Enforcing UCON Policies on the Enterprise Service Bus

Gheorghe, Gabriela; Mori, Paolo; Crispo, Bruno; Martinelli, Fabio

doi:10.1007/978-3-642-16949-6_14

Cited by 6 publications

(9 citation statements)

References 14 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Based on the notions of Authorizations, Obligations and Conditions, UCON offers a unified framework that covers traditional AC models and enhance them to tackle prerequisites within network-connected environment. UCON has been followed by many works, tackling policy definition [11], decentralized systems [12] or existing company mechanisms enforcement [13].…”

Section: Unifying Ac and Tcmentioning

confidence: 99%

See 1 more Smart Citation

Generation of Transmission Control Rules Compliant with Existing Access Control Policies

Bertrand

Blay–Fornarino

Boudaoud

et al. 2015

Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering

View full text Add to dashboard Cite

Abstract. Access Control (AC) is a well known mechanism that allows access restriction to resources. Nevertheless, it does not provide notification when a resource is retransmitted to an unauthorized third party. To overcome this issue, one can use mechanisms such as Data Loss/Leak Prevention (DLP) or Transmission Control (TC). These mechanisms are based on policies that are defined by security experts. Unfortunately, these policies can contradict existing AC rules, leading to security leakage (i.e. a legitimate user is allowed to send a resource to someone who has no access rights in the AC). In this article, we aim at creating TC policies that are compliant with existing AC policies. To do so, we use a mapping mechanism that generates TC rules directly from existing AC policies. Thanks to the generated rules, our solution can make inferences to improve existing AC and enhance security knowledge between infrastructures.

show abstract

Section: Unifying Ac and Tcmentioning

confidence: 99%

“…In order to restrict transmissions in certain cases, we have defined Mapping Rules (MR). A MR can be represented as a function that takes parameters of a sender, actions, receiver and resource and returns a transmission type (13).…”

Section: Generation Mechanismsmentioning

confidence: 99%

Generation of Transmission Control Rules Compliant with Existing Access Control Policies

Bertrand

Blay–Fornarino

Boudaoud

et al. 2015

Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering

View full text Add to dashboard Cite

show abstract

“…The first two, however, do not provide formalized support for cardinality or temporal operators (free text fields exist, but the respective requirements are hard to enforce). UCON supports complex conditions [43], and has been used in applications at different level of abstraction, such as the Java Virtual Machine [44] and the Enterprise Service Bus [45]. Data flow is not considered, however.…”

Section: Related Workmentioning

confidence: 99%

Representation-Independent Data Usage Control

Pretschner

Lovat

Büchler

2012

Data Privacy Management and Autonomous Spontaneus Security

View full text Add to dashboard Cite

Abstract. Usage control is concerned with what happens to data after access has been granted. In the literature, usage control models have been defined on the grounds of events that, somehow, are related to data. In order to better cater to the dimension of data, we extend a usage control model by the explicit distinction between data and representation of data. A data flow model is used to track the flow of data in-between different representations. The usage control model is then extended so that usage control policies can address not just one single representation (e.g., delete file1.txt after thirty days) but rather all representations of the data (e.g., if file1.txt is a copy of file2.txt, also delete file2.txt). We present three proof-of-concept implementations of the model, at the operating system level, at the browser level, and at the X11 level, and also provide an ad-hoc implementation for cross-layer enforcement.

show abstract

“…Gheorghe et al [11] utilise the Message Service Bus of Service-Oriented Architectures (SOA) to enforce business and regulatory usage control policies on messages exchanged between services. Since all messages are placed on the service bus, messages may easily be intercepted and validated for compliance with stated policies.…”

Section: Proactive Enforcementmentioning

confidence: 99%

“…In [11] the introduced round-trip latency said to be around 5000 µm of which the policy decision takes about 22 µm. Although the policy decision time is insignificant compared to the round-trip time, the lack of a neutral benchmark makes it difficult to assess wether the entire round-trip time is acceptable or not.…”

Section: Testing and Evaluationmentioning

confidence: 99%

Usage Control Enforcement - A Survey

Nyre

2011

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Sharing information allows businesses to take advantage of hidden knowledge, improve work processes and cooperation both within and across organisations. Thus there is a need for improved information protection capable of restricting how information is used, as opposed to only accessed. Usage Control has been proposed to achieve this by combining and extending traditional access control, Digital Rights Management and various encryption schemes. Advances in usage control enforcement has received considerable attention from the research community and we therefore believe there is a need to synthesise these efforts to minimise the potential for overlap. This paper surveys the previous efforts on providing usage control enforcement and analyses the general strengths and weaknesses of these approaches. In this paper we demonstrate that there are several promising mechanisms for enforcing usage control, but that reliable empirical evidence is required in order to ensure the appropriateness and usability of the enforcement mechanisms.

show abstract

Enforcing UCON Policies on the Enterprise Service Bus

Cited by 6 publications

References 14 publications

Generation of Transmission Control Rules Compliant with Existing Access Control Policies

Generation of Transmission Control Rules Compliant with Existing Access Control Policies

Representation-Independent Data Usage Control

Usage Control Enforcement - A Survey

Contact Info

Product

Resources

About