eXtensible Access Control Markup Language Research Articles

From model-driven specification to design-level set-based analysis of XACML policies

With lot of hype surrounding policy-based computing, XACML (eXtensible Access Control Markup Language) has become the widely used de facto standard for managing access to open and distributed service-based environments like Web services. However, like any other policy language, XACML has complex syntax, which makes the policies specification process both time consuming and error prone, especially with large size policies that govern complex systems. Moreover, with the diversity of rules and conditions, hidden conflicts, redundancies and access flaws are more likely to arise, which expose Web services to security breaches at runtime. This paper proposes a UML profile that allows systematic model-driven specification of XACML policies to resolve the complexity of policies designation. Based on mathematical sets that explore the rules meanings, the paper provides also a design-level analysis to detect anomalies in the specified policies, prior to their enforcement in the system. A real life case study demonstrates the feasibility and efficiency of the proposition.

Centralized Authorization Service (CAuthS) or Authorization as a Service (AuthaaS) A Conceptual Architecture

Absence of architecture to describe how to implement authorization as a centralized service, in a way similar to authentication, has been causing redundant deployment of computing resources, lack of standard practices, and neverending learning curve in maintaining proprietary or ad hoc authorization solutions. The paper develops an architecture, which focuses on centralization of authorization, to be called Centralized Authorization Service (CAuthS) or Authorization as a Service (AuthaaS), when deployed as a service, and is targeted to substitute platform-based ad hoc authorization solutions. General Terms XACML: eXtensible Access Control Markup Language is a standard maintained by OASIS [1]. ACL, RBAC, and ABAC: Access Control List, Role-Based Access Control, and Attribute-Based Access Control are commonly known patterns in the domain of authorization ( [2]; [3]; [4]]). User Access Control (UAC): An enterprise or federationscoped authorization (access control) service discussed in the paper. In addition to access control, validation of action by the principal (user) is included in the meaning of authorization. UUID: Universally Unique Identifier is defined by the Open Software Foundation [5]. It should guarantee uniqueness of principal within an enterprise-scoped or a federation-scoped UAC service. Identification, Identification Provider (IdP): Identification a.k.a., authentication, validates credentials of principals and returns results as Boolean responses. Issuing secured tokens is often included in the task-list of the IdP [6]; however, the latter responsibility may be gainfully shared by the SP particularly if per-transaction tokens are warranted for security reasons. Core Concern, Crosscutting Concern: Core business gives rise to logic known as the core concern; other, supportive Authorization has been defined differently by many ([20]; [21]; [22]; etc.). In this paper, it is, primarily, granting access to a principal over a view of a UAC resource. However, it may also include validation of user actions. 2 Similar to authorization, authentication (for the purpose of this paper it is same as or close to assertion of identity) has many definitions ([23]; [24]; etc.) Here, the term means asserting identity of a principal. Single Sign-On (SSO), Cross-Domain SSO, and Federated SSO ([25]; [26]; [27]; [28]; [24]) have contributed to centralization of this service. 3 Vide DUKPT [29], which is a way to address vulnerability of sessions that use a single token for all transactions associated with it. logic are known as crosscutting concern [7]. However, the paper will take a relative view on this: if individual concerns in the set C = c1 , c2,... containing all of them are implemented separately then it will be assumed that the relation, crosscutting Χ into C will be deemed reflexive, i.e. ciΧcj ⇔ cjΧci∀ci , cj ∈ C, ci ≠ cj . It practically means that authorization being a crosscutting concern for some business service also means and is meant by the business service (or a part of it) acting as crosscutting concern for authorization. Service Provider (SP): UAC resources are controlled by the Service Provider (SP), which provides access to identified principals, subject to nature and extent determined by the UAC. Principal: Entity seeking access over UAC resources. Also vide infra. Subject: Entity allowed access over UAC resources. Also vide infra.

Semantics-based approach for detecting flaws, conflicts and redundancies in XACML policies

XACML (eXtensible Access Control Markup Language) policies, which are widely adopted for defining and controlling dynamic access among Web/cloud services, are becoming more complex in order to handle the significant growth in communication and cooperation between individuals and composed services. However, the large size and complexity of these policies raise many concerns related to their correctness in terms of flaws, conflicts and redundancies presence. This paper addresses this problem through introducing a novel set and semantics based scheme that provides accurate and efficient analysis of XACML policies. First, our approach resolves the complexity of policies by elaborating an intermediate set-based representation to which the elements of XACML are automatically converted. Second, it allows to detect flaws, conflicts and redundancies between rules by offering new mechanisms to analyze the meaning of policy rules through semantics verification by inference rule structure and deductive logic. All the approach components and algorithms realizing the proposed analysis semantics have been implemented in one development framework. Experiments carried out on synthetic and real-life XACML policies explore the relevance of our analysis algorithms with acceptable overhead. Please visit http://www.azzammourad.org/#projects to download the framework.

Role-based access control for substation automation systems using XACML

There has been an increasing need for accessing data of internal equipment and devices of a substation system from external systems as power grids evolve. This has also introduced growing concerns on data security. In response to the concerns, IEC 62351 has proposed role-based access control (RBAC) for substation automation. In this work, we present a novel approach for implementing RBAC based on IEC 62351 for substation automation using eXtensible Access Control Markup Language (XACML). We integrate the approach with IEC 61850 by extending Abstract Communication Service Interface (ACSI), Manufacturing Message Specification (MMS), and System Configuration Language (SCL). A major advantage of the approach is that it fully conforms to both IEC 61850 and IEC 62351 and highly compatible with SCL as both XACML and SCL are XML-based. We implement the approach using OpenIEC61850 which is an open source library for ACSI services and demonstrate the implementation.

Spatio-temporal XACML: the expansion of XACML for access control

eXtensible Access Control Markup Language XACML standardised by OCG was widely used in the area of information security. And recently geospatial XACML was standardised. But now, types of information are diversified. Especially, importance of information about time and space is continually increased. We use information to know where or when we do something. For instance, we usually check time or find the way with it. Therefore, Geospatial eXtensible Access Control Markup Language GeoXACML is not enough to cover it. In this paper, we propose that spatio-temporal XACML which can accept not only geospatial information but also temporal information. Spatio-temporal XACML is based on and expands standardised GeoXACML in OCG. Its scenario consists of access control between positions of polices.

A Framework for Context Sensitive Risk-Based Access Control in Medical Information Systems.

Since the access control environment has changed and the threat of insider information leakage has come to the fore, studies on risk-based access control models that decide access permissions dynamically have been conducted vigorously. Medical information systems should protect sensitive data such as medical information from insider threat and enable dynamic access control depending on the context such as life-threatening emergencies. In this paper, we suggest an approach and framework for context sensitive risk-based access control suitable for medical information systems. This approach categorizes context information, estimating and applying risk through context- and treatment-based permission profiling and specifications by expanding the eXtensible Access Control Markup Language (XACML) to apply risk. The proposed framework supports quick responses to medical situations and prevents unnecessary insider data access through dynamic access authorization decisions in accordance with the severity of the context and treatment.

Multi‐tenancy authorization models for collaborative cloud services

SummaryThe cloud service model intrinsically caters to multiple tenants, most obviously not only in public clouds but also in private clouds for large organizations. Currently, most cloud service providers isolate user activities and data within a single tenant boundary with no or minimum cross‐tenant interaction. It is anticipated that this situation will evolve soon to foster cross‐tenant collaboration supported by Authorization as a Service. At present, there is no widely accepted model for cross‐tenant authorization. Recently, Calero et al. informally presented a multi‐tenancy authorization system (MTAS), which extends the well‐known role‐based access control model by building trust relations among collaborating tenants. In this paper, we formalize this MTAS model and propose extensions for finer‐grained cross‐tenant trust. We also develop an administration model for MTAS. We demonstrate the utility and practical feasibility of MTAS by means of an example policy specification in extensible access control markup language. To further test the metrics of the model, we develop a prototype system and conduct experiments on it. The result shows that the prototype has 12‐ms policy decision overhead on average and is scalable. We anticipate that researchers will develop additional multi‐tenant authorization models before eventual consolidation and convergence to standard industry practice. Copyright © 2014 John Wiley & Sons, Ltd.

SBA-XACML: Set-based approach providing efficient policy decision process for accessing Web services

Policy-based computing is taking an increasing role in providing real-time decisions and governing the systematic interaction among distributed Web services. XACML (eXtensible Access Control Markup Language) has been known as the de facto standard widely used by many vendors for specifying access and context-aware policies. Accordingly, the size and complexity of XACML policies are significantly growing to cope with the evolution of web-based applications and services. This growth raised many concerns related to the efficiency of real-time decision process (i.e. policy evaluation) and the correctness of complex policies. This paper is addressing these concerns through the elaboration of SBA-XACML, a novel Set-Based Algebra (i.e. SBA) scheme that provides efficient evaluation of XACML policies. Our approach constitutes of elaborating (1) a set-based language that covers all the XACML components and establish an intermediate layer to which policies are automatically converted, and (2) a semantics-based policy evaluation that provides better performance compared to the industrial standard Sun Policy Decision Point (PDP) and its corresponding ameliorations. Experiments have been conducted on real-life and synthetic XACML policies in order to demonstrate the efficiency, relevance and scalability of our proposition. The experimental results explore that SBA-XACML evaluation of large and small sizes policies offers better performance than the current approaches, by a factor ranging between 2.4 and 15 times faster depending on policy size.

Towards a flexible framework to support a generalized extension of XACML for spatio-temporal RBAC model with reasoning ability

Purpose – The paper aims to propose a flexible framework to support X-STROWL model. Extensible access control markup language (XACML) is an international standard used for access control in distributed systems. However, XACML and its existing extensions are not sufficient to fulfill sophisticated security requirements (e.g. access control based on user’s roles, context-aware authorizations and the ability of reasoning). Remarkably, X-STROWL, a generalized extension of XACML for spatiotemporal role-based access control (RBAC) model with reasoning ability, is a comprehensive model that overcomes these shortcomings. It mainly focuses on the architecture design as well as the implementation and evaluation of proposed framework and the comparison with others. Design/methodology/approach – Based on the concept of X-STROWL model, the paper reviewed a large amount of open sources implementing XACML with defined criteria and chose the most suitable framework to be extended for the implementation. The paper also presented a case study used to evaluate the research result. Findings – Holistic enterprise-ready application security framework – architecture framework (HERAS-AF) is chosen as the most suitable framework to be extended to implement X-STROWL model. Extending HERAS-AF to support spatiotemporal aspect and other contextual conditions as well as the way to integrate security in the access request, together with ability of reasoning for hierarchical roles, are striking features that make the proposed framework able to meet more sophisticated security requirements in comparison with others. Research limitations/implications – Due to the research content, the performance of proposed framework is not the focused issue of this work. Originality/value – The proposed framework is a crucial contribution of our research to provide a holistic, extensible and intelligent authorization decision engine.

Semantic-Based Access Control for Data Resources in Open Grid Services Architecture

This paper proposes a semantic-based access control system for the data resources in the Open Grid Services Architecture - Data Access and Integration (OGSA-DAI). OGSA-DAI is a widely used middleware for integrating data resources in Grids. However, the identity-based access control in OGSA-DAI causes substantial overhead for the resource providers in virtual organizations (VOs), because the access control information of individual users has to be maintained by each resource provider. To solve these problems, the authors propose a semantic-based access control system using Shibboleth and ontology. Shibboleth, an attribute authorization service, is used to manage the user attributes, and the Web Ontology Language (OWL) is used to represent the ontology of the data resources and users. By using ontology, VOs can resolve the differences in their terminologies and specify access control policies based on concepts and user roles, instead of individual resources and user identities. As a result, the administration overhead of the resource providers is reduced considerably. In addition, the eXtensible Access Control Markup Language (XACML) is used to specify the access control policies uniformly across multiple VOs. The authors also developed an XACML policy administration tool that allows the administrators to create, update, and manage XACML policies. The performance analysis shows that our proposed system adds only a small overhead to the existing security mechanism of OGSA-DAI.

Privacy-preserving attribute-based access control for grid computing

In Attribute-Based Access Control (ABAC), access is granted based on the attributes of the requesting user. ABAC is a highly flexible and scalable access control scheme which can deal with diverse security requirements in a grid computing environment. However, in ABAC the user attributes published by the identity providers for authorisation decision may cause some privacy violation. We developed an attribute release control mechanism to publish an optimal set of user attributes that are essential to access a desired resource (or service), while exposing the least amount of sensitive user information. To facilitate the selection of an optimal set of user attributes, we also developed a Web service, named Security Policy Publication Service (SPPS), which retrieves the access condition from the access control policies in eXtensible Access Control Markup Language (XACML) and converts it into a Disjunctive Normal Form (DNF) of user attributes. For the implementation of our privacy-preserving ABAC, we used the Globus Toolkit and modified the Shibboleth Identity Provider and GridShib. Our performance analysis shows that the overhead of the proposed system is very small.

Enforcing mobile security with location-aware role-based access control

This paper describes how location-aware role-based access control RBAC can be implemented on top of the Geospatial eXtensible Access Control Markup Language GeoXACML. It furthermore sketches how spatial separation of duty constraints both static and dynamic can be implemented using GeoXACML on top of the XACML RBAC profile. The solution uses physical addressing of geographical locations, which facilitates easy deployment of authorisation profiles to the mobile device. Location-aware RBAC can be used to implement location-dependent access control and also other security enhancing solutions on mobile devices, such as location-dependent device locking, firewall, intrusion prevention or payment anti-fraud systems. The system has been implemented and tested, both to verify the server capacity and also the client capacity running on a mobile device. Copyright © 2013 John Wiley & Sons, Ltd.

Discovery and Resolution of Anomalies in Web Access Control Policies

Emerging computing technologies such as web services, service-oriented architecture, and cloud computing has enabled us to perform business services more efficiently and effectively. However, we still suffer from unintended security leakages by unauthorized actions in business services while providing more convenient services to Internet users through such a cutting-edge technological growth. Furthermore, designing and managing web access control policies are often error-prone due to the lack of effective analysis mechanisms and tools. In this paper, we represent an innovative policy anomaly analysis approach for web access control policies, focusing on extensible access control markup language policy. We introduce a policy-based segmentation technique to accurately identify policy anomalies and derive effective anomaly resolutions, along with an intuitive visualization representation of analysis results. We also discuss a proof-of-concept implementation of our method called XAnalyzer and demonstrate how our approach can efficiently discover and resolve policy anomalies.

Automated testing of eXtensible Access Control Markup Language‐based access control systems

The trustworthiness of sensitive data needs to be guaranteed and testing is a common activity among privacy protection solutions, even if quite expensive. Accesses to data and resources are ruled by the policy decision point (PDP), which relies on the eXtensible Access Control Markup Language (XACML) standard language for specifying access rights. In this study, the authors propose a testing strategy for automatically deriving test requests from a XACML policy and describe their pilot experience in test automation using this strategy. Considering a real two-level PDP implemented for health data security, the authors compare the effectiveness of the test plan automatically derived with the one derived by a standard manual testing process.

Extensible access control markup language integrated with Semantic Web technologies

The eXtensible Access Control Markup Language (XACML) is a standard language for expressing access control policies. The concept of authorization policy has been introduced in XACML-based Web security systems to reduce policy conflicts, enhance policy reusability, simplify policy analysis, and facilitate interoperability. Achieving these goals requires intelligent dynamic authorization. Unfortunately, conventional XACML lacks the computer interpretability needed to support knowledge representation. This study addresses the issue by defining a Multi-layer Semantic XACML Framework (MSACF) for integrating Semantic Web technologies in XACML. Based on the MSACF, this study also develops LAPAR, an intelligent XACML shell consisting of an Ontology Base, an XML-Based Repository, and an Inference Engine to enable different approaches for enhancing knowledge representations. The feasibility of LAPAR is confirmed in a prototype java-based implementation that can be associated with various domain ontologies and knowledge to enable dynamic authorization for different security applications.

New XACML-AspectBPEL approach for composite web services security

Web services technology is the latest evolution in distributed computing. With all of the advantages of web services, one of the main hurdles remains security in composite web services. In this paper, we tackle this problem through a new approach towards the integration of security into the BPEL Business Process Execution Language process of composite web services. Our approach allows specifying the XACML eXtensible Access Control Markup Language policies that determine join points in a BPEL process where security is needed. Subsequently, BPEL flows with the needed security are generated into AspectBPEL security aspects to be weaved in the aforementioned process. The main contributions of our approach are: a describing dynamic security policies using a standard language XACML, b generating automatically the AspectBPEL aspects of the XACML policies and c separating the business and security concerns of composite web services, hence developing and updating them separately at the BPEL side.

A Multiple-Policy supported Attribute-Based Access Control Architecture within Large-scale Device Collaboration Systems

In order to collaborate large numbers of heterogeneous distributed devices over multiple domains within a modern large-scale device collaboration system, a fine-grained, flexible and secure approach is required for device authentication and authorization. This paper proposed a Multiple-Policy supported Attribute-Based Access Control model and its architecture to address these demands. With eXtensible Access Control Markup Language standard, this model exceeds the traditional Attribute-Based Access Control Model by providing cross-domain authentication and authorization, hierarchical policy combination and enforcement, unified device access control and fine-grained attributes-based privilege description. Experiments show the performance of this architecture is acceptable within production environment.

Formal Specification and Verification of Modular Security Policy Based on Colored Petri Nets

Security policies are one of the most fundamental elements of computer security. Current security policy design is concerned with the composition of components in security systems and interactions among them. Consequently, in a modular specification and verification of a policy, the composition of the modules must consistently assure security policies. A rigorous and systematic way to predict and assure such critical properties is crucial. This paper addresses the problem in a formal way. It uses colored Petri net process (CPNP) to specify and verify security policies in a modular way. It defines fundamental policy properties, i.e., completeness, termination, consistency, and confluence in Petri net terminology and gets some theoretical results. According to the eXtensible Access Control Markup Language (XACML) combiners and property preserving Petri net process algebra (PPPA), several policy composition operators are specified and property preserving results are stated for the policy correctness verification. As an application, the approach is illustrated for the design of Chinese Wall Policy.

Access Control Policy Translation, Verification, and Minimization within Heterogeneous Data Federations

Data federations provide seamless access to multiple heterogeneous and autonomous data sources pertaining to a large organization. As each source database defines its own access control policies for a set of local identities, enforcing such policies across the federation becomes a challenge. In this article, we first consider the problem of translating existing access control policies defined over source databases in a manner that allows the original semantics to be observed while becoming applicable across the entire data federation. We show that such a translation is always possible, and provide an algorithm for automating the translation. We show that verifying whether a translated policy obeys the semantics of the original access control policy defined over a source database is intractable, even under restrictive scenarios. We then describe a practical algorithmic framework for translating relational access control policies into their XML equivalent, expressed in the eXtensible Access Control Markup Language. Finally, we examine the difficulty of minimizing translated policies, and contribute a minimization algorithm applicable to nonrecursive translated policies.

Decision-cache based XACML authorisation and anonymisation for XML documents

This paper describes a decision cache for the eXtensible Access Control Markup Language (XACML) that supports fine-grained authorisation and anonymisation of XML based messages and documents down to XML attribute and element level. The decision cache is implemented as an XACML obligation service, where a specification of the XML elements to be authorised and anonymised is sent to the Policy Enforcement Point (PEP) during initial authorisation. Further authorisation of individual XML elements according to the authorisation specification is then performed on all matching XML resources, and decisions are stored in the decision cache. This makes it possible to cache fine-grained XACML authorisation and anonymisation decisions, which reduces the authorisation load on the Policy Decision Point (PDP). The theoretical solution is related to a practical case study consisting of a privacy-enhanced intrusion detection system that needs to perform anonymisation of Intrusion Detection Message Exchange Format (IDMEF) XML messages before they are sent to a security operations centre that operates in privacy-preserving mode. The solution increases the scalability of XACML based authorisation significantly, and may be instrumental in implementing federated authorisation and anonymisation based on XACML in several areas, including intrusion detection systems, web services, content management systems and GRID based authentication and authorisation.