Context-aware role-based access control in pervasive computing systems

ABSTRACT

In this paper we present a context-aware RBAC (CARBAC) model for pervasive computing applications. The design of this model has been guided by the context-based access control requirements of such applications. These requirements are related to users' memberships in roles, permission executions by role members, and context-based dynamic integration of services in the environment with an application. Context information is used in role admission policies, in policies related to permission executions by role members, and in policies related to accessing of dynamically interfaced services by role members. The dynamic nature of context information requires model-level support for revocations of role memberships and permission activations when certain context conditions fail to hold. Based on this model we present a programming framework for building context-aware applications, providing mechanisms for specifying and enforcing context-based access control requirements.

REFERENCES

• 1: Gregory D. Abowd , Anind K. Dey , Peter J. Brown , Nigel Davies , Mark Smith , Pete Steggles, Towards a Better Understanding of Context and Context-Awareness, Proceedings of the 1st international symposium on Handheld and Ubiquitous Computing, p.304-307, September 27-29, 1999, Karlsruhe, Germany
• 2: Tanvir Ahmed , Anand R. Tripathi, Specification and verification of security requirements in a programming model for decentralized CSCW systems, ACM Transactions on Information and System Security (TISSEC), v.10 n.2, p.7-es, May 2007 [doi>10.1145/1237500.1237503]
• 3: Gail-Joon Ahn , Ravi Sandhu, Role-based authorization constraints specification, ACM Transactions on Information and System Security (TISSEC), v.3 n.4, p.207-226, Nov. 2000 [doi>10.1145/382912.382913]
• 4: Jean Bacon , Ken Moody , Walt Yao, A model of OASIS role-based access control and its support for active security, ACM Transactions on Information and System Security (TISSEC), v.5 n.4, p.492-540, November 2002 [doi>10.1145/581271.581276]
• 5: J. E. Bardram, T. R. Hansen, M. Mogensen, and M. Søgaard. Experiences from Real-World Deployment of Context-Aware Technologies in a Hospital Environment. In Ubicomp, pages 369--386, 2006.
• 6: Elisa Bertino , Barbara Catania , Maria Luisa Damiani , Paolo Perlasca, GEO-RBAC: a spatially aware RBAC, Proceedings of the tenth ACM symposium on Access control models and technologies, June 01-03, 2005, Stockholm, Sweden [doi>10.1145/1063979.1063985]
• 7: R. Campbell, J. Al-Muhtadi, P. Naldurg, G. Sampemane, and M. D. Mickunas. Towards Security and Privacy for Pervasive Computing. In Lecture Notes in Computer Science Software Security - Theories and Systems, volume 2609, pages 77--82. Springer, 2003.
• 8: Technology for Care Networks of Elders, IEEE Pervasive Computing, v.3 n.2, p.22-29, April 2004 [doi>10.1109/MPRV.2004.1316814]
• 9: Michael J. Covington , Wende Long , Srividhya Srinivasan , Anind K. Dev , Mustaque Ahamad , Gregory D. Abowd, Securing context-aware applications using environment roles, Proceedings of the sixth ACM symposium on Access control models and technologies, p.10-20, May 2001, Chantilly, Virginia, United States [doi>10.1145/373256.373258]
• 10: Jason Crampton, Specifying and enforcing constraints in role-based access control, Proceedings of the eighth ACM symposium on Access control models and technologies, June 02-03, 2003, Como, Italy [doi>10.1145/775412.775419]
• 11: Nigel Davies , Keith Cheverst , Keith Mitchell , Alon Efrat, Using and Determining Location in a Context-Sensitive Tour Guide, Computer, v.34 n.8, p.35-41, August 2001 [doi>10.1109/2.940011]
• 12: Mark Evered , Serge Bögeholz, A case study in access control requirements for a Health Information System, Proceedings of the second workshop on Australasian information security, Data Mining and Web Intelligence, and Software Internationalisation, p.53-61, January 01, 2004, Dunedin, New Zealand
• 13: David F. Ferraiolo , Ravi Sandhu , Serban Gavrila , D. Richard Kuhn , Ramaswamy Chandramouli, Proposed NIST standard for role-based access control, ACM Transactions on Information and System Security (TISSEC), v.4 n.3, p.224-274, August 2001 [doi>10.1145/501978.501980]
• 14: A. Fitzpatrick, G. Biegel, S. Clarke, and V. Cahill. Towards a Sentient Object Model. In Workshop on Engineering Context-Aware Object-Oriented Systems and Environments (ECOOSE), November 2002.
• 15: M. Ge and S. L. Osborn. A Design for Parameterized Roles. In DBSec, pages 251--264, 2004.
• 16: Christos K. Georgiadis , Ioannis Mavridis , George Pangalos , Roshan K. Thomas, Flexible team-based access control using contexts, Proceedings of the sixth ACM symposium on Access control models and technologies, p.21-27, May 2001, Chantilly, Virginia, United States [doi>10.1145/373256.373259]
• 17: Luigi Giuri , Pietro Iglio, Role templates for content-based access control, Proceedings of the second ACM workshop on Role-based access control, p.153-159, November 06-07, 1997, Fairfax, Virginia, United States [doi>10.1145/266741.266773]
• 18: Terry Halpin, Information modeling and relational databases: from conceptual analysis to logical design, Morgan Kaufmann Publishers Inc., San Francisco, CA, 2001
• 19: Karen Henricksen , Jadwiga Indulska, A Software Engineering Framework for Context-Aware Pervasive Computing, Proceedings of the Second IEEE International Conference on Pervasive Computing and Communications (PerCom'04), p.77, March 14-17, 2004
• 20: Anita K. Jones , Barbara H. Liskov, A language extension for expressing constraints on data access, Communications of the ACM, v.21 n.5, p.358-367, May 1978 [doi>10.1145/359488.359493]
• 21: James B. D. Joshi , Elisa Bertino , Usman Latif , Arif Ghafoor, A Generalized Temporal Role-Based Access Control Model, IEEE Transactions on Knowledge and Data Engineering, v.17 n.1, p.4-23, January 2005 [doi>10.1109/TKDE.2005.1]
• 22: Patrick McDaniel, On context in authorization policy, Proceedings of the eighth ACM symposium on Access control models and technologies, June 02-03, 2003, Como, Italy [doi>10.1145/775412.775422]
• 23: T. Moses. OASIS eXtensible Access Control Markup Language (XACML) Version 2.0, OASIS Standard. pages 1--141, 1 February 2005.
• 24: Gustaf Neumann , Mark Strembeck, An approach to engineer and enforce context constraints in an RBAC environment, Proceedings of the eighth ACM symposium on Access control models and technologies, June 02-03, 2003, Como, Italy [doi>10.1145/775412.775421]
• 25: U. Nitsche, R. Holbein, O. Morger, and S. Teufel. Realization of a Context-Dependent Access Control Mechanism on a Commercial Platform. In Proceedings of IFIP/SEC 1998. Chapman & Hall.
• 26: Jaehong Park , Ravi Sandhu, The UCON_ABC usage control model, ACM Transactions on Information and System Security (TISSEC), v.7 n.1, p.128-174, February 2004 [doi>10.1145/984334.984339]
• 27: Daniel Salber , Anind K. Dey , Gregory D. Abowd, The context toolkit: aiding the development of context-enabled applications, Proceedings of the SIGCHI conference on Human factors in computing systems: the CHI is the limit, p.434-441, May 15-20, 1999, Pittsburgh, Pennsylvania, United States [doi>10.1145/302979.303126]
• 28: Geetanjali Sampemane , Prasad Naldurg , Roy H. Campbell, Access Control for Active Spaces, Proceedings of the 18th Annual Computer Security Applications Conference, p.343, December 09-13, 2002
• 29: B. Schilit, N. Adams, and R. Want. Context-Aware Computing Applications. In IEEE Workshop on Mobile Computing Systems and Applications, pages 85--90, Santa Cruz, CA, US, 1994.
• 30: Yuanchun Shi , Weikai Xie , Guangyou Xu , Runting Shi , Enyi Chen , Yanhua Mao , Fang Liu, The Smart Classroom: Merging Technologies for Seamless Tele-education, IEEE Pervasive Computing, v.2 n.2, p.47-55, April 2003 [doi>10.1109/MPRV.2003.1203753]
• 31: T. Strang and C. Linnhoff-Popien. A Context Modeling Survey. In Workshop on Advanced Context Modelling, Reasoning and Management as part of UbiComp 2004 - The Sixth International Conference on Ubiquitous Computing, September 2004.
• 32: Roshan K. Thomas, Team-based access control (TMAC): a primitive for applying role-based access controls in collaborative environments, Proceedings of the second ACM workshop on Role-based access control, p.13-19, November 06-07, 1997, Fairfax, Virginia, United States [doi>10.1145/266741.266748]
• 33: Anand R. Tripathi , Devdatta Kulkarni , Tanvir Ahmed, A specification model for context-based collaborative applications, Pervasive and Mobile Computing, v.1 n.1, p.21-42, March 2005 [doi>10.1016/j.pmcj.2005.01.005]
• 34: Anand R. Tripathi , Devdatta Kulkarni , Harsha Talkad , Muralidhar Koka , Sandeep Karanth , Tanvir Ahmed , Ivan Osipkov, Autonomic configuration and recovery in a mobile agent-based distributed event monitoring system: Research Articles, Software—Practice & Experience, v.37 n.5, p.493-522, April 2007 [doi>10.1002/spe.v37:5]
• 35: Xiao Hang Wang , Da Qing Zhang , Tao Gu , Hung Keng Pung, Ontology Based Context Modeling and Reasoning using OWL, Proceedings of the Second IEEE Annual Conference on Pervasive Computing and Communications Workshops, p.18, March 14-17, 2004

INDEX TERMS

Primary Classification:
  K. Computing Milieux
  K.6 MANAGEMENT OF COMPUTING AND INFORMATION SYSTEMS
      K.6.5 Security and Protection (D.4.6, K.4.2)

Additional Classification:
  D. Software
  D.2 SOFTWARE ENGINEERING
      D.2.6 Programming Environments

General Terms:
Design, Experimentation, Languages, Security

Keywords:
RBAC, context-aware computing, context-based access control, pervasive computing