Context-dependent access control for web-based collaboration environments with role-based approach

Controlling access to resources is one of the most important protection goals for web-based collaboration environments in practice. In general, access control requires identification of subjects that intend to use resources. Today, there are several identification mechanisms for subjects, providing different security levels. However, some of them are only suitable to be used in specific environments. In this paper we consider access control to web-based collaboration environments where access control also depends on the actually used identification mechanism as a context-dependent parameter. Furthermore, we show how to model this kind of context-dependent access control for web-based collaboration environments by using role-based concepts. Additionally, we present how complex role hierarchies in the context-dependent case can be generated from basic role hierarchies. This is achieved by applying direct products as a special arithmetic operation over role hierarchies and context hierarchies

Context-dependent access control for web-based collaboration environments with role-based approach

Abstract. Controlling access to resources is one of the most important protection goals for web-based collaboration environments in practice. In general, access control requires identification of subjects that intend to use resources. Today, there are several identification mechanisms for subjects, providing different security levels. However, some of them are only suitable to be used in specific environments. In this paper we consider access control to web-based collaboration environments where access control also depends on the actually used identification mechanism as a context-dependent parameter. Furthermore, we show how to model this kind of context-dependent access control for web-based collaboration environments by using role-based concepts. Additionally, we present how complex role hierarchies in the context-dependent case can be generated from basic role hierarchies. This is achieved by applying direct products as a special arithmetic operation over role hierarchies and context hierarchies.