A Privacy-Enhanced Attribute-Based Access Control System

Abstract

Service-oriented architectures (SOAs) are increasingly gaining popularity due to their considerable flexibility and scalability in open IT-environments. Along with their rising acceptance comes the need for well suited security components. In this respect, access control and privacy emerged to crucial factors. Targeting the demands of a SOA, many promising authorization models have been developed, most notably the attribute-based access control (ABAC) model. In this paper we take up concepts from the OASIS XACML and WS-XACML specifications and introduce a dynamic ABAC system that incorporates privacy preferences of the service requestor in the access control process. Separating the Policy Decision Point from the service provider's premises, our infrastructure enables the deployment of alternative PDPs the service requestor can choose from. We employ a PKI to reflect the sufficient trust relation between the service provider and a potential PDP. Our work is carried out within the European research project Access-eGov that aims at a European-wide e-Government service platform.

A Semantic Security Architecture for Web Services The Access-eGov Solution

“…First ideas and the preliminary overall architecture of our security infrastructure for Access-eGov have already been presented in [4] and [5]. Similar approaches have as well been identified by [22], [23], [24].…”

“…Our semantic security architecture for service-oriented systems based on the attribute-based access control paradigm [3] has already been described in [4], [5], [6] and has now successfully been implemented.…”

Access Control Framework for Social Network System using Ontology

“…Discretionary Access Control (DAC) [5], Mandatory Access Control (MAC) [5], Role-Based Access Control (RBAC) [6,7], Attribute-Based Access Control (ABAC) [8], etc.…”

An Annotation-Based Access Control Model and Tools for Collaborative Information Spaces

“…role-based access control (RBAC) [4,5], attribute-based access control [6], etc. Each approach has its own advantages, disadvantages and feasibility scope.…”