1. INSTITUTE FOR CYBER SECURITY April 20081 Access Control and Semantic Web Technologies Ravi Sandhu Executive Director and Endowed Chair Institute for Cyber Security University of Texas at San Antonio April 2008

2. INSTITUTE FOR CYBER SECURITY April 20082 Theme Access control has always had to adjust as new Information Technologies came into play Operating systems Relational DBMSs Object oriented systems XML: XACML, XRML Therefore, semantic web technologies will also require a change in access control But in the meantime access control itself has evolved DAC and MAC RBAC Trust Management, Obligations, Attribute-based access control Policy languages Usage control So semantic web technologies may also need to change to accommodate some of these developments

3. INSTITUTE FOR CYBER SECURITY April 20083 Theme Security itself has fundamentally changed Enterprise security Multi-party security Black-and-white security Gray security Limited points of access Access anytime anywhere Engage with one service at a time Engage with multiple services concurrently

4. INSTITUTE FOR CYBER SECURITY April 20084 Models versus Policy Languages Access control models Built on abstractions Incomplete Testable for conformance Guidance for security architects DAC, MAC, RBAC, UCON Policy languages Specify what authorizations apply under various circumstances Industry standard: XACML Academic implementation oriented: Ponder Several theoretical languages Semantic web: Kaos, Rei, Rein, KAoS Need synergy between these two streams of research Models provide a framework but are necessarily incomplete Languages by themselves provide no guidance or framework

5. INSTITUTE FOR CYBER SECURITY April 20085 Partners in Crime Proceedings ACM Symposium on Access Control Models and Technologies (SACMAT), 2008, to appear

6. INSTITUTE FOR CYBER SECURITY April 20086 NIST RBAC Standard Model

7. INSTITUTE FOR CYBER SECURITY April 20087 NIST RBAC Standard Model

8. INSTITUTE FOR CYBER SECURITY April 20088 NIST RBAC Standard RBAC

9. INSTITUTE FOR CYBER SECURITY April 20089 US Persons Role Hierarchy

10. INSTITUTE FOR CYBER SECURITY April 200810 ROWLBAC: 2 Approaches

11. INSTITUTE FOR CYBER SECURITY April 200811 Common Elements

12. INSTITUTE FOR CYBER SECURITY April 200812 Roles as Classes: Role Hierarchies

13. INSTITUTE FOR CYBER SECURITY April 200813 Roles as Classes: SSD, DSD

14. INSTITUTE FOR CYBER SECURITY April 200814 Roles as Classes: Role- Permission

15. INSTITUTE FOR CYBER SECURITY April 200815 Roles as Classes: Enforcing DSD

16. INSTITUTE FOR CYBER SECURITY April 200816 Roles as Values

17. INSTITUTE FOR CYBER SECURITY April 200817 Roles as Values: Hierarchical Roles

18. INSTITUTE FOR CYBER SECURITY April 200818 Roles as Values: SSD, DSD

19. INSTITUTE FOR CYBER SECURITY April 200819 Roles as Values: Role Permissions

20. INSTITUTE FOR CYBER SECURITY April 200820 Roles as Values: Enforcing RBAC

21. INSTITUTE FOR CYBER SECURITY April 200821 ROWLBAC: 2 Approaches

22. INSTITUTE FOR CYBER SECURITY April 200822 The UCON Model unified model integrating authorization obligation conditions and incorporating continuity of decisions mutability of attributes

23. INSTITUTE FOR CYBER SECURITY April 200823 UCON Extensions UCON future obligations UCON system obligations

24. INSTITUTE FOR CYBER SECURITY April 200824 Unifying Policy Framework

25. INSTITUTE FOR CYBER SECURITY April 200825 Unifying Policy Framework