A general obligation model and continuity-enhanced policy enforcement engine for usage control

Proceedings of ACM Symposium on Access Control Models and Technologies, SACMAT

Volumn , Issue , 2008, Pages 123-132

  Katt, Basel ^a   Zhang, Xinwen ^b   Breu, Ruth ^a   Hafner, Michael ^a   Seifert, Jean Pierre ^b  

^a UNIVERSITY OF INNSBRUCK   (Austria)

^b SAMSUNG INFORMATION SYSTEMS AMERICA   (United States)

Author keywords

Design; Security

Indexed keywords

COMPUTER SYSTEMS; CONTROL SYSTEMS; INFORMATION SYSTEMS; SECURITY SYSTEMS;

ACCESS CONTROL MODELS; COMPUTING ENVIRONMENTS; COMPUTING SYSTEMS; CONFIGURABLE; DATA CONTROLS; HEALTH CARE INFORMATION SYSTEMS; POLICY ENFORCEMENTS; RESOURCE SHARING; SECURITY; SECURITY REQUIREMENTS; USAGE CONTROLS;

ACCESS CONTROL;

EID: 57349136722     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1377836.1377856     Document Type: Conference Paper

References (29)

1. [ACF]ITU-T Rec X.812 (1995) | ISO/IEC 10181-3:1996. Security frameworks for open systems: Access control framework. Technical report, 1996.
2. B. Agreiter, M. Alam, R. Breu, M. Hafner, A. Pretschner, J.-P. Seifert, and X. Zhang. A technical architecture for enforcing usage control requirements in service-oriented architectures. In Proc. ACM workshop on Secure web services, 2007.
3. M. Alam, M. Hafner, M. Memon, and P. Hung. Modeling and enforcing advanced access control policies in healthcare systems with sectet. Mothis, 2007.
4. C. Bettini, S. Jajodia, X. SeanWang, and D. Wijesekera. Provisions and obligations in policy rule management. J. Network and System, Mgmt., 2003.
5. C. Bettini, S. Jajodia, X. Sean Wang, and D. Wijesekera. Obligation monitoring in policy management. IEEE 3rd Intern. Workshop on Policies for Distributed Systems and Networks, 2002.
6. C. Bettini, S. Jajodia, X. Sean Wang, and D. Wijesekera. Provisions and obligations in policy management and security applications. In Proc. of the 28th VLDB Conference, Hong Kong, China, 2002.
7. N. Damianou, N. Dulay, E. Lupu, and M. Sloman. The ponder policy specification language. Lecture Notes in Computer Science, 2001.
8. P. Gama and P. Ferreira. Obligation policies: An enforcement platform. In Sixth IEEE International Workshop on Policies for Distributed Systems and Networks, 2005.
9. P. Gama, C. Ribeiro, and P. Ferreira. A scalable history-based policy engine. In Seventh IEEE International Workshop on Policies for Distributed Systems and Networks, 2006.
10. M. Hafner, R. Mair, R. Breu, B. Agreiter, S. Unterthiner, and T. Schabetsberger. Health@net. Die verteilte elektronische gesundheitsakte- eine fallstudie in modell-getriebenem security engineering. IT-Sicherheitskongress des BSI, 2007.
11. M. Hilty, D. Basin, and A. Pretschner. On obligations. In Proc. of European Symposium on Research in Computer Security, 2005.
12. M. Hilty, A. Pretschner, D. Basin, C. Schaefer, and T. Walter. A policy language for distributed usage control. In Proc. of the 12th European Symposium on Research in Computer Security, 2007.
13. Keith Irwin, Ting Yu, and William H. Winsborogh. On the modeling and analysis of obligations. In Proc. of A CM Conference on Computer and Communications Security, 2006.
14. J. Park and R. Sandhu. The ucon-abc usage control model. ACM Transactions of Information and System Security, 7(1):128-174, 2004.
15. J. Park and R. Sandhu. Towards usage control models: Beyond traditional access control. In Proc. of ACM symposium on Access control models and technologies, 2002.
16. J. Park, X. Zhang, and R. S. Sandhu. Attribute mutability in usage control. In Proc. of the Annual IFIP WG 11.3 Working Conference on Data and Applications Security, 2004.
17. A. Pretschner, M. Hilty, and D. Basin. Distributed usage control. Communication of the ACM, 49(9):39-44, 2006.
18. A. Pretschner, M. Hilty, F. Casati, and F. Massacci. Usage control in service-oriented architecture. In Proc. of the 4th Intl. Conf. on Trust. Privacy & Security in Digital Business, 2007.
19. C. Ribeiro, A. Zuquete, P. Ferreira, and P. Guede. Spl: An access control language for security policies with complex constraints. In Proc. of the Network and Distributed System Security Symposium, 2001.
20. R. Sailer, T. Jaeger, X. Zhang, and L. van Doom. Attestation based policy enforcement for remote access. ACM Conference on Computer and Communications Security, 2004.
21. R. Sailer, X. Zhang, T. Jaeger, and L. van Doom. Design and implementation of teg based integrity measurement systems. In Proc. of the 13th conference on USENIX Security, 2004.
22. R. Sandhu and J. Park. Usage control: A vision for the next generation access control. Inter. Workshop on Mathematical Methods,Models and Architectures for Computer Networks Security, 2003.
23. R. Sandhu, K. Ranganathan, and X. Zhang. Secure information sharing enabled by trusted computing and pei models. In Proc. of ACM Symposium on Information, computer and communications security, 2006.
24. R. Sandhu and X. Zhang. Peer-to-peer access control architecture using trusted computing technology. In Proc. of ACM symposium on Access control models and technologies, 2005.
25. S. Unterthiner, M. Hafner, R.Breu, and T. Schabetsberger. Endpoint security in elga architekturen. eHealth-Medical Inform,atics meets eHealth. Vienna, 2007.
26. G. Vogt. Multiple authoriztion- a model and architecture for increased, practical security. In Proc. of IFIP/IEEE Symposium on Integrated Network Management, 2003.
27. G. Yee, L. Korba, and R. Song. Ensuring privacy for e-health services. In Proc. of The First International Conference on Availability, Reliability and Security, 2006.
28. X. Zhang, M. Nakae, M. J. Convington, and R. Sandhu. A usage-based authorization framework for collaborative computing systems. In Proc. of ACM Symposium on Access Control Models and Technologies, 2006.
29. X. Zhang, F. Parisi-Presicce, R. Sandhu, and J. Park. Formal model and policy specification of usage control. ACM Transactions on Information and System Security, 8(4):351-387, 2005.