Push-based XML access control policy languages: A review
---
paper_title: Access control for XML documents and data

paper_content:

Protecting data over the web is today a crucial need for many companies and organizations. This requires not only the use of cryptographic and digital signature techniques for protecting data during transmission, but also the development of suitable access control models and mechanisms able to support the specification and enforcement of a variety of access control policies. In this paper, we first discuss which are the main access control requirements for web data, and compare some of the most important research proposals with respect to these requirements. We then present Author-X [6] as an example of comprehensive system for controlling access to web data.
---
paper_title: On the efficiency of secure XML broadcasting

paper_content:

Secure broadcasting of web documents is becoming a crucial requirement for many web-based applications. Under the broadcast document dissemination strategy, a web document source periodically broadcasts (portions of) its documents to a potentially large community of users, without the need for explicit requests. By secure broadcasting, we mean that the delivery of information to users must obey the access control policies of the document source. Traditional access control mechanisms that have been adapted for XML documents, however, do not address the performance issues inherent in access control. In this paper, a labeling scheme is proposed to support rapid reconstruction of XML documents in the context of a well-known method, called XML pool encryption. The proposed labeling scheme supports the speedy inference of structure information in all portions of the document. The binary representation of the proposed labeling scheme is also investigated. In the experimental results, the proposed labeling scheme is efficient in searching for the location of decrypted information.
---
paper_title: Specifying access control policies for XML documents with XPath

paper_content:

Access control for XML documents is a non-trivial topic, as can be witnessed from the number of approaches presented in the literature. Trying to compare these, we discovered the need for a simple, clearand unambiguous language to state the declarative semantics of an access control policy. All current approaches state the semantics in natural language, which has none of the above properties. This makes it hard to assess whether the proposed algorithms are correct (i.e., really implement the described semantics). It is also hard to assess the proposed policy on its merits, and to compare it to others (for file systems for instance). This paper shows how XPath can be used to specify the semantics of an access control policy for XML documents. Using XPath has great advantages: it is standard technology, widely used and it has clear and easy syntax and semantics. We use the developed framework to give a formal specification of the five most prominent approaches of access controlfor XML documents from the literature.
---
paper_title: Short Paper: Role-Based Access Control for Securing Dynamically Created Documents

paper_content:

Nowadays most of documents are held in digital form and stored in document repositories or databases. The documents can contain delicate information such that not all the actors on the partner side should see and edit. This leads to the necessity to restrict the actions that users could perform with the document content. In this work we research a possibility to integrate existing technologies in order to dynamically define forms and their security permissions. As the solution to the problem we introduce a dynamic way to define security permissions on the XML documents. We propose to use a role-based access control application on the document structure components and introduce a merging strategy to maintain the document’s integrity.
---
paper_title: Design of access control system for telemedicine secure XML documents

paper_content:

XML can supply the standard data type in information exchange format on a lot of data generated in running database or applied programs for a company by using the advantage that it can describe meaningful information directly. Accordingly since there are increasing needs for the efficient management and telemedicine security of the massive volume of XML data, it is necessary to develop a secure access control mechanism for XML. The existing access control has not taken information structures and semantics into full consideration due to the fundamental limitations of HTML. In addition, access control for XML documents allows read operations only, and there are problems of slowing down the system performance due to the complex authorization evaluation process. To resolve this problem, this paper designs and builds a XACS (XML Access Control System), which is capable of making fined-grained access control. This only provides data corresponding to its users' authority levels by authorizing them to access only the specific items of XML documents when they are searching XML documents in telemedicine. To accomplish this, XACS eliminates certain parts of the documents that are inaccessible and transmits the parts accessible depending on the users' authority levels. In addition, it can be expanded to existing web servers because XML documents are used based on the normal web sites. The telemedicine secure and the guidelines are provided to enable quick and precise understanding of the information, and thus the safety enhancement gets improved. Ultimately, this paper suggests an empirical telemedicine application to confirm the adequacy and validity using the proposed method.
---
paper_title: Controlled access and dissemination of XML documents

paper_content:

XML ( eXtensible Markup Language ) is becoming the most relevant standardization effort in the area of document representation through markup languages. Through XML, it is possible to define complex documents, containing information at different degrees of sensitivity. Moreover, the processes of document exchange and acquisition, which can be very frequent in Web-based information systems, are simplified and standardized. In this scenario, there is a strong need for policies to control and regulate the access and dissemination of XML documents. In the paper, we discuss main protection requirements posed by XML documents and we present a set of authorization and dissemination policies that enable both a controlled access to XML documents in a given source and the exchange of XML documents across different sources.
---
paper_title: Role-Based Access Control Models

paper_content:

Security administration of large systems is complex, but it can be simplified by a role-based access control approach. This article explains why RBAC is receiving renewed attention as a method of security administration and review, describes a framework of four reference models developed to better understand RBAC and categorizes different implementations, and discusses the use of RBAC to manage itself.
---
paper_title: Access control for web data: models and policy languages

paper_content:

The web has made easily available an enormous amount of information in digital form and has facilitated the exchange of such information. In this environment, access control is a primary concern. The key issue is how to trade-off between maximizing the sharing of information and enforcing a controlled access to web data. In this paper we start by outlining which are the main access control requirements of web data. Then, we review researches carried on in the field, by mainly focusing on xml. Finally, we discuss policy languages for the semantic web, and outline which are the main research directions in this field.
---
paper_title: Access Control Systems: Security, Identity Management and Trust Models

paper_content:

This essential resource for professionals and advanced students in security programming and system design introduces the foundations of programming systems security and the theory behind access control models, and addresses emerging access control mechanisms.
---
paper_title: Access control for web data: models and policy languages

paper_content:

The web has made easily available an enormous amount of information in digital form and has facilitated the exchange of such information. In this environment, access control is a primary concern. The key issue is how to trade-off between maximizing the sharing of information and enforcing a controlled access to web data. In this paper we start by outlining which are the main access control requirements of web data. Then, we review researches carried on in the field, by mainly focusing on xml. Finally, we discuss policy languages for the semantic web, and outline which are the main research directions in this field.
---
paper_title: Role-Based Access Control Models

paper_content:

Security administration of large systems is complex, but it can be simplified by a role-based access control approach. This article explains why RBAC is receiving renewed attention as a method of security administration and review, describes a framework of four reference models developed to better understand RBAC and categorizes different implementations, and discusses the use of RBAC to manage itself.
---
paper_title: Proposed NIST standard for role-based access control

paper_content:

In this article we propose a standard for role-based access control (RBAC). Although RBAC models have received broad support as a generalized approach to access control, and are well recognized for their many advantages in performing large-scale authorization management, no single authoritative definition of RBAC exists today. This lack of a widely accepted model results in uncertainty and confusion about RBAC's utility and meaning. The standard proposed here seeks to resolve this situation by unifying ideas from a base of frequently referenced RBAC models, commercial products, and research prototypes. It is intended to serve as a foundation for product development, evaluation, and procurement specification. Although RBAC continues to evolve as users, researchers, and vendors gain experience with its application, we feel the features and components proposed in this standard represent a fundamental and stable set of mechanisms that may be enhanced by developers in further meeting the needs of their customers. As such, this document does not attempt to standardize RBAC features beyond those that have achieved acceptance in the commercial marketplace and research community, but instead focuses on defining a fundamental and stable set of RBAC components. This standard is organized into the RBAC Reference Model and the RBAC System and Administrative Functional Specification. The reference model defines the scope of features that comprise the standard and provides a consistent vocabulary in support of the specification. The RBAC System and Administrative Functional Specification defines functional requirements for administrative operations and queries for the creation, maintenance, and review of RBAC sets and relations, as well as for specifying system level functionality in support of session attribute management and an access control decision process.
---
paper_title: Access control for web data: models and policy languages

paper_content:

The web has made easily available an enormous amount of information in digital form and has facilitated the exchange of such information. In this environment, access control is a primary concern. The key issue is how to trade-off between maximizing the sharing of information and enforcing a controlled access to web data. In this paper we start by outlining which are the main access control requirements of web data. Then, we review researches carried on in the field, by mainly focusing on xml. Finally, we discuss policy languages for the semantic web, and outline which are the main research directions in this field.
---
paper_title: On specifying security policies for web documents with an XML-based language

paper_content:

The rapid growth of the Web and the ease with which data can be accessed facilitate the distribution and sharing of information. Information dissemination often takes the form of documents that are made available at Web servers, or that are actively broadcasted by Web servers to interested clients. In this paper, we present an XML-compliant formalism for specifying security-related information for Web document protection. In particular, we introduce X-Sec , an XML-based language for specifying subject credentials and security policies and for organizing them into subject profiles and policy bases, respectively. The language is complemented by a set of subscription-based schemes for accessing distributed Web documents, which rely on defined XML subject profiles and XML policy bases.
---
paper_title: Controlling Access to Published Data Using Cryptography

paper_content:

We propose a framework for enforcing access control policies on published XML documents using cryptography. In this framework the owner publishes a single data instance, which is partially encrypted, and which enforces all access control policies. Our contributions include a declarative language for access policies, and the resolution of these policies into a logical "protection model" which protects an XML tree with keys. The data owner enforces an access control policy by granting keys to users. The model is quite powerful, allowing the data owner to describe complex access scenarios, and is also quite elegant, allowing logical optimizations to be described as rewriting rules. Finally, we describe cryptographic techniques for enforcing the protection model on published data, and provide a performance analysis using real datasets.
---
paper_title: A distributed push-based XML access control model for better scalability

paper_content:

XML access control is a non-trivial topic as XML language becomes a standard for data representation and transmission on the Web. Existing access control approaches to the published XML documents are not likely to scale well since they specify and enforce their access control policies in centralized servers. This paper proposed a distributed model for providing a scalable access control to the published XML documents. The proposed model is cost-effectively distributed for meeting the increased workload along with avoiding the possible bottlenecks. As a result, the proposed model effectively scales with the increased system and management workloads.
---
paper_title: Trusted-based scalable access control model for broadcast XML documents.

paper_content:

XML language is becoming a de facto standard for representing and transmitting data on the web so controlling access to XML documents is an important issue. Several XML access control approaches have been proposed to control the access of the published XML documents but these approaches still cannot scale well wim increased system and management workload because they specify and enforce their access control policies in centralized servers. We have proposed a distributed XML access control model for that improves the scalability by distributing the system and management workloads into several servers and different administrator, respectively. In this paper, the scalability of the proposed model is evaluated using a quantitative approach that shows that the proposed model is cost-effectively scalable with an increase in system and management workloads.
---
paper_title: Requirements for scalable access control and security management architectures

paper_content:

Maximizing local autonomy by delegating functionality to end nodes when possible (the end-to-end design principle) has led to a scalable Internet. Scalability and the capacity for distributed control have unfortunately not extended well to resource access-control policies and mechanisms. Yet management of security is becoming an increasingly challenging problem in no small part due to scaling up of measures such as number of users, protocols, applications, network elements, topological constraints, and functionality expectations. In this article, we discuss scalability challenges for traditional access-control mechanisms at the architectural level and present a set of fundamental requirements for authorization services in large-scale networks. We show why existing mechanisms fail to meet these requirements and investigate the current design options for a scalable access-control architecture. We argue that the key design options to achieve scalability are the choice of the representation of access control policy, the distribution mechanism for policy, and the choice of the access-rights revocation scheme. Although these ideas have been considered in the past, current access-control systems in use continue to use simpler but restrictive architectural models. With this article, we hope to influence the design of future access-control systems towards more decentralized and scalable mechanisms.
---
paper_title: Access control for XML documents and data

paper_content:

Protecting data over the web is today a crucial need for many companies and organizations. This requires not only the use of cryptographic and digital signature techniques for protecting data during transmission, but also the development of suitable access control models and mechanisms able to support the specification and enforcement of a variety of access control policies. In this paper, we first discuss which are the main access control requirements for web data, and compare some of the most important research proposals with respect to these requirements. We then present Author-X [6] as an example of comprehensive system for controlling access to web data.
---
paper_title: Access control for web data: models and policy languages

paper_content:

The web has made easily available an enormous amount of information in digital form and has facilitated the exchange of such information. In this environment, access control is a primary concern. The key issue is how to trade-off between maximizing the sharing of information and enforcing a controlled access to web data. In this paper we start by outlining which are the main access control requirements of web data. Then, we review researches carried on in the field, by mainly focusing on xml. Finally, we discuss policy languages for the semantic web, and outline which are the main research directions in this field.
---
paper_title: Access control for web data: models and policy languages

paper_content:

The web has made easily available an enormous amount of information in digital form and has facilitated the exchange of such information. In this environment, access control is a primary concern. The key issue is how to trade-off between maximizing the sharing of information and enforcing a controlled access to web data. In this paper we start by outlining which are the main access control requirements of web data. Then, we review researches carried on in the field, by mainly focusing on xml. Finally, we discuss policy languages for the semantic web, and outline which are the main research directions in this field.
---
paper_title: Requirements for scalable access control and security management architectures

paper_content:

Maximizing local autonomy by delegating functionality to end nodes when possible (the end-to-end design principle) has led to a scalable Internet. Scalability and the capacity for distributed control have unfortunately not extended well to resource access-control policies and mechanisms. Yet management of security is becoming an increasingly challenging problem in no small part due to scaling up of measures such as number of users, protocols, applications, network elements, topological constraints, and functionality expectations. In this article, we discuss scalability challenges for traditional access-control mechanisms at the architectural level and present a set of fundamental requirements for authorization services in large-scale networks. We show why existing mechanisms fail to meet these requirements and investigate the current design options for a scalable access-control architecture. We argue that the key design options to achieve scalability are the choice of the representation of access control policy, the distribution mechanism for policy, and the choice of the access-rights revocation scheme. Although these ideas have been considered in the past, current access-control systems in use continue to use simpler but restrictive architectural models. With this article, we hope to influence the design of future access-control systems towards more decentralized and scalable mechanisms.
---
paper_title: Decentralized trust management

paper_content:

We identify the trust management problem as a distinct and important component of security in network services. Aspects of the trust management problem include formulating security policies and security credentials, determining whether particular sets of credentials satisfy the relevant policies, and deferring trust to third parties. Existing systems that support security in networked applications, including X.509 and PGP, address only narrow subsets of the overall trust management problem and often do so in a manner that is appropriate to only one application. This paper presents a comprehensive approach to trust management, based on a simple language for specifying trusted actions and trust relationships. It also describes a prototype implementation of a new trust management system, called PolicyMaker, that will facilitate the development of security features in a wide range of network services.
---

Title: Push-based XML access control policy languages: A review

Section 1: INTRODUCTION
Description 1: This section introduces the significance of XML in data representation and transmission, explains the need for XML access control, and presents the main contributions of the paper.

Section 2: ACCESS CONTROL MODELS
Description 2: This section discusses the three general access control models (Discretionary Access Control, Mandatory Access Control, and Role-Based Access Control) used as a basis for specifying access control policies.

Section 3: XML-BASED ACCESS CONTROL POLICY LANGUAGES
Description 3: This section covers four well-known XML-based policy languages (X-Sec, Policy Query Language, XACML, and trust-based XML policy Language) for push-based XML access control, explaining their mechanisms and features.

Section 4: EVALUATION CRITERIA
Description 4: This section presents the criteria used to evaluate the scalability of the XML-based policy languages discussed in the previous section, based on access control basic requirements and scalability requirements.

Section 5: DISCUSSION
Description 5: This section evaluates the scalability of the reviewed XML policy languages using the evaluation criteria and discusses basic and scalability requirements that have not been addressed.

Section 6: CONCLUSION
Description 6: This section concludes the paper by summarizing the findings regarding the scalability of XML-based policy languages and suggests areas for future development and research.