A Proposal on Enhancing XACML with Continuous Usage Control Features

Colombo, Maurizio; Lazouski, Aliaksandr; Martinelli, Fabio; Mori, Paolo

doi:10.1007/978-1-4419-6794-7_11

Cited by 34 publications

(32 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The usage control policy was expressed in the U-XACML language [1], [6], which is the extension of the OASIS XACML language [2], that provides specific constructs for usage control. PIP and PDP allocation policies were embedded in the OVF package in the XML format.…”

Section: Methodsmentioning

confidence: 99%

Architecture, Workflows, and Prototype for Stateful Data Usage Control in Cloud

Lazouski¹,

Mancini²,

Martinelli³

et al. 2014

2014 IEEE Security and Privacy Workshops

Self Cite

View full text Add to dashboard Cite

Abstract-This paper deals with the problem of continuous usage control of multiple copies of data objects in distributed systems. This work defines an architecture, a set of workflows, a set of policies and an implementation for the distributed enforcement. The policies, besides including access and usage rules, also specify the parties that will be involved in the decision process. Indeed, the enforcement requires collaboration of several entities because the access decision might be evaluated on one site, enforced on another, and the attributes needed for the policy evaluation might be stored in many distributed locations.

show abstract

Section: Methodsmentioning

confidence: 99%

Architecture, Workflows, and Prototype for Stateful Data Usage Control in Cloud

Lazouski¹,

Mancini²,

Martinelli³

et al. 2014

2014 IEEE Security and Privacy Workshops

Self Cite

View full text Add to dashboard Cite

show abstract

“…Colombo et al [10] extended the XACML and it's proposed OASIS architecture to support UCON's new features. They described possible methods to do periodic checks for handling attribute mutability but did not choose suitable one.…”

Section: Related Workmentioning

confidence: 99%

A Usage Control Based Architecture for Cloud Environments

Tavizi

Shajari

Dodangeh

2012

2012 IEEE 26th International Parallel and Distributed Processing Symposium Workshops &Amp; PhD Forum

View full text Add to dashboard Cite

Today modern computing systems leverage distributed models such as cloud, grid, etc. One of the obstacles of wide spreading these distributed computing models is security challenges which includes access control problem. These computing models because of providing features like on-demand self-service, ubiquitous network access, rapid elasticity and scalability, having dynamic infrastructure and offering measured service, need a powerful and continuous control over access and usage session. Usage control (UCON) model is emerged to cover some drawbacks of traditional access control models with features like attribute mutability and continuity of control. Several recent works have been done to apply UCON for distributed computing environments, but none of them could cover all aspects of the model. In this paper we propose an architecture for applying UCON model in cloud environments. Moreover we present a new architecture for obligation handling. We also introduce a new approach to handle attribute mutability. For implementation we have extended XACML syntax and semantics as policy language and leveraged Sun's OASIS XACML implementation.

show abstract

“…The extensible access control markup (XACML) language is a standard ABAC language [24]. Using the document type definition (DTD) of XACML 3.0, we target our grammar toward the computer architecture, events of interest, and mitigation responses.…”

Section: Policy Detailsmentioning

confidence: 99%

“…Attribute-based access control (ABAC) provides a flexible way to define usage control policy [24][25][26][27][28]. The extensible access control markup (XACML) language is a standard ABAC language [24].…”

Section: Policy Detailsmentioning

confidence: 99%

Integrity Levels: A New Paradigm for Protecting Computing Systems

Jenkins

Pierson

2014

2014 IEEE 13th International Conference on Trust, Security and Privacy in Computing and Communications

View full text Add to dashboard Cite

As the field of determined and increasingly sophisticated adversaries multiplies, the risk to integrity of deployed computing devices magnifies. Given the ubiquitous connectivity, substantial storage, and accessibility, the increased reliance on computer platforms make them a significant target for attackers. Over the past decade, malware has transitioned from attacking a single program to subverting the operating system (OS) kernel by means of what is commonly known as a rootkit. While computer systems require patches to fix newly discovered vulnerabilities, undiscovered vulnerabilities remain. Furthermore, typical solutions utilize mechanisms that operate within the OS. If the OS becomes compromised, these mechanisms may be vulnerable to being disabled or upon detection of the potential compromise, being "shut down" until patched, or otherwise mitigated.We propose an innovative approach to designing computer systems that allows the behavior or functionality of the computer system to change based on the integrity of the system. Instead of attempting to prevent or detect all malware attacks, our proposed approach allows possible graceful degradation of functionality according to the security policy specification as anomalies of security concern are detected. We believe this innovative paradigm can determine the "integrity level" of the system. Based on the integrity level, the computer system may behave differently or limit access to data.

show abstract

A Proposal on Enhancing XACML with Continuous Usage Control Features

Cited by 34 publications

References 10 publications

Architecture, Workflows, and Prototype for Stateful Data Usage Control in Cloud

Architecture, Workflows, and Prototype for Stateful Data Usage Control in Cloud

A Usage Control Based Architecture for Cloud Environments

Integrity Levels: A New Paradigm for Protecting Computing Systems

Contact Info

Product

Resources

About