CBDAC: Context-Based Dynamic Access Control Model Using Intuitive 5W1H for Ubiquitous Sensor Network

Abstract

Currently, access control is facing many issues for information protection in the ubiquitous sensor network (USN) environment. In particular, dynamic access control is a central problem where context always changes because of volatile ubiquitous sensors. The use of context is important in USN. In this paper, we focus on the context-driven privacy protection model. In context-based access control research, the access permission technique that uses context is being intensely investigated because of the ease with which various dynamic access permissions can be assigned in accordance with the various changes in context. A key feature of this approach is dynamic access control. Therefore, we propose a model for privacy preservation that is context-based dynamic access control that uses intuitive 5W1H for USN. According to this model, the access control strategy can be determined dynamically based on context elements and subject attributes, in addition to objects and operations, using access control entities; therefore, it is relatively easy to infer the dynamic access control of context expressivity both accurately and efficiently.

A situation-driven framework for dynamic security management

“…However, this work is limited only to few context features and doesn't provide context abstraction such as our concept of situation. Son et al [19] proposed to express access control policies according to six axes of context: who, when, where, why, what and how. Nonetheless, they don't separate context from the policy and the dynamics is not structured.…”

dynSMAUG: A dynamic security management framework driven by situations

“…The second rule deny authz rule involves three entities: a situation, a resource and an action. It states: when the value of situation class Situation laptop owner is far (line 17) and an authenticated connection on the resource has been performed (line 18) then the authorization decision is deny (line 15) and obligation: send a notification on the smartphone of the owner (line [19][20][21][22][23]. Finally, the last rule allows access (line 28) when the value of situation class Situation laptop owner is close (line 30) and the connection is authenticated (line 31).…”

“…This approach is limited to three context information and doesn't structure the dynamics of the world, contrary to the concept of situation. Finally, Son et al [21] have analyzed deeper the notion of context and propose to express access control policies according to six axes of context: who, when, where, why, what and how. If this work seems close to what we call situation, they don't separate context from the policy and the dynamics is not structured.…”