1. Data and Applications Security Developments and Directions
Dr. Bhavani Thuraisingham
The University of Texas at Dallas
Policies
September 7, 2012

2. Outline of the Unit Need to Know to Need to Share RBAC UCON RBUC ABAC
Dissemination
Risk based access control
Trust Management/Credential/Disclosure
Directions
Major conferences for Policy and Access Control:
IEEE Policy Workshop
ACM SACMAT

3. Need to Know to Need to Share
Need to know policies during the cold war; even if the user has access, does the user have a need to know?
Post 9/11 the emphasis is on need to share
User may not have access, but needs the data
Do we give the data to the user and then analyze the consequences
Do we analyze the consequences and then determine the actions to take
Do we simply not give the data to the user
What are risks involved?

4. RBAC
Access to information sources including structured and unstructured data both within the organization and external to the organization
Access based on roles
Hierarchy of roles: handling conflicts
Controlled dissemination and sharing of the data

5. RBAC (Sandhu)

6. UCON
RBAC model is incorporated into UCON and useful for various applications
Authorization component
Obligations
Obligations are actions required to be performed before an access is permitted
Obligations can be used to determine whether an expensive knowledge search is required
Attribute Mutability
Used to control the scope of the knowledge search
Condition
Can be used for resource usage policies to be relaxed or tightened

7. UCON (Sandhu)

8. Role-based Usage Control (RBUC)
RBAC with UCON extension
RBUC integrated RBAC and UCON to provide flexible access control for coalition environment, not only has RBAC flexibility , but also has great UCON features, such as use control,continuity of decisions and mutability of attributes. 8

9. RBUC in Coalition Environment
The coalition partners maybe trustworthy), semi-trustworthy) or untrustworthy), so we can assign different roles on the users (professor) from different infospheres, e.g.
professor role,
trustworthy professor role,
semi-trustworthy professor role,
untrustworthy professor role.
We can enforce usage control on data by set up object attributes to different roles during permission-role-assignment,
e.g. professor role: 4 times a day,
trustworthy role: 3 times a day
semi-trustworthy professor role: 2 times a day,
untrustworthy professor role: 1 time a day
This is an use case how to enforce usage/usage rate control on data, based on the partners’ trustworthy, the four “professor” roles have different usage right on the same documents student record). 9

10. Release and Dissemination Policies
Release policies will determine to whom to release the data
What is the connection to access control
Is access control sufficient
Once the data is retrieved from the information source (e.g., database) should it be released to the user
Once the data is released, dissemination policies will determine who the data can be given to
Electronic music, etc.

11. ABAC: Attribute-based Access Control

12. Risk Based Data Sharing/Access Control
What are the risks involved in releasing/disseminating the data
Risk modeling should be integrated with the access control model
Simple method: assign risk values
Higher the risk, lower the sharing
What is the cost of releasing the data?
Cost/Risk/Security closely related

13. Trust Management Trust Services
Identify services, authorization services, reputation services
Trust negotiation (TN)
Digital credentials, Disclosure policies
TN Requirements
Language requirements
Semantics, constraints, policies
System requirements
Credential ownership, validity, alternative negotiation strategies, privacy
Example TN systems
KeyNote and Trust-X (U of Milan), TrustBuilder (UIUC)

14. Trust Management

15. The problem: establishing trust in open systems
Interactions between strangers
- In conventional systems user identity is known in advance
and can be used for performing access control
- In open systems partecipants may have no pre-existing
relationship and may not share a common security domain ?
Mutual authentication
- Assumption on the counterpart honesty no longer holds
- Both participants need to authenticate each other
The Internet, being a standard way to communicate, has become a standard way to exchange information or perform electronic transactions from anywhere in the world. Purchasing products and services online is becoming a way of life for millions of people and businesses. The information exchanged between parties on the Internet in most cases is sensitive and must be protected.
The communicating parties most often are strangers because they do not share the same security domain and will not have a local login. Traditional security approaches require a stranger to pre-register in order to establish trust, but the traditional way is not good enough. The client usually has no proof of the server’s identity, and the server cannot really trust that you are who you said you were on the registration form, so the paradox between strangers continues.

16. Trust Negotiation model
A promising approach for open systems where most of the interactions occur between strangers
The goal: establish trust between parties in order to exchange sensitive information and services
The approach: establish trust by verifying properties of the other party
costituisce un nuovo approccio alla realizzazione di sistemi di autorizzazione tra soggetti sconosciuti

17. Trust negotiation: the approach
Interactions between strangers in open systems
are different from traditional access control models
Policies and mechanisms developed in conventional systems need to be revised
ACCESS CONTROL POLICIES
VS.
DISCLOSURE POLICIES
USER ID’s
VS.
SUBJECT PROPERTIES

18. Subject properties: digital credentials
Assertion about the credential owner issued and certified by a Certification Authority.
Each entity has an associated set of credentials,
describing properties and attributes of the owner. CA CA CA

19. Use of Credentials Digital Credentials Credential Issuer Alice Check
Julie
3 kids
Married
American
Alice
Check
Check
-Julie
- Married
-Julie
- American
Company B
Want to know marital status
Company A
Referenced from
Want to know citizenship

20. Credentials
Credentials can be expressed through the Security Assertion Mark-up Language (SAML)
SAML allows a party to express security statements about a given subject
Authentication statements
Attribute statements
Authorization decision statements

21. Disclosure policies Disclosure policies Disclosure policies govern:
Access to protected resources
Access to sensitive information
Disclosure of sensitive credentials
Disclosure policies express trust requirements by means of credential combinations that must be disclosed to obtain authorization
Access control policies work well in closed systems with a known set of subjects and static objects.
The targeting of our research is an open environment where subjects are characterized by their role or other attributes.
Policies must express trust requirements by means of credentials proving properties of the counterpart

22. Disclosure policies - Example
Suppose NBG Bank offers loans to students
To check the eligibility of the requester, the Bank asks the student to present the following credentials
The student card
The ID card
Social Security Card
Financial information – either a copy of the Federal Income Tax Return or a bank statement

23. Disclosure policies - Example
p1= ({}, Student_Loan  Student_Card());
p2= ({p1}), Student_Loan  Social_Security_Card());
p3= ({p2}, Student_Loan  Federal_Income_Tax_Return());
p4= ({p2}, Student_Loan  Bank_Statement());
P5=({p3,p4}, Student_Loan  DELIV);
These policies result in two distinct “policy chains” that lead to disclosure
[p1, p2, p3, p5] [p1, p2, p4, p5]

24. Trust Negotiation - definition
The gradual disclosure of credentials and requests for credentials between two strangers, with the goal of establishing sufficient trust so that the parties can exchange sensitive information and/or resources
Il modello di Tn costituisce un nuovo approccio alla realizzazione di sistemi di autorizzazione tra soggetti sconosciuti attraverso lo scambio di credenziali che descrivono attributi di interesse dei partecipanti.

25. Trust-X system: Joint Research with University of Milan
A comprehensive XML based framework for trust negotiations:
Trust negotiation language (X-TNL)
System architecture
Algorithms and strategies to carry out the negotiation process
Trust-X aims at providing a comprehensive infrastructure for trust negotiation, composed by a complete and expressive syntax formalized by the most used representation language (e.g. XML) and supported by an efficient and modular engine.

26. Trust-X language: X-TNL
Able to handle mutliple and heterogeneus certificate specifications:
Credentials
Declarations
Able to help the user in customizing the management of his/her own certificates
X-Profile
Data Set
Able to define a wide range of protection requirements by means of disclosure policies
First, the protection of Web data and their security related information is
uniform, in that credentials and policies are XML documents and thus can be protected using the same
mechanisms developed for the protection of conventional XML documents. Furthermore, the use of an XML
formalism for specifying credentials facilitates credential submission and distribution, as well as their
analysis and verification by use of a standard query language such as
XQuery \cite{XML}.

27. X-TNL: Credential type system
X-TNL simplifies the
task of
credential
specification by
using a set of templates
called credential types
Uniqueness is ensured by use of XML Namespaces
Credential types
are defined by using
Document Type Definition
<!DOCTYPE library_badge[
<!ELEMENT library_badge (name, address, phone_number*,
?, release_date, profession,Issuer)>
<!ELEMENT name (fname, lname)>
<!ELEMENT address (#PCDATA)>
<!ELEMENT phone_number (#PCDATA)>
<!ELEMENT (#PCDATA)>
<!ELEMENT release_date (#PCDATA)>
<!ELEMENT profession (#PCDATA)>
<!ELEMENT fname (#PCDATA)>
<!ELEMENT lname (#PCDATA)>
<!ELEMENT Issuer ANY>
<!ATTLIST Issuer
XML:LINK CDATA #FIXED “SIMPLE”
HREF CDATA #REQUIRED
TITLE CDATA #IMPLIED>
<!ATTLIST library_badge CredID ID #REQUIRED>
<!ATTLIST library_badge SENS CDATA #REQUIRED>
]>
Each credential is digitally signed according to the W3C standard for digital signature.
The use of credential types helps in managing a common onthology so that trust negotiation software can reference standard credential schemas

28. Trust-X negotiation phases- basic model
Introduction
Send a request for a resource/service
Introductory policy exchanges
Policy evaluation phase
Disclosure policy exchange
Evaluation of the exchanged policies in order to determine secure solutions for both the parties.
Certificate exchange phase
Exchange of the sequence of certificates determined at step n. 2.
La negoziazione è articolata in tre fasi distinte
meccanismo di protezione multilivello,
evita il rilascio di informazioni non volute o non necessarie, politiche o credenziali.

29. Trust-X Architecture
Trust-X has been specifically designed for a peer-to-peer environment in that each party is equipped with the same functional modules and thus it can alternatively act as a requester or resource controller during different negotiations.
Trust-${\cal X}$ has been specifically
designed for a peer-to-peer environment in that both the
negotiating parties are equally responsible for negotiation
management and can both drive the negotiation process, by
selecting the strategy that better fits their needs.

30. How a policy is processed
Upon receiving a disclosure policy the compliance checker determines if it can be satisfied by any certificate of the local X-profile.
Then, the module checks in the policy base the protection needs associated with the certificates, if any.
The state of the negotiation is anyway updated by the tree manager, which records whether new policies and credentials have been involved or not.
COMPLIANCE
CHECKER
If a set of credentials and associated policies are actually found, a counterpolicy is sent.
TREE
MANAGER
Disclosure Policies
Policy
Base
X-Profile
Policy Reply

31. Directions
Policies are of much interest to many organizations and applications
Financial, Medical, Retail, Manufacturing etc
Roles and responsibilities
Flexible policies
RBAC, UCON, RBUC, Trust Negotiation, Dissemination Policies
Need to Know to Need to Share
IEEE POLICY and ACM SACMAT