A practical aspect framework for enforcing fine-grained access control in web applications

Lecture Notes in Computer Science

Volumn 3439, Issue , 2005, Pages 156-167

  Chen, Kung ^a   Huang, Chih Mao ^a  

^a NATIONAL CHENGCHI UNIVERSITY   (Taiwan)

Author keywords

[No Author keywords available]

Indexed keywords

CODES (SYMBOLS); CONTROL SYSTEMS; WORLD WIDE WEB;

ACCESS CONTROL; ASPECT-ORIENTED PROGRAMMING (AOP); CUSTOMIZATION; FUNCTIONAL CODES;

SECURITY OF DATA;

EID: 24644470126     PISSN: 03029743     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1007/978-3-540-31979-5_14     Document Type: Conference Paper

References (20)

1. The Apache Struts Web Application Framework: http://struts.apache.org/
2. Chandramouli, R.: A Framework for Multiple Authorization Types in a Healthcare Application System, 17th Annual Computer Security Applications Conference, Dec. 2001.
3. De Win, B., Piessens, F., Joosen, W. and Verhanneman, T., On the importance of the separation-of-concerns principle in secure software engineering, Workshop on the Application of Engineering Principles to System Security Design, 2002.
4. De Win, B., Vanhaute, B., and De Decker, B., Building Frameworks in AspectJ, ECOOP 2001, Workshop on Advanced Separation of Concerns, pp.1-6.
5. De Win, B., Vanhaute, B. and De Decker, B., Security Through Aspect-Oriented Programming, Advances in Network and Distributed Systems Security, Kluwer Academic, pp. 125-138, 2001.
6. Hanenberg, S. and Schmidmeier, A., Idioms for Building Software Frameworks in Aspectj, 2nd AOSD Workshop on Aspects, Components, and Patterns for Infrastructure Software (ACP4IS), Boston, MA, March 17, 2003.
7. Gamma, Helm, Johnson and Vlissides, Design Patterns. Addison-Wesley, 1995.
8. Georg, G, Ray, I., and France, R., Using Aspects to Design a Secure System, Proc. of the 8th IEEE Int'l Conf. on Engineering of Complex Computer Systems. December 2002.
9. Georgiadis, C.K., Mavridis, I., Pangalos, G., and Thomas, R.K.: Flexible Team-based Access Control Using Contexts, Sixth ACM Symposium on Access Control Models and Technologies (SACMAT 2001), Chantilly, VA, USA, May 2001.
10. Giuri, L., and Iglio, P., Role Templates for Content-Based Access Control, Proceedings, 2nd ACM Workshop on Role-Based Access Control, Fairfax, VA (October 28-29, 1997), pp. 153-59.
11. Goodwin, R., Goh, S.F., and Wu, F.Y., Instance-level access control for business-to-business electronic commerce, IBM System Journal, vol. 41, no. 2, 2002.
12. Kiczales, G., Lamping, J., Menhdhekar, A., Maeda, C., Lopes, C., Loingtier, J.-M., and Irwin, J., Aspect-Oriented Programming, in ECOOP '97, LNCS 1241, pp. 220-242.
13. Kiczales, G., Hilsdale, E., Hugunin, J., Kersten, M., Palm, J., and Griswold, W.G., Getting Started with AspectJ, Communications of ACM, vol. 44, no. 10, pp 59-65, Oct. 2001.
14. Kouadri Mostefaoui, G., and Brezillon, P., A generic framework for context-based distributed authorizations, In: Modeling and Using Context (CONTEXT-03), LNAI 2680, Springer Verlag, pp. 204-217.
15. Open Web Application Security Project: The Top Ten Most Critical Web Application Security Vulnerabilities, http://www.owasp.org/documentation/topten
16. Sandhu, R., Coyne, E., Feinstein, H., and Youman, C., Role-Based Access Control Models, IEEE Computer, 29(2):38-47, 1996.
17. Sun Microsystems, Java Authentication and Authorization Service (JAAS), http://java.sun.com/products/jaas/index.jsp
18. Sun Microsystems, JavaServer Pages Technology (JSP): http://java.sun.com/ products/jsp/
19. Sun Microsystems, Java Servlet Technology : http://java.sun.com/products/ servlet/
20. Tzelepil, S.K., Koukopoulos, D.K., and Pangalos, G.: A flexible Content and Context-based Access Control Model for Multimedia Medical Image Database Systems. ACM SIGMM Electronic Proceedings, 2001.