Authors:
Alberto De la Rosa Algarín
1
;
Timoteus B. Ziminski
1
;
Steven A. Demurjian
1
;
Robert Kuykendall
2
and
Yaira K. Rivera Sánchez
1
Affiliations:
1
University of Connecticut, United States
;
2
Texas State University, United States
Keyword(s):
Security and Policy Modeling, Security Policies, XML, XACML, Role-based Access Control.
Related
Ontology
Subjects/Areas/Topics:
Access Control
;
Data Engineering
;
Databases and Data Security
;
Information and Systems Security
;
Internet Technology
;
Web Information Systems and Technologies
;
Web Security and Privacy
;
XML and Data Management
Abstract:
Securing electronic data has evolved into an important requirement in domains such as health care informatics, with the eXtensible Markup Language (XML) utilized to create standards such as the Clinical Document Architecture and the Continuity of Care Record, which have led to a need for approaches to secure XML schemas and documents. In this paper, we present a method for generating eXtensible Access Control Markup Language (XACML) policies that target XML schemas and their instances, allowing instances to be customized for users depending on their roles. To do so, we extend the Unified Modeling Language (UML) with two new diagrams to model XML: the XML Schema Class Diagram (XSCD) to define the structure of an XML document in UML style; and the XML Role-Slice Diagram (XRSD) to define roles and associated privileges at a granular access control level. In the process, we separate the XML schemas of an application from its security definition in XRSD. To demonstrate the enforcement of
our approach, we utilize a personal health assistant mobile application for health information management, which allows patients to share personal health data with providers utilizing XACML for security definition.
(More)