Specification and Enforcement of Dynamic Authorization Policies Oriented by Situations

Abstract

Nowadays, accessing communication networks and systems faces multitude applications with large-scale requirements dimensions. Mobility -roaming services in particular-during urgent situations exacerbate the access control issues. Dynamic authorization then is required. However, traditional access control fails to ensure policies to be dynamic. Instead, we propose to externalize the dynamic behavior management of networks and systems through situations. Situations modularize the policy into groups of rules and orient decisions. Our solution limits policy updates and hence authorization inconsistencies. The authorization system is built upon the XACML architecture coupled with a complex eventprocessing engine to handle the concept of situations. Situationoriented attribute based policies are defined statically allowing static verification and validation.

Dynamic security management driven by situations: An exploratory analysis of logs for the identification of security situations

“…We developed a situation-awareness approach [12,13,14] to deal with such complex security management issues. In this section, we specify this use case scenario as a security situationbased model.…”

A situation-driven framework for dynamic security management

“…To translate this statement in EPL, we specify event startFar in two steps (Figure 8). First, we compute two complex events: i ) MayBeFarEvent meaning either the smartphone (lines 4-5) or the computer (lines 6-7) of the same owner (line 11) moves to another room (line 12) while the current situation is close (lines [13][14][15][16][17], and ii ) MayBeCloseEvent when the smartphone (lines [22][23] or the computer (lines 24-25) moves to a room such that both devices are then in the same room (line 30) and while the current situation is far (lines 31-35). These complex events will be re-injected within the CEP system to compute the beginning of situation far by when an event MayBeFarEvent has been triggered…”

“…However, their approach focuses mainly on the purpose of access only. Finally, we presented a preliminary work in [23] that advocates the necessity of a situation manager and we implemented the Break-the-Glass mechanism [24]. However, our work was limited to the outsourcing deployment mode only.…”

XACML Policy Evaluation with Dynamic Context Handling

“…Dynamic Rule Evaluation. Few researchers have started looking at dynamic policy rule evaluation as opposed to static policies [8], [18]. Among the relatively few researchers who took dynamicity of a context to a higher level by considering dynamicity of a rule is Pallapa et al [30].…”