Although several access control policies can be devised for controlling access to information, all existing authorization models, and the corresponding enforcement mechanisms, are based on a specific policy (usually the closed policy). As a consequence, although different policy choices are possible in theory, in practice only a specific policy can actually be applied within a given system. In this paper, we present a unified framework that can enforce multiple access control policies within a single system. The framework is based on a language through which users can specify security policies to be enforced on specific accesses. The language allows the specification of both positive and negative authorizations and incorporates notions of authorization derivation, conflict resolution, and decision strategies. Different strategies may be applied to different users, groups, objects, or roles, based on the needs of the security policy. The overall result is a flexible and powerful, yet simple, framework that can easily capture many of the traditional access control policies as well as protection requirements that exist in real-world applications, but are seldom supported by existing systems. The major advantage of our approach is that it can be used to specify different access control policies that can all coexist in the same system and be enforced by the same security server.
Flexible support for multiple access control policies / S. Jajodia, P. Samarati, M.L. Sapino, V.S. Subrahmanian. - In: ACM TRANSACTIONS ON DATABASE SYSTEMS. - ISSN 0362-5915. - 26:2(2001), pp. 214-260.
|Titolo:||Flexible support for multiple access control policies|
SAMARATI, PIERANGELA (Secondo)
|Parole Chiave:||Access control policy; Authorization; H.2.7 [Database Management]: Database Administration-security, integrity, and protection; K.6.5 [Management of Computing and Information Systems]: Security and Protection; Logic programming; Management; Security|
|Settore Scientifico Disciplinare:||Settore INF/01 - Informatica|
|Data di pubblicazione:||2001|
|Digital Object Identifier (DOI):||http://dx.doi.org/10.1145/383891.383894|
|Appare nelle tipologie:||01 - Articolo su periodico|