An advanced policy based authorisation infrastructure

Abstract

The version in the Kent Academic Repository may differ from the final published version. Users are advised to check http://kar.kent.ac.uk for the status of the paper. Users should always cite the published version of record.

A Multi-privacy Policy Enforcement System

“…The first beta version is available for download from the PERMIS web site 1 . This contains the AIPEP, CVS, the Obligations Service, a Master PDP, a policy store and sticky store, and multiple PDPs of different types.…”

“…We have designed a system that will ensure the enforcement of multiple privacy policies within an organisation and throughout a distributed system. The current paper is an enhanced version of [1] and it takes the research one step further. …”

Extracting Access Control and Conflict Resolution Policies from European Data Protection Law

“…This balance of rights is critical and other researches, when designing policy based authorization systems to protect the privacy of personal data, have often overlooked this matter and focused primarily on the policy of the data subject [8,9]. In comparison, we have attempted to support this balance by building multiple policy decision points (PDPs) into the authorization system so that all the stakeholders can express their own independent policies [2]. The system is designed to include access control polices and conflict resolution polices [3] from different authors, possibly written in different policy languages (such as XACMLv2 [12], XACMLv3 [13], PERMIS [14], P3P [15] and so on) and these policies will be enforced in separate PDPs.…”

“…This paper presents the extraction of a legal access control policy and a conflict resolution policy from the EU Data Protection Directive [1]. These policies are installed in a multi-policy authorization infrastructure described in [2,3]. A Legal Policy Decision Point (PDP) is constructed with a legal access control policy to provide automated decisions based on the relevant legal provisions.…”

Dynamic obligation specification and negotiation

“…This is even more problematic in a distributed environment with independent PDP and PEP, such as in SOA or SaaS scenarios. In these kinds of environments distributed evaluation of policies as presented in [6] or [4] will result into merged set of obligations whose interrelation has to be specified. As the deployed PEP and PDP might be under the responsibility of different entities an explicit definition of the supported obligation is required.…”