Location-based Access Control (LBAC) techniques allow the definition of users’ access rights based on location predicates that exploit the users’ physical location. However, evaluating the physical location of a user is a specialized activity that is unlikely to be performed by the same entity (e.g., organization or system) in charge of the access control decision. For this reason, location evaluation is usually assumed to be provided by specific Location Services (LSs) possibly coexisting in a same area and competing one with the others. In this paper, we address the issues related to the communication and negotiation between an Access Control Engine (ACE) enforcing access rules that include location-based predicates and multiple, functionally equivalent, LSs. We introduce metadata for the exchange of service level agreement attributes between the ACE and the LSs. Based on such metadata we develop different negotiation protocols, from a basic negotiation protocol that shows the core aspects of our proposal to an enhanced protocol that enriches the interaction by taking into account a cost/benefit analysis and some service requirements. Finally, we present an extension to the enhanced protocol to consider possible time validity constraints on access control decisions.

Location-based metadata and negotiation protocols for LBAC in a one-to-many scenario / C.A. Ardagna, M. Cremonini, E. Damiani, S. De Capitani di Vimercati, P. Samarati - In: IFIP Networking 2006 : workshop on security and privacy in mobile and wireless networking / [a cura di] S. Gritzalis, A. Rouskas, C. Skianis. - [s.l] : null, 2006. (( convegno Workshop on Security and Privacy in Mobile and Wireless Networking (SecPri MobiWi) tenutosi a Coimbra nel 2006.

Location-based metadata and negotiation protocols for LBAC in a one-to-many scenario

C.A. Ardagna
Primo
;
M. Cremonini
Secondo
;
E. Damiani;S. De Capitani di Vimercati
Penultimo
;
P. Samarati
Ultimo
2006

Abstract

Location-based Access Control (LBAC) techniques allow the definition of users’ access rights based on location predicates that exploit the users’ physical location. However, evaluating the physical location of a user is a specialized activity that is unlikely to be performed by the same entity (e.g., organization or system) in charge of the access control decision. For this reason, location evaluation is usually assumed to be provided by specific Location Services (LSs) possibly coexisting in a same area and competing one with the others. In this paper, we address the issues related to the communication and negotiation between an Access Control Engine (ACE) enforcing access rules that include location-based predicates and multiple, functionally equivalent, LSs. We introduce metadata for the exchange of service level agreement attributes between the ACE and the LSs. Based on such metadata we develop different negotiation protocols, from a basic negotiation protocol that shows the core aspects of our proposal to an enhanced protocol that enriches the interaction by taking into account a cost/benefit analysis and some service requirements. Finally, we present an extension to the enhanced protocol to consider possible time validity constraints on access control decisions.
Access control ; Mobile systems ; Location-based services ; Negotiation protocol.
Settore INF/01 - Informatica
Book Part (author)
File in questo prodotto:
Non ci sono file associati a questo prodotto.
Pubblicazioni consigliate

Caricamento pubblicazioni consigliate

I documenti in IRIS sono protetti da copyright e tutti i diritti sono riservati, salvo diversa indicazione.

Utilizza questo identificativo per citare o creare un link a questo documento: https://hdl.handle.net/2434/60525
Citazioni
  • ???jsp.display-item.citation.pmc??? ND
  • Scopus ND
  • ???jsp.display-item.citation.isi??? ND
social impact