The UCONABC usage control model

ABSTRACT

In this paper, we introduce the family of UCON_ABC models for usage control (UCON), which integrate Authorizations (A), oBligations (B), and Conditions (C). We call these core models because they address the essence of UCON, leaving administration, delegation, and other important but second-order issues for later work. The term usage control is a generalization of access control to cover authorizations, obligations, conditions, continuity (ongoing controls), and mutability. Traditionally, access control has dealt only with authorization decisions on users' access to target resources. Obligations are requirements that have to be fulfilled by obligation subjects for allowing access. Conditions are subject and object independent environmental or system requirements that have to be satisfied for access. In today's highly dynamic, distributed environment, obligations and conditions are also crucial decision factors for richer and finer controls on usage of digital resources. Although they have been discussed occasionally in recent literature, most authors have been motivated from specific target problems and thereby limited in their approaches. The UCON_ABC model integrates these diverse concepts in a unified framework. Traditional authorization decisions are generally made at the time of requests but hardly recognize ongoing controls for relatively long-lived access or for immediate revocation. Moreover, mutability issues that deal with updates on related subject or object attributes as a consequence of access have not been systematically studied.Unlike other studies that have targeted on specific problems or issues, the UCON_ABC model seeks to enrich and refine the access control discipline in its definition and scope. UCON_ABC covers traditional access controls such as mandatory, discretionary, and role-based access control. Digital rights management and other modern access controls are also covered. UCON_ABC lays the foundation for next generation access controls that are required for today's real-world information and systems security. This paper articulates the core of this new area of UCON and develops several detailed models.

REFERENCES

• 1: Martín Abadi , Michael Burrows , Butler Lampson , Gordon Plotkin, A calculus for access control in distributed systems, ACM Transactions on Programming Languages and Systems (TOPLAS), v.15 n.4, p.706-734, Sept. 1993 [doi>10.1145/155183.155225]
• 2: Anderson, R. 2002. TCPA/palladium frequently asked questions. Available at http://www.cl.cam.ac.uk/˜rja14/tcpa-faq.html.
• 3: W. A. Arbaugh , D. J. Farber , J. M. Smith, A secure and reliable bootstrap architecture, Proceedings of the 1997 IEEE Symposium on Security and Privacy, p.65, May 04-07, 1997
• 4: D. B. Baker , R. M. Barnhart , T. T. Buss, PCASSO: applying and extending state-of-the-art security in the healthcare domain, Proceedings of the 13th Annual Computer Security Applications Conference, p.251, December 08-12, 1997
• 5: Bell, D. and LaPadula, L. 1973. Secure computer systems: Mathematical foundations and model. MITRE Report, MTR 2547, v2, November.
• 6: C. Bettini , S. Jajodia , X. Wang , D. Wijesekera, Obligation Monitoring in Policy Management, Proceedings of the 3rd International Workshop on Policies for Distributed Systems and Networks (POLICY'02), p.2, June 05-07, 2002
• 7: Matt Blaze , Joan Feigenbaum , Jack Lacy, Decentralized Trust Management, Proceedings of the 1996 IEEE Symposium on Security and Privacy, p.164, May 06-08, 1996
• 8: ContentGuard. 2002. XrML: Extensible rights Markup Language Core 2.1 Specification. Available at http://www.xrml.org.
• 9: Nicodemos Damianou , Naranker Dulay , Emil Lupu , Morris Sloman, The Ponder Policy Specification Language, Proceedings of the International Workshop on Policies for Distributed Systems and Networks, p.18-38, January 29-31, 2001
• 10: Godik, S. and Moses, T. 2002. OASIS eXtensible Access Control Markup Language (XACML) Specification 1.0. Available at http://www.oasis-open.org/committees/xacml/docs/.
• 11: Gligor, V., Gavrila, S., and Ferraiolo, D. 1998. On the formal definition of separation-of-duty policies and their composition. 19th IEEE Computer Society Symposium on Research in Security and Privacy.
• 12: C. Gunter , S. Weeks , A. Wright, Models and Languages for Digital Rights, Proceedings of the 34th Annual Hawaii International Conference on System Sciences ( HICSS-34)-Volume 9, p.9076, January 03-06, 2001
• 13: Michael A. Harrison , Walter L. Ruzzo , Jeffrey D. Ullman, Protection in operating systems, Communications of the ACM, v.19 n.8, p.461-471, Aug. 1976 [doi>10.1145/360303.360333]
• 14: Amir Herzberg , Yosi Mass , Joris Michaeli , Yiftach Ravid , Dalit Naor, Access Control Meets Public Key Infrastructure, Or: Assigning Roles to Strangers, Proceedings of the 2000 IEEE Symposium on Security and Privacy, p.2, May 14-17, 2000
• 15: HHS. 2002. Standards for Privacy of Individually Identifiable Health Information. Available at http://www.hhs.gov/ocr/hipaa/finalreg.html.
• 16: Iannella, R. 2002. Open Digital Rights Language V1.1. Available at http://odrl.net.
• 17: Jajodia, S., Kudo, M., and Subrahmanian, V. S. 2001. Provisional authorizations. In E-Commerce Security and Privacy, Anup Gosh (Ed.) Kluwer Academic Press, Boston, MA.
• 18: Kaplan, M. 1996. IBM Cryptolopes, Superdistribution and Digital Right Management. Available at http://www.research.ibm.com/people/k/kaplan.
• 19: Michiharu Kudo , Satoshi Hada, XML document security based on provisional authorization, Proceedings of the 7th ACM conference on Computer and communications security, p.87-96, November 01-04, 2000, Athens, Greece [doi>10.1145/352600.352613]
• 20: Landwehr, C. 1997. Protection (Security) Models and Policy The Computer Science and Engineering Handbook. CRC Press, Boco Raton, FL, 1914--1928.
• 21: Butler W. Lampson, Protection, ACM SIGOPS Operating Systems Review, v.8 n.1, p.18-24, January 1974 [doi>10.1145/775265.775268]
• 22: LaMacchia, B. 2002. Key challenges in DRM: An industry perspective. Proceedings of the 2nd ACM DRM Workshop (in conjunction with ACM CCS Conference) November.
• 23: MIT 2001. Ten emerging technologies that will change the world. MIT Technology Review (Jan/Feb).
• 24: P3P 2002. The Platform for Privacy Preferences 1.0 (P3P1.0) Specification. Available at http://www.w3.org/P3P/.
• 25: Jaehong Park , Ravi Sandhu, Towards usage control models: beyond traditional access control, Proceedings of the seventh ACM symposium on Access control models and technologies, June 03-04, 2002, Monterey, California, USA [doi>10.1145/507711.507722]
• 26: William Rosenblatt , Stephen Mooney , William Trippe, Digital Rights Management: Business and Technology, John Wiley & Sons, Inc., New York, NY, 2001
• 27: Tatyana Ryutov , B. Clifford Neuman, The Set and Function Approach to Modeling Authorization in Distributed Systems, Proceedings of the International Workshop on Information Assurance in Computer Networks: Methods, Models, and Architectures for Network Security, p.189-206, May 21-23, 2001
• 28: T. Ryutov , C. Neuman, The Specification and Enforcement of Advanced Security Policies, Proceedings of the 3rd International Workshop on Policies for Distributed Systems and Networks (POLICY'02), p.128, June 05-07, 2002
• 29: Sandhu, R. 1988. Transaction control expressions for separation of duties. In Proceedings of the Fourth Computer Security Applications Conference, 282--286.
• 30: Ravi S. Sandhu, Lattice-Based Access Control Models, Computer, v.26 n.11, p.9-19, November 1993 [doi>10.1109/2.241422]
• 31: Ravi Sandhu, Engineering authority and trust in cyberspace: the OM-AM and RBAC way, Proceedings of the fifth ACM workshop on Role-based access control, p.111-119, July 26-28, 2000, Berlin, Germany [doi>10.1145/344287.344309]
• 32: Sandhu, R. and Samarati, P. 1994. Access control: Principles and practice. IEEE Communication Magazine (Sept.), 40--48.
• 33: Ravi S. Sandhu , Edward J. Coyne , Hal L. Feinstein , Charles E. Youman, Role-Based Access Control Models, Computer, v.29 n.2, p.38-47, February 1996 [doi>10.1109/2.485845]
• 34: A. Schaad , J. Moffett, Delegation of Obligations, Proceedings of the 3rd International Workshop on Policies for Distributed Systems and Networks (POLICY'02), p.25, June 05-07, 2002
• 35: Schneck, P. 1999. Persistent access control to prevent piracy of digital information. Proceedings of the IEEE 87, 7 (July).
• 36: Sibert et al. 1995. The DigiBox: A self-protecting container for information commerce. Proceedings of USENIX Workshop on Electronic Commerce.
• 37: Richard Simon , Mary Ellen Zurko, Separation of Duty in Role-based Environments, Proceedings of the 10th Computer Security Foundations Workshop (CSFW '97), p.183, June 10-12, 1997
• 38: TCPA. 2002. Trusted Computing Paltform Alliance, Main Specification V1.1b. Available at http://www.trustedcomputing.org/docs.
• 39: Roshan K. Thomas , Ravi S. Sandhu, Task-Based Authorization Controls (TBAC): A Family of Models for Active and Enterprise-Oriented Autorization Management, Proceedings of the IFIP TC11 WG11.3 Eleventh International Conference on Database Securty XI: Status and Prospects, p.166-181, August 10-13, 1997
• 40: Xin Wang , Guillermo Lao , Thomas DeMartini , Hari Reddy , Mai Nguyen , Edgar Valenzuela, XrML -- eXtensible rights Markup Language, Proceedings of the 2002 ACM workshop on XML security, November 22-22, 2002, Fairfax, VA [doi>10.1145/764792.764803]
• 41: Stephen Weeks, Understanding Trust Management Systems, Proceedings of the 2001 IEEE Symposium on Security and Privacy, p.94, May 14-16, 2001
• 42: Winsborough, W., Seamons, K., and Jones, V. 2000. Automated trust negotiation. Proceedings of the DARPA Information Survivability Conference and Exposition.
• 43: Zhang, X. 2004. Personal communication.

INDEX TERMS

Primary Classification:
  D. Software
  D.4 OPERATING SYSTEMS
      D.4.6 Security and Protection
          Subjects: Access controls

Additional Classification:
  K. Computing Milieux
  K.6 MANAGEMENT OF COMPUTING AND INFORMATION SYSTEMS
      K.6.5 Security and Protection (D.4.6, K.4.2)
          Subjects: Unauthorized access (e.g., hacking, phreaking)

General Terms:
Design, Security

Keywords:
access control, digital rights management, privacy, trust, usage control