Usage Control: A Solution to Access Control in a Distributed-Network-Connected Environment

Abstract:

Computer and information technology has evaded our every aspect of life. Information technology is seen in all aspect of the individual from banking and investing to shopping and communicating through the use of the internet services such as emails and chat rooms. Organizations and industries also utilize computer and information technology to collect information on individuals leading to the creation of warehouse of databases that enable them to achieve their objectives. In a distributed network environment today, information security is a very important issue in ensuring a safe computing environment.

• Periodical: Applied Mechanics and Materials (Volumes 513-517)
• Pages: 742-749
• DOI: https://doi.org/10.4028/www.scientific.net/AMM.513-517.742
• Online since: February 2014
• Authors: Patricia Ghann*, Chang Da Wang, Cong Hua Zhou
• Keywords: Access Control (AC), Digital Resource, Obligation, Transition State, Usage Control (UCON)

References

[1] A. Lazouski, F. Martinelli, P. Mori, Usage Control in Computer Security: A survey. (2010).

[2] B. Katt, X. Zhang, R. Breu, M. Hafner, J. ­P. Seifert, A general obligation model and continuity: Enhanced policy enforcement engine for usage control, in: SACMAT. 08: Proceedings of the 13th ACM Symposium on Access Control Models and Technologies, ACM, New York, NY, USA, (2008).

DOI: 10.1145/1377836.1377856

[3] Claudio Bettini, Sushil Jajodia, X. Sean Wang, Duminda Wijesekera, Obligation Monitoring in Policy Management.

[4] M. Hilty, D. Basin, A. Pretschner, On obligations, in: Proceedings of ESORICS (2005).

[5] J. Park, Usage control: A unified framework for next generation access control, Ph.D. Thesis, George Mason University, Fairfax, VA, USA, (2003).

[6] X. Zhang, Formal model and analysis of usage control, Ph.D. Thesis, George Mason University, Fairfax, VA, USA, (2006).

[7] J. Park, R. Sandhu, The UCON ABC usage control model, ACM Trans. Inf. Syst. Secur. 7 (1) (2004) 128. 174.

DOI: 10.1145/984334.984339

[8] J. Park, R. Sandhu, Towards usage control models: Beyond traditional access control, in: SACMAT. 02: Proceedings of the Seventh ACM Symposium on Access Control Models and Technologies, ACM, New York, NY, USA, 2002, p.57. 64.

DOI: 10.1145/507711.507722

[9] R. Sandhu, K. Ranganathan, X. Zhang, Secure information sharing enabled by trusted computing and PEI models, in: ASIACCS. 06: Proceedings of ACM Symposium on Information, Computer and Communications Security, ACM, New York, NY, USA, (2006).

DOI: 10.1145/1128817.1128820

[10] R.S. Sandhu, J. Park, Usage control: A vision for next generation access control, in: MMM­ACNS, in: Lecture Notes in Computer Science, (2003).

DOI: 10.1007/978-3-540-45215-7_2

[11] J. Park, X. Zhang, R.S. Sandhu, Attribute mutability in usage control, in: DBSec, Kluwer, (2004).

[12] W. Yao, K. Moody, J. Bacon, A model of OASIS role based access control and its support for active security, in: SACMAT. 01: Proceedings of the Sixth ACM Symposium on Access Control Models and Technologies, ACM, New York, NY, USA, (2001).

DOI: 10.1145/373256.373294

[13] A. Pretschner, M. Hilty, D. Basin, Distributed usage control, Commun. ACM 49 (9) (2006) 39. 44.

DOI: 10.1145/1151030.1151053

[14] X. Zhang, F. Parisi­Presicce, R. Sandhu, J. Park, Formal model and policy specification of usage control, ACM Trans. Inf. Syst. Secur. 8 (4) (2005) 351. 387.

DOI: 10.1145/1108906.1108908

[15] S.D.C. di Vimercati, S. Paraboschi, P. Samarati, Access control: Principles and solutions, Softw. Pract. Exper. 33 (5) (2003) 397. 421.

DOI: 10.1002/spe.513

[16] R. Sandhu, Engineering authority and trust in cyberspace: The OM­AM and RBAC way, in: In Proceedings of 5th ACM Workshop on Role Based Access Control, ACM, 2000, p.111. 119.

DOI: 10.1145/344287.344309

[17] W. Ku, C. ­H. Chi, Survey on the technological aspects of digital rights management, in: Information Security, 2004, p.391. 403.

DOI: 10.1007/978-3-540-30144-8_33

[18] H.L. Jonker, S. Mauw, J.H.S. Verschuren, A.T.S.C. Schoonen, Security aspects of DRM systems, in: 25th Symposium on Information Theory in the Benelux, 2004, p.169. 176.

[19] M. Sastry, R. Krishnan, R. Sandhu, A new modeling paradigm for dynamic authorization in multi­domain systems, in: communications in Computer and Information Science, vol. 1, Springer, Berlin, Heidelberg, 2007, p.153. 158.

DOI: 10.1007/978-3-540-73986-9_13

[20] L. Lamport, The temporal logic of actions, ACM Trans. Program. Lang. Syst. 16 (3) (1994) 872. 923.

DOI: 10.1145/177492.177726

[21] W. Shin, S.B. Yoo, Secured web services based on extended usage control, in: PAKDD Workshops, in: Lecture Notes in Computer Science, vol. 4819, Springer, 2007, p.656. 663.

DOI: 10.1007/978-3-540-77018-3_65

[22] Z. Zhang, L. Yang, Q. Pei, J. Ma, Research on usage control model with delegation characteristics based on OM­AM methodology, in: NPC. 2007: Proceedings of Network and Parallel Computing Workshops, 2007, p.238. 243.

DOI: 10.1109/npc.2007.103

[23] P. Gama, P. Ferreira, Obligation policies: An enforcement platform, in: POLICY. 05: Proceedings of the Sixth IEEE International Workshop on Policies for Distributed Systems and Networks, IEEE Computer Society, Washington, DC, USA, 2005, p.203.

DOI: 10.1109/policy.2005.18