Agent-based access control framework for enterprise content management

Abstract

Telework is an important alternative to work that seeks to enhance employees’ safety and well-being while reducing the company costs. Employees can work anytime, any where and under high mobility conditions using new devices. Therefore, the access control of remote exchanges of Enterprise Content Management systems (ECM) have to take into consideration the diversity of users’ devices and context conditions in a telework open network. Different access control models were proposed in the literature to deal with the dynamic nature of users’ context and devices. However, most access control models rely on a centralized management of permissions by an authorization entity which can reduce its performance with the increase of number of users and requests in an open network. Moreover, they often depend on the administrator’s intervention to add new devices’ authorization and to set permissions on resources. In this paper, we suggest a distributed management of access control for telework open networks that focuses on an agent-based access control framework. The framework uses a multi-level rule engine to dynamically generate policies. We conducted a usability test and an experiment to evaluate the security performance of the proposed framework. The result of the experiment shows that the ability to resist deny of service attacks over time increased in the proposed distributed access control management compared with the centralized approach.