Chen, Liang, Crampton, Jason, Kollingbaum, Martin J. and Norman, Timothy J. (2012) Obligations in risk-aware access control. In: 10th Annual International Conference on Privacy, Security and Trust, 16-18 Jul 2012, Paris, France.

Full text not available from this repository.

Abstract

The increasing need to share information in dynamic environments has created a requirement for risk-aware access control systems. In this paper, we present a metamodel for risk-aware authorization that captures the key aspects of a system in relation to risk mitigation. In particular, we develop various risk-aware models as instances of the metamodel that broadly differ in the form of risk mitigation that is used (system obligations and user obligations respectively), and study how those obligations are applied to reduce and account for the risk incurred by granting access. Unlike system obligations, an access control system cannot guarantee that user obligations are fulfilled. We propose two approaches to defining risk-aware authorization semantics that takes unfulfilled obligations into account: one is to restrict users' future access because of prior failure to fulfill obligations, and the other is to “reward” users who have been diligent in fulfilling their obligations by permitting risky access requests.

Item Type:	Conference or Workshop Item (Paper)
ISBN:	9781467323239
Identifier:	10.1109/PST.2012.6297931
Page Range:	pp. 145-152
Identifier:	10.1109/PST.2012.6297931
Keywords:	Authorization, Semantics, Context, Force, Abstracts
Subjects:	Computing
Depositing User:	Liang Chen
Date Deposited:	22 Mar 2016 18:12
Last Modified:	28 Aug 2021 07:19
URI:	https://repository.uwl.ac.uk/id/eprint/1836

Actions (login required)

View Item