Automatic Enforcement of Access Control Policies Among Dynamic Coalitions

Abstract

The need to securely share information on an ad-hoc basis between collaborating entities is increasingly becoming important. We propose a coalition based access control model (CBAC), comprised of three layers: coalition, role and user-object layers. Our model enables translation of coalition level policies to implementation level access control in a manner similar to that of the layers of the TCP/IP protocol. We present a coalition policy translation protocol that allows the implementation level access control details to be piggybacked as the access control policy percolates to the coalition level, and similarly, as the coalition level policy trickles down to the implementation level. Under our approach, a user’s request to access an object belonging to another coalition entity is automatically translated by employing an approach that considers attributes associated with user credentials and objects. Our approach ensures that the individual access control policies of each coalition entity as well as the agreed-upon coalition policies for sharing are enforced.

This work is supported in part by the National Science Foundation under grant IIS-0306838.