Semantic Access Control Ashraful Alam Dr. Bhavani Thuraisingham

Semantic Access Control (SAC) Traditional Access Control Traditional Access Control Semantic Web Semantic Access Control

Motivation Shortcomings of Traditional Access Control Proprietary systems Lack of modularity Changes in access control schemas break the system Changes in data schemas break the system Path to resources (e.g., XPATH) is clumsy //school/department/professor/personal/ssn – LONG! Non-optimal for distributed/federation environment

Modularity Problem People this policy applies to Resources this policy applies to Actions allowed for this policy Target Box

SAC Ontology Written in OWL ( Web Ontology Language ) User-centric Modular Easily extensible Available at :

SAC Components Subjects: Software Agents or Human clients Resources: Assets exposed through WS Actions: Read, Write, Execute Conditions: Additional constraints (e.g., geospatial parameters) on policy enforcement Resources Subjects Actions Condition Policy Set

Application: Geo-WS Security Data providers (e.g., geospatial clearinghouses, research centers) need access control on serviceable resources. Access policies have geospatial dimension Bob has access on Building A Bob does NOT have access on Building B Building A and B have overlapping area Current access control mechanisms are static and non- modular.

Geo-WS Security: Architecture Client DAGISDAGIS DAGISDAGIS Geospatial Semantic WS Provider Enforcement Module Decision Module Authorization Module Semantic-enabled Policy DB Web Service Client SideWeb Service Provider Side

Geo-WS Security: Semantics Policy rules are based on description logic (DL). DL allows machine-processed deductions on policy base. Example 1: DL Rule: ‘Stores’ Inverse ‘Is Stored In’ Fact: Airplane_Hanger(X) ‘stores’ Airplane(Y) Example 2: DL Rule: ‘Is Located In’ is Transitive. Fact: Polygon(S) ‘Is Located In’ Polygon(V) Polygon(V) ‘Is Located In’ Polygon(T)

Secure Inferencing Geospatial Data Store Semantic-enabled Policy DB Inferencing Module Obvious facts Deduced facts

Geo-WS Security: Example Resource := Washington, Oregon, California, West Coast Rule:= West Coast = WA Union OR Union CA Policy:= Subject:= Bob Resources:= WA, OR, CA Action:=Read Query: Retrieve Interstate Highway topology of West Coast

SAC in Action Environment: University Campus Campus Ontology Main Resources Computer Science Building Pharmacy Building Electric Generator in each Building

SAC in Action User Access: Bob has ‘execute’ access to all Building Resources Bob doesn’t have any access to CS Building Bob has ‘modify’ access to Building resources within a certain geographic extent Policy File located at

SAC Improvements Subjects, Resources, Actions and Conditions are defined independently Reduced policy look-up cost -- only policies related to the requester is processed No long path name!

Distributed Access Control Travel SiteReimbursement SiteBank Site Travel Data & Ontology Reimbursement Data Bank Site & Ontology Client Query Interface Middleware