PAES: Policy-Based Authority Evaluation Scheme

Abstract

Abstract. Enterprise Rights Management (ERM) systems aim to protect disseminated data even after it has been sent to remote locations. Existing systems are based on common components, have similar functionalities and often have two shortcomings: a centralised architecture and a lack of concern for the trust and privacy of data recipients. To access the data, recipients must present their credentials to a policy evaluation authority, which they cannot choose and may not trust. Furthermore, recipients may be unable to access the data if their connection is intermittent or if they are off-line. To address these limitations, we propose PAES: a Policy-based Authority Evaluation Scheme, which combines data protection with a distributed policy evaluation protocol. The result allows us to implement the sticky policies paradigm in combination with trust management techniques. This permits distributing policy evaluation over a flexible set of authorities, simultaneously increasing the resilience of policy enforcement.

A Lifecycle for Data Sharing Agreements: How it Works Out

“…[6] considers policies that restrict the use and replication of information, e.g., imposing that certain information may only be used or copied a certain number of times. Related to the sharing of data, but not strictly related to analysis, [9,20,21] present on opportunistic authority evaluation scheme for sharing data in a secure way in a crisis management scenario. The main idea is to combine two already existing data sharing solutions to share data in a secure way through opportunistic networks.…”

A Formal Support for Collaborative Data Sharing

“…Related to the sharing of data, but not strictly related to analysis, [23,24] present on opportunistic authority evaluation scheme for sharing data in a secure way in a crisis management scenario. The main idea is to combine two already existing data sharing solutions in order to share data in a secure way through opportunistic networks.…”

Secure cross-domain data sharing architecture for crisis management

“…The Policy-based Authority Evaluation Scheme (PAES) [22] allows a data originator to specify a hierarchy of authorities trusted to correctly evaluate its policies. The set of authorities trusted to evaluate the usage control policies is not statically defined, but designated by a trust policy evaluated by a higher level authority.…”

“…The ad hoc distribution of rights in form of private-keys of groups is controlled by policies, inspired by the Policy-based Authority Evaluation Scheme (PAES) [22]. The private keys are always stored by the PEP securely and are not directly accessible to end-users (discussed further in Section 7).…”