XACML Policies for Exclusive Resource Usage

Abstract

Abstract. The extensible access control markup language (XACML) is the standard access control policy specification language of the World Wide Web. XACML does not provide exclusive accesses to globally resources. We do so by enhancing the policy execution framework with locks.

RBAC Constraints Specification and Enforcement in Extended XACML

“…He also provided the specifications of REA; in this way, XACML become more expressive access control language. [16] extended XACML syntax for supporting exclusive access to resources, and furthermore, add a lock manager to the policy enforcement module in order to enforce Chinese Wall constraints and DSoD. Bertino et al supported RBAC SoD in XACML in [17], but with OWL ontology, keeping user role activation state up-to-date in OWL ontology.…”

Mobile Security with Location-Aware Role-Based Access Control

“…A central lock manager, for example as suggested in [7], will then be required to ensure safe policy checks for concurrent authorisation requests, so that the SSD/DSD constraints ensure that less than a given number of sessions for a given role are active at the same time. This central lock manager needs to be extended to block updates of sessions and their roles by the REA and the Identity Manager during checking of SSD/DSD constraints to avoid race conditions that could violate the constraints.…”

Securing Workflows with XACML, RDF and BPEL

“…In this aspect, our work provides a complete end to end security cover for workflows. Because we use XACML based policies for expressing security requirements, we can utilize earlier extensions like the lock manager enhancements by Dhankhar et al [11] to enforce RBAC-like authorization constraints.…”

“…Dhankhar et al have extended reference XACML implementation [26] with extensions to enforce exclusive use [11] and distributed policy evaluation [12] within a nested transaction tree framework. This paper extends their work to fully distribute evaluation and enforcement of XACML policies.…”

“…In this paper we supply the necessary extensions to V. Atluri current XACML standard and reference implementation to be able to evaluate and enforce XACML policies in a fully-distributed manner. We enhance our previous [11,12] work in achieving this objective in this paper by passing sufficient contextual information between XCAML PDPs and PEPs so that the passed information contain sufficient information to control the distrbuted usage of resources such as flow control ans synhronization. Such techniques can be used in more contemporary workflow languages like BPEL.…”