, S., Policies, models, and languages for access control (2005) Databases in Networked Information Systems, pp. 225-237Regina Lúcia de Oliveira Moraes, , http://www.ft.unicamp.br/~regina/Gerais/Request-database-administrator- detailed.pdf, Accessed: April 9, 2013Sybase XML Modeling PowerDesigner®, , http://wwwdownload.sybase.com/pdfdocs/pdd1100e/xmug.pdf, 15.3, accessed: April 09, 2013Zhu, H., Lü, K., Fine-grained access control for database management systems (2007) Proceedings of the 24th British National Conference on Databases, Berlin, Heidelberg, pp. 215-223Role-Based Access Control a Position Statement, , http://profsandhu.com/misc_pubs/nist/n94rbac.pdf, accessed: January 29, 2013Miseldine, P.L., Automated XACML Policy Reconfiguration for Evaluation Otimisation (2008) Proceedings of the Fourth International Workshop on Software Engineering for Secure Systems (SESS 2008), pp. 1-8. , ACM, New Yorkhttp://www.tpc.org/tpcw/, accessed: January 08, 2013Hardware and Software, Engineered to Work Together, , http://www.oracle.com/index.html, accessed: January 29, 2013Apache JMeter - Apache JMeter™, , http://jmeter.apache.org/, accessed: January 09, 201