A framework for managing data provider and data consumer semantic obligations for access control

Abstract

Norms and policies are a fundamental component of nowadays open distributed systems operating on the Internet, and a crucial application is the field of Access Control. In such context, policies have been widely used to express data consumer permissions and prohibitions to get access to certain data, whereas obligations have been modelled and applied more infrequently. In this paper, we present a unified semantic model for specifying data consumer and data provider obligations in the context of an exchange of logically formalized information between agents, inside a Multiagent System. We explain how to specify those obligations, in a formal way; we present how to enforce the data provider obligations on the data released by the agent before returning it to the data consumer; we show how to monitor the fulfilment or violation of the specified data consumer obligations; all of that in the context of a complete reasoning-based obligation framework.

Keywords

Obligation description logics reasoning access control semantic web OWL

Get full access to this article

View all access options for this article.

References

Alamri,

Bertok and

J.A.

Thom, Authorization control for a semantic data repository through an inference policy engine, IEEE Trans. Dependable Secur. Comput. 10(6) (2013), 328–340. doi:10.1109/TDSC.2013.20.

Andrighetto,

Governatori,

Noriega and

L.W.N.

van der Torre, Normative Multi-Agent Systems, Dagstuhl Follow-Ups, Vol. 4, Schloss Dagstuhl–Leibniz-Zentrum fuer Informatik, Dagstuhl, Germany, 2013.

Ardagna,

De Capitani di Vimercati,

Paraboschi,

Pedrini and

Samarati, An XACML-based privacy-centered access control system, in: Proc. of the 1st ACM Workshop on Information Security Governance (WISG 2009), Chicago, Illinois, USA, 2009.

Bettini,

Jajodia,

X.S.

Wang and

Wijesekera, Provisions and obligations in policy management and security applications, in: VLDB 2002, Proceedings of 28th International Conference on Very Large Data Bases, Hong Kong, China, August 20–23, 2002, Morgan Kaufmann, 2002, pp. 502–513. doi:10.1016/B978-155860869-6/50051-2.

Bettini,

Jajodia,

X.S.

Wang and

Wijesekera, Provisions and obligations in policy management and security applications, in: VLDB, Morgan Kaufmann, 2002, pp. 502–513.

Bradshaw,

Uszok,

Breedy,

Bunch,

Eskridge,

Feltovich,

Johnson,

Lott and

Vignati, The KAoS policy services framework, in: Proceedings of the Eighth Cyber Security and Information Intelligence Research Workshop (CSIIRW 2013), Oak Ridge National Labs, Oak Ridge, TN, 2013.

Carminati,

Ferrari,

Heatherly,

Kantarcioglu and

Thuraisingham, A semantic web based framework for social network access control, in: Proceedings of the 14th ACM Symposium on Access Control Models and Technologies, SACMAT ’09, ACM, New York, NY, USA, 2009, pp. 177–186. doi:10.1145/1542207.1542237.

Chen,

Crampton,

M.J.

Kollingbaum and

T.J.

Norman, Obligations in risk-aware access control, in: Proceedings of the 2012 Tenth Annual International Conference on Privacy, Security and Trust (PST), PST ’12, IEEE Computer Society, Washington, DC, USA, 2012, pp. 145–152. doi:10.1109/PST.2012.6297931.

Costabello,

Villata and

Gandon, Context-aware access control for RDF graph stores, in: ECAI,

L.D.

Raedt,

Bessière,

Dubois,

Doherty,

Frasconi,

Heintz and

P.J.F.

Lucas, eds, Frontiers in Artificial Intelligence and Applications, Vol. 242, IOS Press, 2012, pp. 282–287.

10.

Criado,

Argente and

Botti, Rational strategies for norm compliance in the n-BDI proposal, in: Coordination, Organizations, Institutions, and Norms in Agent Systems VI,

M.D.

Vos,

Fornara,

J.V.

Pitt and

G.A.

Vouros, eds, LNCS, Vol. 6541, Springer, 2011, pp. 1–20. doi:10.1007/978-3-642-21268-0_1.

11.

Criado,

Argente,

Noriega and

V.J.

Botti, Reasoning about norms under uncertainty in dynamic environments, Int. J. Approx. Reasoning 55(9) (2014), 2049–2070. doi:10.1016/j.ijar.2014.02.004.

12.

Finin,

Joshi,

Kagal,

Niu,

Sandhu,

Winsborough and

Thuraisingham, ROWLBAC: Representing role based access control in OWL, in: Proceedings of the SACMAT, ACM, New York, NY, USA, 2008, pp. 73–82. doi:10.1145/1377836.1377849.

13.

Fornara, Specifying and monitoring obligations in open multiagent systems using semantic web technology, in: Semantic Agent Systems: Foundations and Applications, Studies in Computational Intelligence, Vol. 344, Springer-Verlag, 2011, pp. 25–46, chapter 2. doi:10.1007/978-3-642-18308-9_2.

14.

Fornara and

Colombetti, Specifying and Enforcing Norms in Artificial Institutions, Springer, Berlin, Heidelberg, 2009, pp. 1–17.

15.

Fornara and

Colombetti, Representation and monitoring of commitments and norms using OWL, AI Commun. 23(4) (2010), 341–356.

16.

Fornara and

Tampitsikas, Semantic technologies for open interaction systems, Artificial Intelligence Review 39 (2013), 63–79. doi:10.1007/s10462-012-9390-7.

17.

Gama and

Ferreira, Obligation policies: An enforcement platform, in: Sixth IEEE International Workshop on Policies for Distributed Systems and Networks, 2005, pp. 203–212.

18.

Hitzler,

Krötzsch and

Rudolph, Foundations of Semantic Web Technologies, Chapman & Hall/CRC, 2009, pp. 226–229.

19.

Irwin,

Yu and

W.H.

Winsborough, On the modeling and analysis of obligations, in: ACM Conference on Computer and Communications Security,

Juels,

R.N.

Wright and

S.D.C.

di Vimercati, eds, ACM, 2006, pp. 134–143.

20.

Kolovski,

Hendler and

Parsia, Analyzing web access control policies, in: Proceedings of the 16th International Conference on World Wide Web, WWW ’07, ACM, New York, NY, USA, 2007, pp. 677–686. doi:10.1145/1242572.1242664.

21.

Masoumzadeh and

Joshi, Ontology-based access control for social network systems, IJIPSI 1(1) (2011), 59–78. doi:10.1504/IJIPSI.2011.043731.

22.

Ni,

Bertino,

Lobo,

Brodie,

C.-M.

Karat,

Karat and

Trombeta, Privacy-aware role-based access control, ACM Trans. Inf. Syst. Secur. 13(3) (2010), 24:1–24:31. doi:10.1145/1805974.1805980.

23.

OASIS XACML Version 3.0 Specification, Data-flow model, 2013, p. 19–20, http://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-cs-01-en.pdf.

24.

Paradesi,

Liccardi,

Kagal and

Pato, A semantic framework for content-based access controls, in: Proceedings of the 2013 International Conference on Social Computing, SOCIALCOM ’13, IEEE Computer Society, Washington, DC, USA, 2013, pp. 624–629. doi:10.1109/SocialCom.2013.94.

25.

Ribeiro,

Zúquete,

Ferreira and

Guedes, SPL: An access control language for security policies with complex constraints, in: Proceedings of the Network and Distributed System Security Symposium, 1999, pp. 89–107.

26.

Sacco and

Passant, A privacy preference ontology (PPO) for linked data, in: Proceedings of the Linked Data on the Web Workshop (LDOW), Colocated with WWW, Hyderabad, India, 2011.

27.

Sacco,

Passant and

Decker, An access control framework for the web of data, in: 2011 IEEE 10th International Conference on Trust, Security and Privacy in Computing and Communications, 2011, pp. 456–463. doi:10.1109/TrustCom.2011.59.

28.

Sensoy,

Norman,

Vasconcelos and

Sycara, OWL–POLAR: Semantic policies for agent reasoning, in: The Semantic Web – ISWC 2010,

Patel-Schneider,

Pan,

Hitzler,

Mika,

Zhang,

Pan,

Horrocks and

Glimm, eds, Lecture Notes in Computer Science, Vol. 6496, Springer, Berlin, Heidelberg, 2010, pp. 679–695. doi:10.1007/978-3-642-17746-0_43.

29.

Shearer,

Motik and

Horrocks, Hermit: A highly-efficient owl reasoner, in: OWLED,

Dolbear,

Ruttenberg and

Sattler, eds, CEUR Workshop Proceedings, Vol. 432, CEUR-WS.org, 2008.

30.

Sirin and

Parsia, SPARQL–DL: SPARQL query for OWL–DL, in: Proceedings of the Third International Workshop on OWL: Experiences and Directions (OWLED ’07),

Golbreich,

Kalyanpur and

Parsia, eds, Innsbruck, Austria, 2007.

31.

Sirin,

Parsia,

B.C.

Grau,

Kalyanpur and

Katz, Pellet: A practical OWL–DL reasoner, Web Semant 5 (2007), 51–53.

32.

Uszok and

J.M.

Bradshaw, Demonstrating selected W3C policy languages interest group use cases using the KAoS policy services framework, in: POLICY, IEEE Computer Society, 2008, pp. 233–234.

33.

Wright, Deontic logics, American Philosophical Quarterly 4(2) (1967), 136–143.

34.

Zeng,

Yang and

Luo, Content-based access control: Use data content to assist access control for large-scale content-centric databases, in: IEEE International Conference on Big Data, Big Data 2014, Washington, DC, USA, October 27–30, 2014,

J.J.

Lin,

Pei,

Hu,

Chang,

Nambiar,

Aggarwal,

Cercone,

Honavar,

Huan,

Mobasher and

Pyne, eds, IEEE, 2014, pp. 27–30. doi:10.1109/BigData.2014.7004294.