Concurrent History-based Usage Control Policies

Fabio Martinelli, Ilaria Matteucci, Paolo Mori, Andrea Saracino

Abstract

The sharing of data and resources is one of the cornerstones of our society. However, this comes together with several challenges regarding the increasing need of guaranteeing security and privacy during both the access and the usage of such shared resources. Access control policies first, and usage control policies secondly, have been introduced to overcome issues related to the access and usage of resources. However, the introduction of distributed and cloud systems to share data and resources enables the concurrent and shared access to the same resources. Here we present an enhanced version of History-based Usage Control policies in which we are able to manage concurrent access and usage of resources by several subjects, whose actions may influence one another. Moreover, to ease the understanding of the proposed approach, we present a reference example where a document is shared among a set of people having different roles in a company.

References

  1. Aktug, I. and Naliuka, K. (2008). ConSpec - A formal language for policy specification. Science of Computer Programming. Special Issue on Security and Trust, 74(1):2 - 12.
  2. Baiardi, F., Martinelli, F., Mori, P., and Vaccarelli, A. (2004). Improving grid services security with fine grain policies. In On the Move to Meaningful Internet Systems 2004: Confederated International Workshops and Posters, GADA, JTRES, MIOS, WORM, WOSE, PhDS, and INTEROP 2004, Agia Napa, Cyprus, October 25-29, 2004. Proceedings, pages 123-134.
  3. Colombo, M., Lazouski, A., Martinelli, F., and Mori, P. (2010). A proposal on enhancing xacml with continuous usage control features. In Grids, P2P and Services Computing, pages 133-146, Boston, MA. Springer US.
  4. Kelbert, F. and Pretschner, A. (2014). Decentralized distributed data usage control. In Cryptology and Network Security: 13th International Conference, CANS 2014, Heraklion, Crete, Greece, October 22-24, 2014. Proceedings, pages 353-369, Cham. Springer International Publishing.
  5. Kelbert, F. and Pretschner, A. (2015). A fully decentralized data usage control enforcement infrastructure. In Applied Cryptography and Network Security: 13th International Conference, ACNS 2015, New York, NY, USA, June 2-5, 2015, Revised Selected Papers, pages 409-430, Cham. Springer International Publishing.
  6. Lazouski, A., Martinelli, F., Mori, P., and Saracino, A. (2014). Stateful usage control for android mobile devices. In Security and Trust Management - 10th International Workshop, STM 2014, Wroclaw, Poland, September 10-11, 2014. Proceedings, pages 97-112.
  7. Lazouski, A., Martinelli, F., Mori, P., and Saracino, A. (2016). Stateful data usage control for android mobile devices. International Journal of Information Security, pages 1-25.
  8. Martinelli, F., Matteucci, I., Mori, P., and Saracino, A. (2016). Enforcement of U-XACML history-based usage control policy. In Security and Trust Management - 12th International Workshop, STM 2016, Heraklion, Crete, Greece, September 26-27, 2016, Proceedings, volume 9871 of Lecture Notes in Computer Science, pages 64-81. Springer.
  9. Martinelli, F. and Mori, P. (2007). Enhancing java security with history based access control. In Foundations of Security Analysis and Design IV, pages 135-159. Springer-Verlag.
  10. Martinelli, F. and Mori, P. (2010). On usage control for grid systems. Future Generation Computer Systems, 26(7):1032-1042.
  11. Neisse, R., Pretschner, A., and Di Giacomo, V. (2013). A trustworthy usage control enforcement framework. International Journal of Mobile Computing and Multimedia, 5(3):34-49.
  12. OASIS (2013). eXtensible Access Control Markup Language (XACML) Ver. 3.0.
  13. Park, J. and Sandhu, R. (2004). The UCONABC usage control model. ACM Transactions on Information and System Security, 7:128-174.
  14. Zhang, X., Nakae, M., Covington, M. J., and Sandhu, R. (2008). Toward a usage-based security framework for collaborative computing systems. ACM Transactions on Information and System Security, 11(1):3:1-3:36.
  15. Zhang, X., Parisi-Presicce, F., Sandhu, R., and Park, J. (2005). Formal model and policy specification of usage control. ACM Transactions on Information and System Security, 8(4):351-387.
  16. <?xml version="1.0" encoding="UTF-8"?>
Download


Paper Citation


in Harvard Style

Martinelli F., Matteucci I., Mori P. and Saracino A. (2017). Concurrent History-based Usage Control Policies . In Proceedings of the 5th International Conference on Model-Driven Engineering and Software Development - Volume 1: MODELSWARD, ISBN 978-989-758-210-3, pages 657-666. DOI: 10.5220/0006232506570666


in Bibtex Style

@conference{modelsward17,
author={Fabio Martinelli and Ilaria Matteucci and Paolo Mori and Andrea Saracino},
title={Concurrent History-based Usage Control Policies},
booktitle={Proceedings of the 5th International Conference on Model-Driven Engineering and Software Development - Volume 1: MODELSWARD,},
year={2017},
pages={657-666},
publisher={SciTePress},
organization={INSTICC},
doi={10.5220/0006232506570666},
isbn={978-989-758-210-3},
}


in EndNote Style

TY - CONF
JO - Proceedings of the 5th International Conference on Model-Driven Engineering and Software Development - Volume 1: MODELSWARD,
TI - Concurrent History-based Usage Control Policies
SN - 978-989-758-210-3
AU - Martinelli F.
AU - Matteucci I.
AU - Mori P.
AU - Saracino A.
PY - 2017
SP - 657
EP - 666
DO - 10.5220/0006232506570666