Privacy-Aware Access Control and Authorization in Passive Network Monitoring Infrastructures

Security Comm. Networks

et al. 2014

Self Cite

In the modern enterprise world, collaboration has emerged as a standard of best business practice. In order to build competitive advantages and minimize inefficiencies, organizations nowadays pursuit strategic alliances with partners outside the comfort of familiar security zones, loosen their hierarchical structures, exploit “edge” competencies, and aggregate diverse and heterogeneous sources of information. Nevertheless, such techniques dictate the concentration, use, and circulation of corporate information and sensitive personal data and, thus, ignite severe information confidentiality and privacy concerns. Hence, the employment of the appropriate collaboration technology is not sufficient; potential lack of successful protection mechanisms limits the effectiveness of partnerships and denies the respective investments to reach their full potential. In this paper, an authorization framework toward the protection of sensitive resources in the context of cross‐enterprise scenarios is presented. The proposed framework is founded on the utilization of a semantic information model, which integrates individual privacy preferences, organizational access control rules and information handling policies into the authorization determination procedure. Partners within the framework are organized in a bridged federated architecture in order to build a secure communication network, within which semantic and trust interoperability is guaranteed. Copyright © 2014 John Wiley & Sons, Ltd.

Section: Semantic Information Modelmentioning

confidence: 99%

An authorization model for cross-enterprise collaborations

Gogoulos

Antonakopoulou

Security Comm. Networks

et al. 2014

Self Cite

“…Finally, the proposed model draws inspiration from previous works of the authors, notably OrBAC [10][27] [2] and PRISM [16][20] [19]. OrBAC provides a mature framework for managing contextual policies, and several extensions, e.g., for dynamically deploying security policies; PRISM is an access control approach specifically devised for network monitoring, although limited to singleprobe environments.…”

Section: Related Workmentioning

confidence: 99%

A Contextual Privacy-Aware Access Control Model for Network Monitoring Workflows: Work in Progress

Papagiannakopoulou

Koukovini

Foundations and Practice of Security

et al. 2012

Self Cite

Abstract. Network monitoring activities are surrounded by serious privacy implications. The inherent leakage-proneness is harshened due to the increasing complexity of the monitoring procedures and infrastructures, that may include multiple traffic observation points, distributed mitigation mechanisms and even inter-operator cooperation. In this paper, we report a work in progress policy model that aims at addressing these concernes, by verifying access requests from network monitoring workflows, with privacy features already contained since their specification phase. We survey related work, outline some of their limitations, and describe an early version of our proposal.

“…Finally, it should be mentioned that the proposed approach draws inspiration from our previous works, notably OrBAC [38][39] [40] and PRISM [41][42] [2]. OrBAC provides a mature framework for managing contextual policies, and several extensions, e.g., for dynamically deploying security policies [40], whereas a privacy-enhancing version of OrBAC is presented in [43].…”

Section: Related Workmentioning

confidence: 99%

A privacy-aware access control model for distributed network monitoring

Papagiannakopoulou

Koukovini

Computers & Electrical Engineering

et al. 2013

Self Cite

Despite the usefulness of network monitoring for the operation, maintenance, control and protection of communication networks, as well as law enforcement, network monitoring activities are surrounded by serious privacy implications. Their inherent leakage-proneness is harshened due to the increasing complexity of the monitoring procedures and infrastructures, that may include multiple traffic observation points, distributed mitigation mechanisms and even inter-operator cooperation. However, current approaches present limitations in effectively addressing such privacy issues, as they have not been designed for meeting the particular requirements of distributed network monitoring and conceptualising the corresponding functionalities and infrastructures; additionally, they are not suitable for highly dynamic and distributed environments and for automating privacy-awareness. In this paper, we introduce a new access control model that aims at addressing these concerns; it is conceived on the basis of data protection legislation, as well as distributed network monitoring. The proposed approach provides rich expressiveness, captures all the underlying concepts along with their associations and enables the specification of contextual authorisation policies and * Corresponding author.Email address: epapag@icbnet.ntua.gr (Eugenia I. Papagiannakopoulou) ⋆ This is a revised and expanded version of a paper that appeared in the proceedings of the 4th MITACS Workshop on Foundations & Practice of Security, Paris, France, May 2011, pp. 208-217 [44]. Computers & Electrical Engineering 2011 June 7, 2012 expressive separation and binding of duty constraints. Finally, two key innovations of our work consist in the ability to define access control rules in any possible level of abstraction and in enabling a verification procedure which results in inherently privacy-aware workflows, thus minimising run-time reasoning overheads and fostering the realisation of the Privacy by Design vision. Preprint submitted to Elsevier