A Non-technical User-Oriented Display Notation for XACML Conditions
- Bernard StepienAffiliated withSchool of Information Technology and Engineering, University of Ottawa, Canada, and Devera Logic, Inc.
- , Amy FeltyAffiliated withSchool of Information Technology and Engineering, University of Ottawa, Canada, and Devera Logic, Inc.
- , Stan MatwinAffiliated withSchool of Information Technology and Engineering, University of Ottawa, Canada, and Devera Logic, Inc.
Ideally, access control to resources in complex IT systems ought to be handled by business decision makers who own a given resource (e.g., the pay and benefits section of an organization should decide and manage the access rules to the payroll system). To make this happen, the security and database communities need to develop vendor-independent access management tools, useable by decision makers, rather than technical personnel detached from a given business function. We have developed and implemented such tool, based on XACML. The XACML is an important emerging tool for managing complex access control applications. As a formal notation, based on an XML schema representing the grammar of a given application, XACML is precise and non-ambiguous. But this very property puts it out of reach of non-technical users. We propose a new notation for displaying and editing XACML rules that is independent of XML, and we develop an editor for it. Our notation combines a tree representation of logical expressions with an accessible natural language layer. Our early experience indicates that such rules can be grasped by non-technical users wishing to develop and control rules for accessing their own resources.
KeywordsAccess control notation rule editor XACML
- A Non-technical User-Oriented Display Notation for XACML Conditions
- Book Title
- E-Technologies: Innovation in an Open World
- Book Subtitle
- 4th International Conference, MCETECH 2009, Ottawa, Canada, May 4-6, 2009. Proceedings
- pp 53-64
- Print ISBN
- Online ISBN
- Series Title
- Lecture Notes in Business Information Processing
- Series Volume
- Series ISSN
- Springer Berlin Heidelberg
- Copyright Holder
- Springer-Verlag Berlin Heidelberg
- Additional Links
- Access control
- rule editor
- Industry Sectors
- eBook Packages
- Editor Affiliations
- 6. Technologies de l’Information, HEC Montréal, 3000, ch. de la Côte-Sainte-Catherine
- 7. Institut d’informatique, Université de Neuchâtel
- 8. School of Computer Science, Carleton University
- Author Affiliations
- 9. School of Information Technology and Engineering, University of Ottawa, Canada, and Devera Logic, Inc., Ottawa, Canada
To view the rest of this content please follow the download PDF link above.