Abstract
Current architectures and data flow models for access control are based on request response communication. In stateful or session-based applications monitoring access rights over time this results in polling of authorization services and for Attribute-Based Access Control (ABAC) in the polling of policy information points. This introduces latency or increased load due to polling. Attribute-Stream-based Access Control (ASBAC) is an authorization model based on a publish subscribe pattern mitigating these bottlenecks. ASBAC allows the quasi real time consideration of attribute data streams for access control decisions, such as internet-of-things (IoT) sensor data. This paper introduces the Structure and Agency Policy Language (SAPL) for implementing ASBAC. In addition, the paper describes how ASBAC with SAPL can be implemented by applying a reactive programming model and describes key algorithms for evaluating SAPL policies.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
References
American National Standards Institute: INCITS 499–2018: Information technology - next generation access control - functional architecture. Technical report, American National Standards Institute (2018)
Barker, C.: Cultural Studies: Theory and Practice. Sage, Thousand Oaks (2003)
Bonér, J., et al.: The reactive manifesto (2014). https://www.reactivemanifesto.org/. Accessed 15 May 2019
Bray, T.: The JavaScript Object Notation (JSON) Data Interchange Format. RFC 7159, March 2014. https://doi.org/10.17487/RFC7159, https://rfc-editor.org/rfc/rfc7159.txt
Open Geospatial Consortium: Geospatial extensible access control markup language (GeoXACML). Technical report, Open Geospatial Consortium (2011). https://www.opengeospatial.org/standards/geoxacml
Gamma, E., Helm, R., Johnson, R., Vlissides, J.: Design Patterns: Elements of Reusable Object-oriented Software. Addison-Wesley Longman Publishing Co., Inc., Boston (1995)
Gossner, S.: JSONPath - XPath for JSON (2006). https://goessner.net/articles/JsonPath/. Accessed 14 June 2019
Heutelbeck, D.: Attribute stream-based access control (ASBAC) - functional architecture and patterns. In: Proceedings of the 2019 International Conference of Security and Management (SAM 2019) (2019)
Heutelbeck, D.: SAPL policy engine (2019). https://github.com/heutelbeck/sapl-policy-engine. Accessed 10 May 2019
Heutelbeck, D.: SAPL policy engine demos (2019). https://github.com/heutelbeck/sapl-demos. Accessed 10 May 2019
Hu, V.C., et al.: Guide to attribute based access control (ABAC) definition and considerations. Technical report, National Institute of Standards and Technology, January 2014. https://doi.org/10.6028/nist.sp.800-162
Ijeh, A.C., Brimicombe, A.J., Preston, D.S., Imafidon, C.O.: Geofencing in a security strategy model. In: Jahankhani, H., Hessami, A.G., Hsu, F. (eds.) ICGS3 2009. CCIS, vol. 45, pp. 104–111. Springer, Heidelberg (2009). https://doi.org/10.1007/978-3-642-04062-7_11
Jiang, H., Bouabdallah, A.: JACPoL: a simple but expressive JSON-based access control policy language. In: Hancke, G.P., Damiani, E. (eds.) WISTP 2017. LNCS, vol. 10741, pp. 56–72. Springer, Cham (2018). https://doi.org/10.1007/978-3-319-93524-9_4
Jiang, H., Bouabdallah, A.: Towards a JSON-based fast policy evaluation framework. In: Panetto, H., et al. (eds.) OTM 2017. LNCS, vol. 10574, pp. 22–30. Springer, Cham (2017). https://doi.org/10.1007/978-3-319-69459-7_2
Latham, D.C.: Department of defense trusted computer system evaluation criteria. Department of Defense (1986)
Linklater, G., Smith, C., Connan, J., Herbert, A., Irwin, B.V.: JSON schema for attribute-based access control for network resource security. In: Proceedings of Southern Africa Telecommunication Networks and Applications Conference (SATNAC 2017). (2017)
Lockhart, H., Parducci, B.: JSON profile of XACML 3.0 version 1.0 (2017). http://docs.oasis-open.org/xacml/xacml-json-http/v1.0/xacml-json-http-v1.0.html. Accessed 10 May 2019
Sandhu, R.S.: Role-based access control. In: Advances in Computers, vol. 46, pp. 237–286. Elsevier (1998)
XACML 3.0 Committee: extensible access control markup language (XACML) version 3.0 (2013). http://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.html. Accessed 10 May 2019
XACML 3.0 Committee: Abbreviated language for authorization version 1.0 (2015). https://www.oasis-open.org/committees/download.php/55228/alfa-for-xacml-v1.0-wd01.doc. Accessed 10 May 2019
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
A SAPL Grammar
A SAPL Grammar
Rights and permissions
Copyright information
© 2020 Springer Nature Switzerland AG
About this paper
Cite this paper
Heutelbeck, D. (2020). The Structure and Agency Policy Language (SAPL) for Attribute Stream-Based Access Control (ASBAC). In: Saracino, A., Mori, P. (eds) Emerging Technologies for Authorization and Authentication. ETAA 2019. Lecture Notes in Computer Science(), vol 11967. Springer, Cham. https://doi.org/10.1007/978-3-030-39749-4_4
Download citation
DOI: https://doi.org/10.1007/978-3-030-39749-4_4
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-030-39748-7
Online ISBN: 978-3-030-39749-4
eBook Packages: Computer ScienceComputer Science (R0)