Design and Implementation of XACML Access Control Model Based on AC

TANG Cheng-hua,HU Chang-zhen

DOI: https://doi.org/10.3969/j.issn.1001-3695.2006.10.046

2006-01-01

Abstract:By analyzing the features of traditional access control models and relative implementation mechanism,puts forward an XACML access control model based on AC and its realizing methods.The security of this model is also analyzed.

What problem does this paper attempt to address?

Modeling, Implementation and Application of Extensible Access Control

高亮,张斌,蔡力钢,刘向军

DOI: https://doi.org/10.3969/j.issn.1001-3695.2004.08.035

2004-01-01

Abstract:Effective control of access for resource is key to make users work collaboratively.It is also important to ensure information security.Having analyzed traditional access control technologies,a new access control model,eXtensible Access Control Model (XACM),is proposed in this paper.An extensible access control system based on XACM is successfully implemented for control of access to information in Tongda Group's workflow-based office automation system.It proves the characteristics of XACM such as flexibility and generalization.
Access Control Model for Web Services Based on XACML

徐晓春,陆松年,杨树堂,蒋兴浩

DOI: https://doi.org/10.3969/j.issn.1000-3428.2004.05.028

2004-01-01

Abstract:One of the most important features of XML Web services is that they can easily accessed over the Internet. But the downside of this easiness is that security is compromised. This paper presents an access control system for Web Services. It uses XACML for the description of access control criteria based on the use of attribute certificate. The system takes full advantage of XML-enabled feature of Web Services and XACML access control decision model. Furthermore, the integration of privilege management infrastructure and XACML makes this system suitable for heterogeneous Web services.
Access control model based on dynamic rules

He Huang,Shuzhen Yao

2007-01-01

Abstract:In order to counteract the implicit information leakage problems caused by illegal information flows in internal network environment, a new access control model suitable for inside document protection was proposed, which introduced dynamic rules into traditional access control and authorization mechanisms. The implementation of the proposed model was based on XACML (extensible access control markup language) and its obligation condition, and thus the information leakage problem in multiple users environment can be addressed. The algorithm analysis and its scenario simulation show that the security capability of the traditional access control model is enhanced through the treatments.
The Research an and Implementation of an Improved Model of a Dual Logic Acess Control System

Gao Yanyu,Li Shenghong,Xue zhi

DOI: https://doi.org/10.3969/j.issn.1009-8054.2006.03.022

2006-01-01

Abstract:This paper gives an improved model of "Role Based Access Control System Integrating Rating". The new model has advantages of both Role-based logic and Rating logic, and it implements the standardization and unification of policy management and access validation by the introduction of XACML, therefore, it implements the perfect integration of two logic on the basis of role definition.
Achieving Efficient Access Control Via XACML Policy in Cloud Computing.

Xin Pei,Huiqun Yu,Guisheng Fan

DOI: https://doi.org/10.18293/seke2015-37

2015-01-01

Abstract:One primary challenge of applying access control methods in cloud computing is to ensure data security while supporting access efficiency, particularly when adopting multiple access control policies.Many existing works attempt to propose suitable frameworks and schemes to solve the problems, however, these proposals only satisfy specified use cases.In this paper, we take XACML as the policy language and build up a logical model.Based on this, we introduce the fine-grained data fragment algorithm to optimize the policies, whose resource property represents physical meaningful data blocks.Data are organized in a tree structure, where each leaf node represents a minimal physical meaningful data block, and internal nodes are combined data types.This method can eliminate conflicts and redundancies among rules and policies, thus to refine the policy set and achieve fine-grained access control.Our approach can also be applied to processing multi-types of data, and experiments are carried out to show the improvements of efficiencies.
Access Control Model for Web Services Based on SAML and XACML

JIANG Wei-chao,XIA Yang,HUANG Xiao

DOI: https://doi.org/10.3969/j.issn.1000-7024.2005.06.042

2005-01-01

Abstract:Web services, which adopt general protocol and technology, can be easily accessed by users and have been the research hotspot in distributed computing, but the downside of this easiness is that security is compromised. An access control system for web services is presented based on SAML and XACML, which uses SAML to single sign-on and introduces XACML to control the access of users. Based on SAML, XACML is imported to control the protected resources on web sites, and achieves the security of access control of web services.
AADL Vulnerability Modeling and Security Analysis Method

Yang Cao,Yunwei Dong,Xiaomin Wei,Xiao Wu

DOI: https://doi.org/10.1109/QRS-C.2019.00080

2019-01-01

Abstract:In the system architecture design phase, there may be flaws introduced by the access control design. The flaws make the system design vulnerable. Vulnerabilities that are not detected during the design phase will be taken to the subsequent phases of the system development. This reduces system security and leads to more repair cost. In order to detect the access control flaws in the design phase as early as possible, we propose the security analysis method using Architecture Analysis and Design Language (AADL). This method analyzes the access control policies between components. It can analyze and detect the access control flaws in the AADL architecture model. For describing the access control policies, vulnerability model annex is created. We use a case study, based on a module from an aircraft intelligent information system, to introduce the application of modeling and analysis methods.
Using XACML to Define Access Control Policy in Information System

Yun-qing Fu,Chun-xiao Ye

DOI: https://doi.org/10.1049/cp:20070238

2007-01-01

Abstract:Access control is widely used in most information systems. XML or other languages are usually adopted to define access control policy. In this paper, we examine an approach to employ user and role's attribute expression as a part of access control policy. In our approach, a XACML-based policy language named A-XACML is defined and used as a simple, flexible way to express and enforce access control policies in a variety of environments. The language and schema support include data types, functions, and combining logic which allow simple and complex rules to be defined. Finally, we illustrate how to define access control policies of product document management (PDM) system by using XACML.
An XACML Policy Generating Method Based on Policy View

Bo Lang,Nan Zhao,Kun Ge,Kai Chen

DOI: https://doi.org/10.1109/icpca.2008.4783596

2008-01-01

Abstract:Attribute Based Access Control (ABAC) is a promising access control model for pervasive computing. XACML is recognized as an effective ABAC policy description method that can exactly describe the semantics of a policy. However, the description of a XACML policy is complex and it is difficult for users to compose such a policy, which seriously embarrasses the application of XACML. Aiming at this problem, this paper presents an XACML policy generating method basing on a user-oriented ABAC policy view. On the basis of analyzing the XACML policy description language, the paper first establishes a policy description template composed of primary policy description elements of XACML, and then proposes an ABAC concept model called Access Control Cube (ACCube) and submits a comprehensible user-oriented policy view basing on the ACCube. The policy view and the XACML policy template provide an easy and effective way for users to define XACML policies. Users can describe their ABAC policies by creating the policy views, which can then be transformed into XACML policies. The transforming algorithm is given in the paper. According to the foregoing method, we develop a XACML policy generating tool named XACML Policy Builder. An example of using XACML Policy Builder for building XACML policy is also given.
Realization of UCON Model Based on Extended-XACML

Dongliang Jiao,Liu Lianzhong,Li Ting,Ma Shilong

DOI: https://doi.org/10.1109/icfcsa.2011.27

2011-01-01

Abstract:Usage control model is presented and has been considered as the next generation control model which is used to access digital objects. in order to achieve full functionality of UCON, this paper puts forward a realization of UCON Model Based on extended-XACML-CeXUCON. First, We extended the policy decision point in XACML to support administrate conditions obligations and attributions of subject or object. Second, we established a eXUCON context model and find the differents between eXUCON context model and XACML context model. Finally, the potential of our realization for improving the convenience of enforcement mechanisms is illustrated using a small, but representative example.
Research on Application of RBAC Based on XACML in We

闫季鸿,王帅,蒋文蓉,李硕

DOI: https://doi.org/10.3969/j.issn.1001-4543.2008.02.005

2008-01-01

Abstract:This paper makes a common application proposal of RBAC in web services on the research of the kernel techniques on RBAC,WebServices and XACML.It may provide access control for enterprises.This proposal describes its access control policy by the XACML and provides services in accordance with RBAC standard and Web Services.Finally,the performance is experimented and the result shows the developing efficiency and software quality can be greatly improved.
Access Control Model Based on XACML and SAML in Web Services

WEI Wei

DOI: https://doi.org/10.3969/j.issn.1006-4052.2010.20.038

2010-01-01

Abstract:Web Services brings lots of new security challenges for the traditional security model , in order to solve the security problem of Web services, we propose the RBAC model based on XACML and SAML,which through analyzing the XACML、SAML and RBAC, this model adopts XACML to control and interview the users, applies role to manage the authorization, uses RBAC to separate the users and authority, improves the flexibility of the authority management. Let the users which are different roles single sign -on successfully through SAML, the whole frame based on XML ensure the flexibility and expansibility of the model.
An Attributes-Based Access Control Architecture within Large-Scale Device Collaboration Systems Using XACML

feng liang,haoming guo,shengwei yi,xiaoqiang zhang,shilong ma

DOI: https://doi.org/10.1007/978-94-007-2169-2_124

2012-01-01

Abstract:Containing multiple domains and a large number of heterogeneous distributed devices, large-scale device collaboration systems require a fine-grained, flexible and secure mechanism for device access control. This chapter presents and evaluates a distributed device access control architecture Multiple Policies supported Attribute-Based Access Control (MPABAC) to support device authentication and authorization among multiple domains. Based on eXtensible Access Control Markup Language (XACML) standard and Attribute-Based Access Control (ABAC) model, this architecture supports cross-domain authentication and authorization, hierarchical policy combination and enforcement, unified device access control and fine-grained attributes-based privilege description. Experiments show that the performance of this implementation is acceptable within the production environment.
Towards A Generic Formal Framework for Access Control Systems

Jason Crampton,Charles Morisset

DOI: https://doi.org/10.48550/arXiv.1204.2342

2014-07-31

Abstract:There have been many proposals for access control models and authorization policy languages, which are used to inform the design of access control systems. Most, if not all, of these proposals impose restrictions on the implementation of access control systems, thereby limiting the type of authorization requests that can be processed or the structure of the authorization policies that can be specified. In this paper, we develop a formal characterization of the features of an access control model that imposes few restrictions of this nature. Our characterization is intended to be a generic framework for access control, from which we may derive access control models and reason about the properties of those models. In this paper, we consider the properties of monotonicity and completeness, the first being particularly important for attribute-based access control systems. XACML, an XML-based language and architecture for attribute-based access control, is neither monotonic nor complete. Using our framework, we define attribute-based access control models, in the style of XACML, that are, respectively, monotonic and complete.

Cryptography and Security,Logic in Computer Science
Research of User Access Control for Networked Manufacturing System

Zheng Xiao-lin,Lei Yu,Chen De-ren

DOI: https://doi.org/10.1007/s11460-006-0089-x

2006-01-01

Frontiers of Electrical and Electronic Engineering in China

Abstract:An integrated user access control method was proposed to address the issues of security and management in networked manufacturing systems (NMS). Based on the analysis of the security issues in networked manufacturing system, an integrated user access control method composed of role-based access control (RBAC), task-based access control (TBAC), relationship-driven access control (RDAC) and coalition-based access control (CBAC) was proposed, including the hierarchical user relationship model, the reference model and the process model. The elements and their relationships were defined, and the expressions of constraints authorization were given. The extensible access control markup language (XACML) was used to implement this method. This method was used in the networked manufacturing system in the Shaoxing spinning region of China. The results show that the integrated user access control method can reduce the costs of system security maintenance and management.
Conformance Checking of Access Control Policies Specified in XACML

Vincent C. Hu,Evan Martin,JeeHyun Hwang,Tao Xie

DOI: https://doi.org/10.1109/compsac.2007.96

2007-01-01

Abstract:Access control is one of the most fundamental and widely used security mechanisms. Access control mechanisms control which principals such as users or processes have access to which resources in a system. To facilitate managing and maintaining access control, access control policies are increasingly written in specification languages such as XACML. The specification of access control policies itself is often a challenging problem. Furthermore, XACML is intentionally designed to be generic: it provides the freedom in describing access control policies, which are well-known or invented ones. But the flexibility and expressiveness provided by XACML come at the cost of complexity, verbosity, and lack of desirable-property enforcement. Often common properties for specific access control policies may not be satisfied when these policies are specified in XACML, causing the discrepancy between what the policy authors intend to specify and what the actually specified XACML policies reflect. In this position paper, we propose an approach for conducting conformance checking of access control policies specified in XACML based on existing verification and testing tools for XACML policies.
Multiple-implementation testing for XACML implementations.

Nuo Li,JeeHyun Hwang,Tao Xie

DOI: https://doi.org/10.1145/1390832.1390837

2008-01-01

Abstract:ABSTRACTMany Web applications enhance their security via access-control systems. XACML is a standardized policy language, which has been widely used in access-control systems. In an XACML-based access-control system, policies, requests, and responses are written in XACML. An XACML implementation implements XACML functionalities to validate XACML requests against XACML policies. To ensure the quality of an XACML-based access-control system, we need an effective means to test whether the XACML implementation correctly implements XACML functionalities. The test inputs of an XACML implementation are XACML policies and requests. The test outputs are XACML responses. This paper proposes an approach to detect defects in XACML implementations via observing the behaviors of different XACML implementations for the same test inputs. As XACML has been widely used, we can collect different XACML implementations, and test them with the same XACML polices and requests to observe whether the different implementations produce different responses. Based on the analysis of different responses, we can detect defects in different XACML implementations. We show the feasibility of the proposed approach with a preliminary study on three XACML implementations.
Full Business Model Oriented Access Control Method

Junhao Geng,Sumei Zhang

DOI: https://doi.org/10.1109/cis.2009.260

2009-01-01

Abstract:To meet the requirements that full business model of complex information system needs simplified, precise and consistent access control method, analyzing meta-model of full business model, granularities of access control elements, Full Business Model Oriented Access Control (FBMOAC) model is proposed and built, and an algorithm of permission consistency control is presented based on the formal description. Through building access subject granularities, access object granularities, permission assignment control granularities and the dependency, contradiction, delegation, nesting relationships between granularities, FBMOAC supports simplifying the authorization process, controlling access objects precisely and implementing the consistency control of permissions.
XACML-based Access Control and RBAC Constraints

Nuermaimaiti·Heilili,LUO Zhen-xing,LIN Zuo-quan

DOI: https://doi.org/10.3969/j.issn.1000-3428.2008.08.007

2008-01-01

Abstract:Constraints are considered to be the principal motivation for Role-Based Access Control(RBAC).This paper analyzes XML based access control language XACML and points out some shortcomings of the XACML profile for RBAC.It provides role enablement authority to extend this profile,in this way,several kinds of constraints of RBAC such as separation of duty constraints and cardinality constraints can be enforced and implemented using XACML.
An Extended Mandatory Access Control Model for XML.

Dong-Zhan Zhang,Yong-Sheng Xue

DOI: https://doi.org/10.1007/11596370_37

2005-01-01

Abstract:More and more information is distributed in XML format. Information stored in XML documents should be protected by access control policy. An extended MAC model for XML is presented. The subject and object are discussed at first. The labeled XML document model, which includes three rules and one algorithm, is presented allowing for definition and enforcement of access restrictions directly on the structure and content of XML documents. The extended MAC model for XML documents is described in detail by discussing four operations on XML documents. The architecture and some mechanisms used to implement the model are discussed at last.

Design and Implementation of XACML Access Control Model Based on AC

Modeling, Implementation and Application of Extensible Access Control

Access Control Model for Web Services Based on XACML

Access control model based on dynamic rules

The Research an and Implementation of an Improved Model of a Dual Logic Acess Control System

Achieving Efficient Access Control Via XACML Policy in Cloud Computing.

Access Control Model for Web Services Based on SAML and XACML

AADL Vulnerability Modeling and Security Analysis Method

Using XACML to Define Access Control Policy in Information System

An XACML Policy Generating Method Based on Policy View

Realization of UCON Model Based on Extended-XACML

Research on Application of RBAC Based on XACML in We

Access Control Model Based on XACML and SAML in Web Services

An Attributes-Based Access Control Architecture within Large-Scale Device Collaboration Systems Using XACML

Towards A Generic Formal Framework for Access Control Systems

Research of User Access Control for Networked Manufacturing System

Conformance Checking of Access Control Policies Specified in XACML

Multiple-implementation testing for XACML implementations.

Full Business Model Oriented Access Control Method

XACML-based Access Control and RBAC Constraints

An Extended Mandatory Access Control Model for XML.