skip to main content
10.1145/1390832.1390836acmconferencesArticle/Chapter ViewAbstractPublication PagesisstaConference Proceedingsconference-collections
research-article

Policy expression and checking in XACML, WS-Policies, and the jABC

Published: 21 July 2008 Publication History

Abstract

Web-based access to sensitive and confidential data is realized today via different approaches, using a variety of methods to specify and combine access control policies. In an optic of change management and evolution, a structured and flexible model is needed to handle dynamicity, particularly when handling rights in systems with many users which hold different roles. Furthermore the validation of security constraints is an important key to warrant the reliability of control mechanisms.
This paper compares the temporal logic-based approach for modeling access control used by the jABC framework with two popular XML-based description languages (XACML and WS-Policy), which are quasi-standards for policy expression in Web applications. Its usage is illustrated here on the example of the web-based Online Conference Service (OCS). The respective functionalities are described and examined in consideration of their ability to validate and enforce the needed policies.

References

[1]
T. Moses (Ed.): eXtensible Access Control Markup Language (XACML) Version 2.0, Feb. 2005 http://docs.oasis-open.org/xacml/2.0/access_control-xacml-2.0-core-spec-os. pdf,
[2]
P. Griffin: Introduction to XACML, February 2004 http://dev2dev.bea.com/pub/a/2004/02/xacml.html
[3]
B. Siddharth et al.: Web Services Policy 1.2 - Framework (WS-Policy), April 2006, http://www.w3.org/Submission/2006/SUBM-WS-Policy-20060425/
[4]
E. A. Emerson, C. S. Jutla, A. P. Sistla. On model-checking for fragments of μ-calculus. 1993.
[5]
G. Hughes, T. Bultan: Automated Verification of XACML Policies Using a SAT Solver. WQVV 2007, Worksh. on Web Quality, Verification and Validation, at 7th ICWE, Como (I), July 2007, Worksh. Proc. pp. 378--392.
[6]
M. Karusseit, T. Margaria: A Web-based Runtime-Reconfigurable Role Management Service Proc. WWV '06, 2nd Int. Worksh. on Automated Specification and Verification of Web Sites, Cyprus, 2006, IEEE Press, pp.53--60.
[7]
M. Karusseit, T. Margaria: Feature-based Modelling of a Complex, Online-Reconfigurable Decision Support Service Proc. WWV '05, 1st Int. Worksh. on Automated Specification and Verification of Web Sites, Valencia (E), March 2005, ENTCS N. 1132.
[8]
T. Margaria, M. Karusseit: Community Usage of the Online Conference Service: an Experience Report from three CS Conferences, 2nd IFIP Conf. on "e-commerce, e-business, e-government" (I3E 2002), Lisboa (P), Oct. 2002, Kluwer, pp.497--511.
[9]
jABC: JavaABC Framework http://www.jABC.de
[10]
B. Steffen, T. Margaria, R. Nagel, S. Jörges, C. Kubczak: Model-Driven Development with the jABC, Proc. HVC '06, IBM Haifa Verification Conf., Haifa (IL), LNCS 4383, Springer Verlag, 2006.
[11]
T. Margaria, B. Steffen: Service Engineering: Linking Business and IT, Computer, IEEE Computer Society, October 2006, pp.45--55
[12]
B. Steffen, P. Narayan: Full Life-Cycle Support for End-to-End Processes, Computer, IEEE Computer Society, November 2007, pp.64--73
[13]
S. Jörges, T. Margaria, B. Steffen: FormulaBuilder: A Tool for Graph-based Modelling and Generation of Formulae, ICSE 2006, Shanghai, China, ACM Press, pp. 815--818.
[14]
OASIS http://www.oasis-open.org/home/index.php
[15]
Della-Libera et al.: Web Services Security Policy Language (WS-SecurityPolicy) Version 1.1, July 2005 http://specs.xmlsoap.org/ws/2005/07/securitypolicy/ws-securitypolicy.pdf
[16]
D. Box et al.: Web Services Policy Assertions Language (WS-PolicyAssertions) Version 1.1, May 2003 http://xml.coverpages.org/ws-policyassertionsV11.pdf
[17]
K. Ballinger et al.: Web Services Metadata Exchange (WS-MetadataExchange) Version 1.1 August 2006 http://specs.xmlsoap.org/ws/2004/09/mex/WS-MetadataExchange.pdf,
[18]
M. Bakera, T. Margaria, C. Renner, B. Steffen: Game-based Model Checking for Reliable Autonomy, SMC-IT '06, 2nd IEEE Int. Conf. on Space Mission Challenges for Information Technology, Workshop on Autonomous and Autonomic Systems, July 2006.

Cited By

View all
  • (2019)Making Sense of Complex Applications: Constructive Design, Features, and QuestionsModels, Mindsets, Meta: The What, the How, and the Why Not?10.1007/978-3-030-22348-9_9(129-148)Online publication date: 26-Jun-2019
  • (2017)Analyzing ambient assisted living solutions: A research perspective2017 12th International Conference on Design & Technology of Integrated Systems In Nanoscale Era (DTIS)10.1109/DTIS.2017.7930168(1-7)Online publication date: Apr-2017
  • (2010)Securing Queries to Outsourced XML DatabasesProceedings of the 2010 IEEE 24th International Conference on Advanced Information Networking and Applications Workshops10.1109/WAINA.2010.122(419-424)Online publication date: 20-Apr-2010

Recommendations

Comments

Information & Contributors

Information

Published In

cover image ACM Conferences
TAV-WEB '08: Proceedings of the 2008 workshop on Testing, analysis, and verification of web services and applications
July 2008
49 pages
ISBN:9781605580531
DOI:10.1145/1390832
  • Editors:
  • Tevfik Bultan,
  • Tao Xie
Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

Sponsors

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 21 July 2008

Permissions

Request permissions for this article.

Check for updates

Author Tags

  1. access control
  2. model checking
  3. policies
  4. validation

Qualifiers

  • Research-article

Conference

ISSTA '08
Sponsor:

Upcoming Conference

ISSTA '25

Contributors

Other Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

  • Downloads (Last 12 months)0
  • Downloads (Last 6 weeks)0
Reflects downloads up to 20 Jan 2025

Other Metrics

Citations

Cited By

View all
  • (2019)Making Sense of Complex Applications: Constructive Design, Features, and QuestionsModels, Mindsets, Meta: The What, the How, and the Why Not?10.1007/978-3-030-22348-9_9(129-148)Online publication date: 26-Jun-2019
  • (2017)Analyzing ambient assisted living solutions: A research perspective2017 12th International Conference on Design & Technology of Integrated Systems In Nanoscale Era (DTIS)10.1109/DTIS.2017.7930168(1-7)Online publication date: Apr-2017
  • (2010)Securing Queries to Outsourced XML DatabasesProceedings of the 2010 IEEE 24th International Conference on Advanced Information Networking and Applications Workshops10.1109/WAINA.2010.122(419-424)Online publication date: 20-Apr-2010

View Options

Login options

View options

PDF

View or Download as a PDF file.

PDF

eReader

View online with eReader.

eReader

Media

Figures

Other

Tables

Share

Share

Share this Publication link

Share on social media