Decision-cache based XACML authorisation and anonymisation for XML documents

Ulltveit-Moe, Nils; Oleshchuk, Vladimir

doi:10.1016/j.csi.2011.10.007

Cited by 13 publications

(5 citation statements)

References 14 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We have had previous experience that this behaviour may be due to limitations with the XML DOM parser, which may cause heavy garbage collection patterns for large DOM trees. One way to mitigate this problem is to use a different XML parser in GeoXACML, for example, virtual token descriptor VTD‐XML , which uses a VTD data structure in order to avoid expanding the entire XML tree as DOM objects . However, implementing such a solution would be a major job, because VTD‐XML does not support the standard XML DOM parsing interface.…”

Section: Methodsmentioning

confidence: 99%

Enforcing mobile security with location-aware role-based access control

Ulltveit-Moe

Oleshchuk

2013

Security Comm. Networks

Self Cite

View full text Add to dashboard Cite

This paper describes how location-aware role-based access control (RBAC) can be implemented on top of the Geospatial eXtensible Access Control Markup Language (GeoXACML). It furthermore sketches how spatial separation of duty constraints (both static and dynamic) can be implemented using GeoXACML on top of the XACML RBAC profile. The solution uses physical addressing of geographical locations, which facilitates easy deployment of authorisation profiles to the mobile device. Location-aware RBAC can be used to implement location-dependent access control and also other security enhancing solutions on mobile devices, such as location-dependent device locking, firewall, intrusion prevention or payment anti-fraud systems. The system has been implemented and tested, both to verify the server capacity and also the client capacity running on a mobile device.

show abstract

Section: Methodsmentioning

confidence: 99%

Enforcing mobile security with location-aware role-based access control

Ulltveit-Moe

Oleshchuk

2013

Security Comm. Networks

Self Cite

View full text Add to dashboard Cite

show abstract

“…The solution is based on existing standards like XML, IDMEF, XACML, XML-Encryption and XML-Signature, and uses a proxy-based reversible anonymiser based on an earlier proposed XACML decision cache for authorisation and anonymisation of XML documents [23]. The solution furthermore supports location-based anonymisation policies via the GeoXACML framework [1].…”

Section: Discussionmentioning

confidence: 99%

“…The software is implemented in Jython and based on the XACML Decision-cache based anonymiser in [23], which uses SunXACML with a Java HashMap based Least Recently Used cache and virtual token descriptor based XML parser VTD-XML for increased XPath performance. The solution in this paper has been extended with the GeoX-ACML patches [1], to support more advanced XACML data types like pointlists which are used by the implementation.…”

Section: Methodsmentioning

confidence: 99%

“…The reversible anonymisation scheme is implemented as an extension of the anonymising decision cache proposed in [23].…”

Section: Reversible Anonymisation Schemementioning

confidence: 99%

“…It extends the eXtensible Access Control Markup Language (XACML) based decision cache and anonymiser for XML documents, proposed in [23], with support for reversible anonymisation of private or condential information based on broadcast encryption. An advantage compared to the original approach, is that it supports multi-level privacy for condential content in the XML messages, so that only authorised parties can access this information.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

A novel policy-driven reversible anonymisation scheme for XML-based services

Ulltveit-Moe

Oleshchuk

2015

Information Systems

Self Cite

View full text Add to dashboard Cite

This paper proposes a reversible anonymisation scheme for XML messages that supports ne-grained enforcement of XACML-based privacy policies. Reversible anonymisation means that information in XML messages is anonymised, however the information required to reverse the anonymisation is cryptographically protected in the messages. The policy can control access down to octet ranges of individual elements or attributes in XML messages. The reversible anonymisation protocol eectively implements a multi-level privacy and security based approach, so that only authoried stakeholders can disclose condential information up to the privacy or security level they are authorised for. The approach furthermore supports a shared secret based scheme, where stakeholders need to agree to disclose condential information. Last, it supports time limited access to private or condential information. This opens up for improved control of access to private or condential information in XML messages used by a service oriented architecture. The solution provides horizontally scalable condentiality protection for certain types of big data applications, like XML databases, secure logging and data retention repositories.

show abstract