The YGuard access control model: set-based access control

ABSTRACT

As Internet usage proliferates, resource security becomes both more important and more complex. Contemporary users and systems are ill-equipped to deal with the complex security demands of a ubiquitous, insecure network. The YGuard Access Control Model, developed at Brigham Young University, employs set-based access control lists, XML, and a modular architecture to provide users with an intuitive, extensible, and efficient method of controlling access to system resources. The implementation of YGuard in XWeb, a research project designed to replace HTTP, demonstrates the power and flexibility of the model and its potential for use in diverse modern systems. This paper examines the effectiveness of the YGuard Access Control Model in solving many of the access control problems associated with the modern, networked computing environment.

REFERENCES

• 1: Edward G. Amoroso, Fundamentals of computer security technology, Prentice-Hall, Inc., Upper Saddle River, NJ, 1994
• 2: Elisa Bertino , Silvana Castano , Elena Ferrari , Marco Mesiti, Controlled access and dissemination of XML documents, Proceedings of the 2nd international workshop on Web information and data management, p.22-27, November 02-06, 1999, Kansas City, Missouri, United States [doi>10.1145/319759.319770]
• 3: T. Bray, J. Paoli, C. M. Sperberg-McQueen, and E. Maler. Extensible Markup Language (XML) 1.0 (Second Edition)". w3c Website, October 2000. W3C Recommendation 6 October 2000. <http://www.w3.org/TR/REC-xml>.
• 4: N. C. S. Center. Trusted UNIX Working Group (TRUSIX) rationale for selecting access control list features for the UNIX system. Government Report, NCSC-TG ; 020-A, Fort George G. Meade, MD : The Center, {1990}, August 1989.
• 5: Dan R. Olsen, Jr. , Sean Jefferies , Travis Nielsen , William Moyes , Paul Fredrickson, Cross-modal interaction using XWeb, Proceedings of the 13th annual ACM symposium on User interface software and technology, p.191-200, November 06-08, 2000, San Diego, California, United States [doi>10.1145/354401.354764]
• 6: Glenn Faden, RBAC in UNIX administration, Proceedings of the fourth ACM workshop on Role-based access control, p.95-101, October 28-29, 1999, Fairfax, Virginia, United States [doi>10.1145/319171.319180]
• 7: D. Ferraiolo and R. Kuhn. Role Based Access Control. In Proceedings of the 15th National Computer Security Conference, 1992.
• 8: H. M. Gladney. Administrative Control of Computing Services. IBM Systems Journal, 17(2):151-178, 1978.
• 9: H. M. Gladney, J.J. Meyers, and E. L. Worley. Access Control Mechanism for Computing Resources. IBM Systems Journal, 14(3):212-228, 1975.
• 10: J. Franks et al. HTTP Authentication: Basic and Digest Access Authentication. Network Working Group: RFC 2617, June 1999. <ftp://ftp.isi.edu/in-notes/rfc2617.txt>.
• 11: Jonathan Robie, Joe Lapp and David Schach. "XML Query Language (XQL)". w3c Website, September 1998. Proposal to the W3C QL98 Workshop. <http://www.w3.org/TandS/QL/QL98/pp/xql.html>.
• 12: Microsoft Corporation. Secure Internet Information Services 5 Checklist. Microsoft Tech NetWeb Site, 21 August 2000. <http://www.microsoft.com/technet/security/iis5chk.asp>.
• 13: James H. Morris , Mahadev Satyanarayanan , Michael H. Conner , John H. Howard , David S. Rosenthal , F. Donelson Smith, Andrew: a distributed personal computing environment, Communications of the ACM, v.29 n.3, p.184-201, March 1986 [doi>10.1145/5666.5671]
• 14: Chris Andrew , Brian Brown , Bill Bodine, Novell's Nds Developer's Guide with Cdrom, Hungry Minds, Incorporated, 1998
• 15: David A. Solomon , Helen Custer, Inside Windows NT, Microsoft Press, Redmond, WA, 1998
• 16: The Apache Software Foundation. "Module mod access". Apache HTTP Server Version 1.3 Online Documentation, August 2000. <http://www.apache.org/docs/mod/mod access.html>.

INDEX TERMS

Primary Classification:
  D. Software
  D.4 OPERATING SYSTEMS
      D.4.6 Security and Protection
          Subjects: Access controls

Additional Classification:
  H. Information Systems
  H.3 INFORMATION STORAGE AND RETRIEVAL
      H.3.5 On-line Information Services
          Subjects: Web-based services
  H.5 INFORMATION INTERFACES AND PRESENTATION (I.7)
      H.5.3 Group and Organization Interfaces

          Nouns: WEB

  I. Computing Methodologies
  I.7 DOCUMENT AND TEXT PROCESSING
      I.7.2 Document Preparation

          Nouns: XML

  K. Computing Milieux
  K.6 MANAGEMENT OF COMPUTING AND INFORMATION SYSTEMS

General Terms:
Design, Languages, Management, Performance, Security, Theory

Keywords:
XML, XSet, XWeb, YGuard, access control list, access control model, set