SmartGate: a smart push-pull approach to support role-based security in web gateways

ABSTRACT

Efficient and effective web gateways or proxy servers are important to control the access privileges of users and protect private networks that are connected to the Internet, thus providing a productive and safe web environment. Access control in the form of complex access rules based on users or user sets (groups) has been studied extensively. The objective of this work is to provide role-based (RB) security for web gateways utilizing Role-Based Access Control (RBAC). RB security reduces the administrative burden, provides fine grained access control and supports various constraints such as context-aware and temporal seamlessly.In this paper we elaborate on the problems, issues that need to be addressed, and our approach for providing RB security for web gateways by leveraging the flexibility and expressiveness of RBAC. Our approach enables the proxy server to act smarter, rather than just allow or deny access based on access rules, meanwhile preserving the principle of least privileges.

REFERENCES

• 1: Join Bill Rose and Joe Lenski, "Internet and Multimedia 12: The Value of Internet Broadcast Advertising," Arbiton IBS and Edison Media Research, 2004. {Online}: http://www.edisonresearch.com/Internet 12 Web cast.htm
• 2: "Surfing at Work: Corporate Networks Are Paying the Price," SurfControl, 2004. {Online}: http://www.surfcontrol.com/resources/whitepapers/
• 3: Brian E. Burke, "Content Security: The Business Value of Blocking Unwanted Content," IDC, 2003. {Online}: http://www.idc.com
• 4: "Surfing at Work: Ethics in Computing," Dept of CSC, North Carolina State University, Raleigh, NC. {Online}: http://ethics.csc.ncsu.edu/social/workplace/surfing/
• 5: "Web Filtering Products Feature Comparison," SurfControl, 2004. {Online}: http://www.surfcontrol.com/products/web/features.aspx
• 6: "Proxy SGTM: Advanced Web Proxy," Blue Coat Systems. {Online}: http://www.bluecoat.com/
• 7: "Websense Enterprise," Websense, 2004. {Online}: http://www.websense.com/products/about/Enterprise/
• 8: "Microsoft ISA Server," Microsoft, 2004. {Online}: http://www.microsoft.com/isaserver/techinfo/productdoc/2004.asp
• 9: "Border Manager," Novell, Inc., 2004. {Online}: http://www.novell.com/products/bordermanager/
• 10: "SurfControl Web Filter," SurfControl, 2004. {Online}: http://www.surfcontrol.com/products/web/
• 11: D. F. Ferraiolo, J. A. Cugini, and D. R. Kuhn, "Role-Based Access Control: Features and Motivations," in Proc. of CSAC, 1995.
• 12: Ravi S. Sandhu , Edward J. Coyne , Hal L. Feinstein , Charles E. Youman, Role-Based Access Control Models, Computer, v.29 n.2, p.38-47, February 1996 [doi>10.1109/2.485845]
• 13: RBAC Standard, ANSI INCITS 359-2004, 2004.
• 14: The Economic Impact of RBAC, RTI Project Number: 07007.012, National Institute of Standards and Technology, 2002.
• 15: James B. D. Joshi , Basit Shafiq , Arif Ghafoor , Elisa Bertino, Dependencies and separation of duty constraints in GTRBAC, Proceedings of the eighth ACM symposium on Access control models and technologies, June 02-03, 2003, Como, Italy [doi>10.1145/775412.775420]
• 16: Generalized Role-Based Access Control, Proceedings of the The 21st International Conference on Distributed Computing Systems, p.391, April 16-19, 2001
• 17: Jean Bacon , Ken Moody , Walt Yao, A model of OASIS role-based access control and its support for active security, ACM Transactions on Information and System Security (TISSEC), v.5 n.4, p.492-540, November 2002 [doi>10.1145/581271.581276]
• 18: Joon S. Park , Ravi Sandhu , Gail-Joon Ahn, Role-based access control on the web, ACM Transactions on Information and System Security (TISSEC), v.4 n.1, p.37-71, Feb. 2001 [doi>10.1145/383775.383777]
• 19: R. Adaikkalavan et al., "Information Security: Using A Novel Event-Based Approach," in Proc. of IKE, USA, June 2004.
• 20: R. Adaikkalavan and S. Chakravarthy, "ED-RBAC: A Flexible Event-Based Framework for Enforcing RBAC and its Extensions," Dept. of CSE, The University of Texas at Arlington, Technical Report. CSE-2004-1, 2004.
• 21: C. Adams and S. Lloyd, Understanding PKI. Addison-Wesley, 2003.

INDEX TERMS

Keywords:
RB security, fire-walls, role-based access control, web gateways