1. Semantic Access Control Ashraful Alam Dr. Bhavani Thuraisingham

2. Semantic Access Control (SAC) Traditional Access Control Traditional Access Control Semantic Web Semantic Access Control

3. Motivation Shortcomings of Traditional Access Control Proprietary systems Lack of modularity Changes in access control schemas break the system Changes in data schemas break the system Path to resources (e.g., XPATH) is clumsy //school/department/professor/personal/ssn – LONG! Non-optimal for distributed/federation environment

4. Modularity Problem People this policy applies to Resources this policy applies to Actions allowed for this policy Target Box

5. SAC Ontology Written in OWL ( Web Ontology Language ) User-centric Modular Easily extensible Available at : http://utd61105.campus.ad.utdallas.edu/geo/voc/newaccessonto

6. SAC Components Subjects: Software Agents or Human clients Resources: Assets exposed through WS Actions: Read, Write, Execute Conditions: Additional constraints (e.g., geospatial parameters) on policy enforcement Resources Subjects Actions Condition Policy Set

7. Application: Geo-WS Security Data providers (e.g., geospatial clearinghouses, research centers) need access control on serviceable resources. Access policies have geospatial dimension Bob has access on Building A Bob does NOT have access on Building B Building A and B have overlapping area Current access control mechanisms are static and non- modular.

8. Geo-WS Security: Architecture Client DAGISDAGIS DAGISDAGIS Geospatial Semantic WS Provider Enforcement Module Decision Module Authorization Module Semantic-enabled Policy DB Web Service Client SideWeb Service Provider Side

9. Geo-WS Security: Semantics Policy rules are based on description logic (DL). DL allows machine-processed deductions on policy base. Example 1: DL Rule: ‘Stores’ Inverse ‘Is Stored In’ Fact: Airplane_Hanger(X) ‘stores’ Airplane(Y) Example 2: DL Rule: ‘Is Located In’ is Transitive. Fact: Polygon(S) ‘Is Located In’ Polygon(V) Polygon(V) ‘Is Located In’ Polygon(T)

10. Secure Inferencing Geospatial Data Store Semantic-enabled Policy DB Inferencing Module Obvious facts Deduced facts

11. Geo-WS Security: Example Resource := Washington, Oregon, California, West Coast Rule:= West Coast = WA Union OR Union CA Policy:= Subject:= Bob Resources:= WA, OR, CA Action:=Read Query: Retrieve Interstate Highway topology of West Coast

12. SAC in Action Environment: University Campus Campus Ontology http://utd61105.campus.ad.utdallas.edu/geo/voc/campusonto Main Resources Computer Science Building Pharmacy Building Electric Generator in each Building

13. SAC in Action User Access: Bob has ‘execute’ access to all Building Resources Bob doesn’t have any access to CS Building Bob has ‘modify’ access to Building resources within a certain geographic extent Policy File located at http://utd61105.campus.ad.utdallas.edu/geo/voc/policyfile1

14. SAC Improvements Subjects, Resources, Actions and Conditions are defined independently Reduced policy look-up cost -- only policies related to the requester is processed No long path name!

15. Distributed Access Control Travel SiteReimbursement SiteBank Site Travel Data & Ontology Reimbursement Data Bank Site & Ontology Client Query Interface Middleware