A Semantic-Aware Attribute-Based Access Control Model for Web Services

Abstract

Web service is a new service-oriented computing paradigm which poses the unique security challenges due to its inherent heterogeneity, multi-domain characteristic and highly dynamic nature. A key challenge in Web services security is the design of effective access control schemes. Attribute-based access control (ABAC) is more appropriate than some other access control mechanisms, but it do not fully exploit the semantic power and reasoning capabilities of emerging web applications. So a semantic-aware attribute-based access control model (SABAC) is presented to address these issues by combining the ABAC with the Semantic Web technologies in this paper. SABAC grants access to services based on attributes of the related entities, and uses Shibboleth service to address the disclosure issue of the sensitive attributes. In addition, SABAC uses the Web Ontology Language (OWL) standard to represent the ontology of the resources and users and uses eXtensible Access Control Markup Language (XACML) as the policy language. It can provide administratively scalable alternative to identity-based authorization methods and provide semantic interoperability for the access control to Web services. Moreover, SABAC also separates ontology management from access management.