Securing context-aware applications using environment roles

ABSTRACT

In the future, a largely invisible and ubiquitous computing infrastructure will assist people with a variety of activities in the home and at work. The applications that will be deployed in such systems will create and manipulate private information and will provide access to a variety of other resources. Securing such applications is challenging for a number of reasons. Unlike traditional systems where access control has been explored, access decisions may depend on the context in which requests are made. We show how the well-developed notion of roles can be used to capture security-relevant context of the environment in which access requests are made. By introducing environment roles, we create a uniform access control framework that can be used to secure context-aware applications. We also present a security architecture that supports security policies that make use of environment roles to control access to resources.

REFERENCES

• 1: Elisa Bertino , Claudio Bettini , Elena Ferrari , Pierangela Samarati, Supporting Periodic Authorizations and Temporal Reasoning in Database Access Control, Proceedings of the 22th International Conference on Very Large Data Bases, p.472-483, September 03-06, 1996
• 2: Elisa Bertino , Claudio Bettini , Elena Ferrari , Pierangela Samarati, A Temporal Access Control Mechanism for Database Systems, IEEE Transactions on Knowledge and Data Engineering, v.8 n.1, p.67-80, February 1996 [doi>10.1109/69.485637]
• 3: Andrew D. Birrell, Butler W. Lampson, Roger M. Needham, and Michael D. Schroeder. A global authentication service without global trust. In Proceedings of the IEEE Symposium on Security and Privacy, pages 223-230, 1986.
• 4: Michael J. Covington, Matthew J. Moyer, and Mustaque Ahamad. Generalized role-based access control for securing future applications. In Proceedings of the National Information Systems Security Conference (NISSC), October 2000. Also appeared as technical report GIT-CC-00-02, available from the Georgia Tech College of Computing.
• 5: Anind K. Dey and Gregory D. Abowd. The context toolkit: Aiding the development of context-aware applications. In Workshop on Software Engineering for Wearable and Pervasive Computing, June 2000.
• 6: Anind K. Dey, Daniel Salber, and Gregory D. Abowd. A context-based infrastructure for smart environments. In Proceedings of the 1st International Workshop on Managing Interactions in Smart Environments (MANSE '99), Dublin, Ireland, pages 114-128, December 1999.
• 7: David F. Ferraiolo , John F. Barkley , D. Richard Kuhn, A role-based access control model and reference implementation within a corporate intranet, ACM Transactions on Information and System Security (TISSEC), v.2 n.1, p.34-64, Feb. 1999 [doi>10.1145/300830.300834]
• 8: Morrie Gasser, Andy Goldstein, Charlie Kaufman, and Butler Lampson. The digital distributed system security architecture. In Proceedings of the National Computer Security Conference, pages 305-319. NIST/NCSC, October 1989.
• 9: Luigi Giuri , Pietro Iglio, Role templates for content-based access control, Proceedings of the second ACM workshop on Role-based access control, p.153-159, November 06-07, 1997, Fairfax, Virginia, United States [doi>10.1145/266741.266773]
• 10: R. J. Hayton, J. M. Bacon, and K. Moody. Access control in an open distributed environment. In Proceedings of the IEEE Symposium on Security and Privacy, pages 3-14, 1998.
• 11: Amir Herzberg , Yosi Mass , Joris Michaeli , Yiftach Ravid , Dalit Naor, Access Control Meets Public Key Infrastructure, Or: Assigning Roles to Strangers, Proceedings of the 2000 IEEE Symposium on Security and Privacy, p.2, May 14-17, 2000
• 12: Georgia Tech Broadband Institute. The Aware Home Research Initiative. Research Initiative Web Page, 2000. http://www.cc.gatech.edu/fce/ahri/.
• 13: Sushil Jajodia , Pierangela Samarati , V. S. Subrahmanian , Eliza Bertino, A unified framework for enforcing multiple access control policies, Proceedings of the 1997 ACM SIGMOD international conference on Management of data, p.474-485, May 11-15, 1997, Tucson, Arizona, United States
• 14: Cory D. Kidd, Thomas O'Connell, Kris Nagel, Sameer Patil, and Gregory D. Abowd. Building a better intercom: Context-mediated communication within the home. Technical Report GIT-GVU-00-27. GVU Center, Georgia Institute of Technology. June 2000.
• 15: D. Moore, I. Essa, and M. Hayes. Exploiting human actions and object context for recognition tasks. In IEEE International Conference on Computer Vision, 1999.
• 16: Matthew J. Moyer and Mustaque Ahamad. Generalized role based access control. Technical Report GIT-CC-00-16, College of Computing, Georgia Institute of Technology, September 2000.
• 17: Ronald L. Rivest and Butler Lampson. SDSI - a simple distributed security infrastructure. SDSI Version 1.1, October 1996.
• 18: Ravi S. Sandhu. Role based access control. In Advances in Computers, volume 46. Academic Press, 1998.
• 19: Ravi S. Sandhu , Edward J. Coyne , Hal L. Feinstein , Charles E. Youman, Role-Based Access Control Models, Computer, v.29 n.2, p.38-47, February 1996 [doi>10.1109/2.485845]
• 20: HongHai Shen , Prasun Dewan, Access control for collaborative environments, Proceedings of the 1992 ACM conference on Computer-supported cooperative work, p.51-58, November 01-04, 1992, Toronto, Ontario, Canada [doi>10.1145/143457.143461]
• 21: Thomas Y. C. Woo and Simon S. Lam. Designing a distributed authorization service. In Proceedings of IEEE INFOCOM, March 1998.

INDEX TERMS

Primary Classification:
  K. Computing Milieux
  K.6 MANAGEMENT OF COMPUTING AND INFORMATION SYSTEMS

Additional Classification:
  C. Computer Systems Organization
  C.2 COMPUTER-COMMUNICATION NETWORKS

  D. Software
  D.4 OPERATING SYSTEMS

  K. Computing Milieux
  K.4 COMPUTERS AND SOCIETY

General Terms:
Design, Management, Performance, Security, Standardization, Theory

Keywords:
context aware computing, role-based access control