Abstract
Ensuring secure interoperation in multidomain environments based on role based access control (RBAC) has drawn considerable research works in the past. However, RBAC primarily consider static authorization decisions based on subjects’ permissions on target objects, and there is no further enforcement during the access. Recently proposed usage control (UCON) can address these requirements of access policy representation for temporal and time-consuming problems. In this paper, we propose a framework to facilitate the establishment of secure interoperability in multidomain environments employing Usage Control (UCON) policies. In particular, we propose an attribute mapping technique to establish secure context in multidomain environments. A key challenge in the establishment of secure interoperability is to guarantee security of individual domains in presence of interoperation. We study how conflicts arise and show that it is efficient to resolve the security violations of cyclic inheritance and separation of duty.
This work is supported by National Natural Science Foundation of China under Grant 60873225, 60773191 and 60403027, National High Technology Research and Development Program of China under Grant 2007AA01Z403.
This is a preview of subscription content, log in via an institution to check access.
Preview
Unable to display preview. Download preview PDF.
Similar content being viewed by others
References
Kapadia, A., AlMuhtadi, J., Campbell, R., et al.: IRBAC 2000: Secure Interoperability using Dynamic Role Translation. University of Illinois, Technical Report: UIUCDCS-R-2000-2162 (2000)
ANSI. American National Standard for Information Technology-Role Based Access Control. ANSI INCITS 359-2004 (2004)
Park, J., Sandhu, R.: The UCONABC Usage Control Model. ACM Transactions on Information and System Security 7(1), 128–174 (2004)
Zhang, X., Parisi-Presicce, F., Sandhu, R., Park, J.: Formal Model and Policy Specification of Usage Control. ACM Transactions on Information and Systems Security 8(4), 351–387 (2005)
Zhang, X., Park, J., Parisi-Presicce, F., Sandhu, R.: A Logical Specification for Usage Control. In: 9th ACM Symposium on Access Control Models and Technology, pp. 1–10. ACM Press, New York (2004)
Bonatti, P., Vimercati, S.D.C., Samarati, P.: An Algebra for Composing Access Control Policies. ACM Transaction on Information and System Security 5(1), 409–422 (2002)
Dawson, S., Qian, S., Samarati, P.: Providing Security and Interoperation of Heterogeneous Systems. Distributed and Parallel Databases 8, 119–145 (2000)
Gong, L., Qian, X.: Computational Issues in Secure Interoperation. IEEE Transactions on Knowledge and Data Engineering 22(1), 14–23 (1996)
Dawson, S., Qian, S., Samarati, P.: Providing Security and Interoperation of Heterogeneous Systems. Distributed and Parallel Databases 8(1), 119–145 (2000)
Clark, D., Wilson, D., Kuhn, D.R.: A comparison of Commercial and Military Computer Security Policies. In: IEEE Symposium on Security and Privacy, pp. 184–195. IEEE Press, Los Alamitos (1987)
Shehab, M., Bertino, E., Ghafoor, A.: SERAT: Secure Role Mapping Technique for Decentralized Secure Interoperability. In: 10th ACM Symposium on Access Control Models and Technologies, Stockholm, pp. 159–167. ACM Press, Sweden (2005)
Shafiq, B., Joshi, J.B.D., Bertino, E.: Secure Interoperation in a Multidomain Environment Employing RBAC Policies. IEEE Transactions on Knowledge and Data Engineering 17(11), 1557–1577 (2005)
Lupu, E., Sloman, M.: Conflicts in Policy-Based Distributed Systems Management. IEEE Transactions on Software Engineering 25(6), 852–869 (1999)
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2009 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Lu, J., Li, R., Varadharajan, V., Lu, Z., Ma, X. (2009). Secure Interoperation in Multidomain Environments Employing UCON Policies. In: Samarati, P., Yung, M., Martinelli, F., Ardagna, C.A. (eds) Information Security. ISC 2009. Lecture Notes in Computer Science, vol 5735. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-642-04474-8_31
Download citation
DOI: https://doi.org/10.1007/978-3-642-04474-8_31
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-642-04473-1
Online ISBN: 978-3-642-04474-8
eBook Packages: Computer ScienceComputer Science (R0)