An Attribute-Based Access Control Model for Web Services

Shen, Haibo; Fan, Hong

doi:10.1109/pdcat.2006.28

Cited by 95 publications

(32 citation statements)

References 9 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The determination of the attributes is performed according to the topics. As the attributes are related to the information entered, they can be grouped into the following three categories: subject attributes (such as personal information), Resource attributes (information about the outcomes), and environment attributes (information about the environment) [41]. In this manner, the complexities that are rising in the growing and complicated systems are solved.…”

Section: Attribute Based Access Controlmentioning

confidence: 99%

Survey on Access Control Mechanisms in Cloud Computing

Karataş

Akbulut

2018

JCSM

View full text Add to dashboard Cite

The benefits that Internet-based applications and services have given to the end user with today's cloud computing technology are very remarkable. The distributed services instantly scaled over the Internet provided by cloud computing can be achieved by using some mechanisms in the background. It is a critical task for end users to control access to resources because lack of control often leads to security risks. In addition, this may cause systems to fail. This paper describes seven different access control mechanisms used in cloud computing platforms for different purposes. Besides, the advantages and disadvantages of various models developed from previous service-based architectures and used for cloud computing are detailed and classified. During the assessments, NIST's metrics were taken as a reference, and in the study, 109 articles from the past decade were examined. We also compared our research with the existing survey papers.

show abstract

Section: Attribute Based Access Controlmentioning

confidence: 99%

Survey on Access Control Mechanisms in Cloud Computing

Karataş

Akbulut

2018

JCSM

View full text Add to dashboard Cite

show abstract

“…An authorized requester can invoke a web service only when it possesses the permissions to access the attributes. The model proposed in [11] allows requesters to use PMI (privilege management infrastructure) for managing the checking, retrieval, and revocation of authentication. The model also uses an RBAC-based web service access control policy to determine whether a requester can invoke a web service.…”

Section: Related Workmentioning

confidence: 99%

“…Our research focuses on preventing information leakage during the execution of net services. The prevention can be achieved by information flow control [2][3][4][5][6][7][8][9][10][11][12][13][14][15].…”

Section: Introductionmentioning

confidence: 99%

Controlling Information Flows in Net Services with Low Runtime Overhead

Chou

2015

IJCNIS

View full text Add to dashboard Cite

Abstract-This paper presents the information flow control model NetIFC to prevent information leakage when a net service is being executed. NetIFC offers the following features: (1) it blocks at least statements as possible and (2) it reduces runtime overhead. To achieve the first feature, NetIFC strictly controls output statements because only output may leak information. To achieve the second feature, NetIFC is executed in parallel with a service in different sites to monitor the service. This monitoring style substantially reduce runtime overhead when comparing with embedding a model in a net service.Index Terms-Information flow, information flow control, information security, information leakage prevention, runtime overhead.

show abstract

“…A broad range of access control models have been developed in the last decades, defining access control constraints based on particular security information such as the user's role (RBAC [8]) or the user's team affiliation (TBAC [9]). Since all these pieces of information can be considered as attributes of involved objects, the attribute-based access control model (ABAC) can be seen as the most comprehensive access control model, as described in [10]. Within the borders of one organisation, the organisational role of a subject is often the attribute of choice to perform access control, since it can be understood as "A set of expectations and behaviours associated with a given position in a social system."…”

Section: A Authentication Authorisation Trustmentioning

confidence: 99%

Security Requirements Specification in Service-Oriented Business Process Management

Menzel

Thomas

Meinel

2009

2009 International Conference on Availability, Reliability and Security

View full text Add to dashboard Cite

Abstract-Service-oriented Architectures deliver a flexible infrastructure to allow independently developed software components to communicate in a seamless manner. In the scope of organisational workflows, SOA provides a suitable foundation to execute business processes as an orchestration of multiple independent services. Along with the increased connectivity, the corresponding security risks rise exponentially. However, security requirements are usually defined on a technical level, rather than on an organisational level that would provide a comprehensive view on the participants, the assets and their relationships regarding security.In this paper, we propose an approach to describe security requirements at the business process layer and their translation to concrete security configuration for service-based systems. We introduce security elements for business process modelling which allow to evaluate the trustworthiness of participants based on a rating of enterprise assets and to express security intentions such as confidentiality or integrity on an abstract level.Our aim is to facilitate the generation of security configurations based on the modelled requirements. For this purpose, we foster a model-driven approach: Information at the modelling layer is gathered and translated to a domain-independent security model. Concrete protocols and security mechanisms are resolved based on a security pattern system that is introduced in the course of this paper.

show abstract

An Attribute-Based Access Control Model for Web Services

Cited by 95 publications

References 9 publications

Survey on Access Control Mechanisms in Cloud Computing

Survey on Access Control Mechanisms in Cloud Computing

Controlling Information Flows in Net Services with Low Runtime Overhead

Security Requirements Specification in Service-Oriented Business Process Management

Contact Info

Product

Resources

About