Michal Trnka
Tomas Cerny
ABSTRACT
Huge contemporary trend is adding context awareness into software applications. It allows both better user experience as well as a lot useful features for application owner. Nowadays, there are various approaches enabling particular context awareness but none of them concerns security. We tackle this problem and describe it further in the paper. Our solution extends role based access control with certain context awareness elements. Based on already existing solutions we propose own lightweight, universal solutions, which allows instant enhancement of current RBAC even in existing applications. The uniqueness of our solution is based on using security levels, which are granted to user based on his context. Security levels represents how the users can be trusted and are determined during users login procedure. The levels are used as additional security constrain so to access resources in application user need to have not only right permission granted through roles, but also to have corresponding level.
- Abowd, Gregory D; Dey, Anind K; Brown, Peter J; Davies, Nigel; Smith, Mark; Steggles Pete. Towards a better understanding of context and context-awareness. In: Handheld and ubiquitous computing. 1999. 304--307. Google Scholar
Digital Library
- Blinded, WoS ISI Jornal, 2014Google Scholar
- Harter, Andy; Hopper Andy; Steggles, Pete; Ward, Andy; Webster, Paul. The anatomy of a context-aware application. Wireless Networks 8, no. 2/3 (2002): 187--197. Google ScholarDigital Library
- Hong, Jongyi; Suh, Eui-Ho; Kim, Junyoung; Kim, SuYeon. Context-aware system for proactive personalized service based on context history. Expert Systems with Applications 36, no. 4 (2009): 7448--7457. Google ScholarDigital Library
- Matthew, Moyer; Abamad, Mustaque. Generalized role-based access control. In: Distributed Computing Systems, 2001. 21st International Conference on., pp. 391--398. IEEE, 2001. Google ScholarDigital Library
- Covington, Michael J.; Long, Wende; Srinivasan, Srividhya; Dev, Anind K.; Ahamad, Mustaque; Abowd, Gregory D. Securing context-aware applications using environment roles. In: Proceedings of the sixth ACM symposium on Access control models and technologies. 2001. 10--20. Google ScholarDigital Library
- Park, Seon-Ho; Han, Young-Ju; Chung, Tai-Myoung. Context-role based access control for context-aware application. In High Performance Computing and Communications, pp. 572--580. Springer Berlin Heidelberg, 2006. Google ScholarDigital Library
- Sladić, Goran; Milosavljević, Branko; Konjović, Zora. Context-sensitive access control model for business processes. Computer Science and Information Systems/ComSIS. 2013, 10 (3), 939--972.Google ScholarCross Ref
- Kulkarni, Devdatta; Tripathi, Anand. Context-aware role-based access control in pervasive computing systems. In: Proceedings of the 13th ACM symposium on Access control models and technologies. 2008. 113--122. Google ScholarDigital Library
- Neumann, Gustaf; Strembeck, Mark. An approach to engineer and enforce context constraints in an RBAC environment. In: Proceedings of the eighth ACM symposium on Access control models and technologies. 2003. 65--79. Google ScholarDigital Library
- Mostéfaoui, Ghita Kouadri; Brézillon, Patrick. A generic framework for context-based distributed authorizations. In Modeling and Using Context, pp. 204--217. Springer Berlin Heidelberg, 2003. Google ScholarDigital Library
- Corrad, Antonio; Montanari, Rebecca; Tibaldi, Daniela. Context-based access control management in ubiquitous environments. In: Network Computing and Applications, 2004.(NCA 2004). Proceedings. Third IEEE International Symposium on. 2004. 253--260. Google ScholarDigital Library
- Lima, Joao Carlos D.; Rocha, Cristiano C.; Augustin, Iara; Dantas, Mario AR. A Context-Aware Recommendation System to Behavioral Based Authentication in Mobile and Pervasive Environments. In: Embedded and Ubiquitous Computing (EUC), 2011 IFIP 9th International Conference on. 2011. 312--319. Google ScholarDigital Library
- Xung, Le Xuan; Hassan, J.; Riaz, AS.; Raazi, SMK.; Weiwei, Y.; Canh, Ngo Trong; Truc, Phan Tran Ho; Lee, Sungyoung; Lee, Heejo; Son, Yuseung; and others. Activity-based security scheme for ubiquitous environments. In: Performance, Computing and Communications Conference, 2008. IPCCC 2008. IEEE International. 2008. 475--481.Google Scholar
- Wendong, Zhang; Kaiji, Zhang. A role-based workflow access control model. In: Education Technology and Computer Science, 2009. ETCS'09. First International Workshop on. 2009. 1136--1139. Google ScholarDigital Library
- Bush, Vannevar and As We May Think. "The atlantic monthly." As we may think 176.1 (1945): 101--108.Google Scholar
- Sandhu, Ravi. Access control: The neglected frontier. In: Information Security and Privacy. 1996. 219--227. Google ScholarDigital Library
- Hitchens, M.; Varadharajan, V. Design and specification of role based access control policies. Software, IEE Proceedings -. 2000, 147 (4), 117--129. DOI 10.1049/ip-sen:20000792.Google ScholarCross Ref
- Schilit, Bill; Norman Adams; Want, Roy. "Context-aware computing applications." In Mobile Computing Systems and Applications, 1994. WMCSA 1994.First Workshop on, pp. 85--90. IEEE, 1994. Google ScholarDigital Library
Index Terms
- On security level usage in context-aware role-based access control
Recommendations
A semantic security framework and context-aware role-based access control ontology for smart spaces
SBD '16: Proceedings of the International Workshop on Semantic Big DataSmart Spaces are composed of heterogeneous sensors and devices that collect and share information. This information may contain personal information of the users. Thus, securing the data and preserving the privacy are of paramount importance. In this ...
A role-based access control model and reference implementation within a corporate intranet
Special issue on role-based access controlThis paper describes NIST's enhanced RBAC model and our approach to designing and implementing RBAC features for networked Web servers. The RBAC model formalized in this paper is based on the properties that were first described in Ferraiolo and Kuhn [...
Proposed NIST standard for role-based access control
In this article we propose a standard for role-based access control (RBAC). Although RBAC models have received broad support as a generalized approach to access control, and are well recognized for their many advantages in performing large-scale ...
Comments