Policy expression and checking in XACML, WS-Policies, and the jABC

ABSTRACT

Web-based access to sensitive and confidential data is realized today via different approaches, using a variety of methods to specify and combine access control policies. In an optic of change management and evolution, a structured and flexible model is needed to handle dynamicity, particularly when handling rights in systems with many users which hold different roles. Furthermore the validation of security constraints is an important key to warrant the reliability of control mechanisms.

This paper compares the temporal logic-based approach for modeling access control used by the jABC framework with two popular XML-based description languages (XACML and WS-Policy), which are quasi-standards for policy expression in Web applications. Its usage is illustrated here on the example of the web-based Online Conference Service (OCS). The respective functionalities are described and examined in consideration of their ability to validate and enforce the needed policies.

REFERENCES

• 1: T. Moses (Ed.): eXtensible Access Control Markup Language (XACML) Version 2.0, Feb. 2005 http://docs.oasis-open.org/xacml/2.0/access_control-xacml-2.0-core-spec-os. pdf,
• 2: P. Griffin: Introduction to XACML, February 2004 http://dev2dev.bea.com/pub/a/2004/02/xacml.html
• 3: B. Siddharth et al.: Web Services Policy 1.2 - Framework (WS-Policy), April 2006, http://www.w3.org/Submission/2006/SUBM-WS-Policy-20060425/
• 4: E. A. Emerson, C. S. Jutla, A. P. Sistla. On model-checking for fragments of μ-calculus. 1993.
• 5: G. Hughes, T. Bultan: Automated Verification of XACML Policies Using a SAT Solver. WQVV 2007, Worksh. on Web Quality, Verification and Validation, at 7th ICWE, Como (I), July 2007, Worksh. Proc. pp. 378--392.
• 6: Martin Karusseit , Tiziana Margaria, A Web-Based Runtime-Reconfigurable Role Management Service, Proceedings of the 2nd Int'l. Workshop on Automated Specification and Verification of Web Systems, p.53-60, November 19-19, 2006 [doi>10.1109/WWV.2006.5]
• 7: M. Karusseit, T. Margaria: Feature-based Modelling of a Complex, Online-Reconfigurable Decision Support Service Proc. WWV '05, 1st Int. Worksh. on Automated Specification and Verification of Web Sites, Valencia (E), March 2005, ENTCS N. 1132.
• 8: Tiziana Margaria , Martin Karusseit, Community Usage of the Online Conference Service: an Experience Report from three CS Conferences, Proceedings of the IFIP Conference on Towards The Knowledge Society: E-Commerce, E-Business, E-Government, p.497-511, October 07-09, 2002
• 9: jABC: JavaABC Framework http://www.jABC.de
• 10: B. Steffen, T. Margaria, R. Nagel, S. Jörges, C. Kubczak: Model-Driven Development with the jABC, Proc. HVC '06, IBM Haifa Verification Conf., Haifa (IL), LNCS 4383, Springer Verlag, 2006.
• 11: Tiziana Margaria , Bernhard Steffen, Service Engineering: Linking Business and IT, Computer, v.39 n.10, p.45-55, October 2006 [doi>10.1109/MC.2006.355]
• 12: Bernhard Steffen , Prakash Narayan, Full Life-Cycle Support for End-to-End Processes, Computer, v.40 n.11, p.64-73, November 2007 [doi>10.1109/MC.2007.386]
• 13: Sven Jörges , Tiziana Margaria , Bernhard Steffen, FormulaBuilder: a tool for graph-based modelling and generation of formulae, Proceedings of the 28th international conference on Software engineering, May 20-28, 2006, Shanghai, China [doi>10.1145/1134285.1134422]
• 14: OASIS http://www.oasis-open.org/home/index.php
• 15: Della-Libera et al.: Web Services Security Policy Language (WS-SecurityPolicy) Version 1.1, July 2005 http://specs.xmlsoap.org/ws/2005/07/securitypolicy/ws-securitypolicy.pdf
• 16: D. Box et al.: Web Services Policy Assertions Language (WS-PolicyAssertions) Version 1.1, May 2003 http://xml.coverpages.org/ws-policyassertionsV11.pdf
• 17: K. Ballinger et al.: Web Services Metadata Exchange (WS-MetadataExchange) Version 1.1 August 2006 http://specs.xmlsoap.org/ws/2004/09/mex/WS-MetadataExchange.pdf,
• 18: M. Bakera, T. Margaria, C. Renner, B. Steffen: Game-based Model Checking for Reliable Autonomy, SMC-IT '06, 2nd IEEE Int. Conf. on Space Mission Challenges for Information Technology, Workshop on Autonomous and Autonomic Systems, July 2006.

INDEX TERMS

Primary Classification:
  H. Information Systems
  H.3 INFORMATION STORAGE AND RETRIEVAL
      H.3.5 On-line Information Services
          Subjects: Web-based services

Additional Classification:
  D. Software
  D.2 SOFTWARE ENGINEERING
      D.2.4 Software/Program Verification
          Subjects: Model checking
  D.4 OPERATING SYSTEMS
      D.4.6 Security and Protection
          Subjects: Access controls

  H. Information Systems
  H.3 INFORMATION STORAGE AND RETRIEVAL
      H.3.4 Systems and Software

          Nouns: World Wide Web (WWW)

  I. Computing Methodologies
  I.7 DOCUMENT AND TEXT PROCESSING
      I.7.2 Document Preparation

          Nouns: XML

General Terms:
Algorithms, Design, Experimentation, Measurement, Performance, Security

Keywords:
access control, model checking, policies, validation