Secure collaboration in mediator-free environments

ABSTRACT

The internet and related technologies have made multidomain collaborations a reality. Collaboration enables domains to effectively share resources; however it introduces several security and privacy challenges. Managing security in the absence of a central mediator is even more challenging. In this paper, we propose a distributed secure interoperability framework for mediator-free collaboration environments. We introduce the idea of secure access paths which enables domains to make localized access control decisions without having global view of the collaboration. We also present a path authentication technique for proving path authenticity. Furthermore, we present both a proactive and on-demand path discovery algorithms that enable domains to securely discover paths in the collaboration environment.

REFERENCES

• 1: Hamideh Afsarmanesh , César Garita , Louis O. Hertzberger, Virtual Enterprises and Federated Information Sharing, Proceedings of the 9th International Conference on Database and Expert Systems Applications, p.374-383, August 24-28, 1998
• 2: D. Bell and L. LaPadula. Secure Computer Systems: Mathematical Foundations. Technical Report MTR-2547, 1, March 1973.
• 3: Elisa Bertino , Elena Ferrari , Vijay Atluri, The specification and enforcement of authorization constraints in workflow management systems, ACM Transactions on Information and System Security (TISSEC), v.2 n.1, p.65-104, Feb. 1999 [doi>10.1145/300830.300837]
• 4: P. A. Bonatti , M. L. Sapino , V. S. Subrahmanian, Merging heterogenous security orderings, Journal of Computer Security, v.5 n.1, p.3-29, Jan. 1997
• 5: D. Brewer and M. Nash. The Chinese Wall Security Policy. In Proceedings of IEEE Symposium on Security and Privacy, pages 206--214, 1989.
• 6: Jason Crampton, On permissions, inheritance and role hierarchies, Proceedings of the 10th ACM conference on Computer and communications security, October 27-30, 2003, Washington D.C., USA [doi>10.1145/948109.948123]
• 7: Steven Dawson , Shelly Qian , Pierangela Samarati, Providing Security and Interoperation of HeterogeneousSystems, Distributed and Parallel Databases, v.8 n.1, p.119-145, Jan. 2000 [doi>10.1023/A:1008787317852 ]
• 8: A. Desai and N. Awad. Special Issue on Adaptive Complex Enterprises. Communications of ACM, 48(5), May 2005.
• 9: David F. Ferraiolo , D. Richard Kuhn , Ramaswamy Chandramouli, Role-Based Access Control, Artech House, Inc., Norwood, MA, 2003
• 10: David F. Ferraiolo , Ravi Sandhu , Serban Gavrila , D. Richard Kuhn , Ramaswamy Chandramouli, Proposed NIST standard for role-based access control, ACM Transactions on Information and System Security (TISSEC), v.4 n.3, p.224-274, August 2001 [doi>10.1145/501978.501980]
• 11: Li Gong , Xiaolei Qian, The Complexity and Composability of Secure Interoperation, Proceedings of the 1994 IEEE Symposium on Security and Privacy, p.190, May 16-18, 1994
• 12: Li Gong , Xiaolei Qian, Computational Issues in Secure Interoperation, IEEE Transactions on Software Engineering, v.22 n.1, p.43-52, January 1996 [doi>10.1109/32.481533 ]
• 13: Yih-Chun Hu , Adrian Perrig , David B. Johnson, Ariadne:: a secure on-demand routing protocol for ad hoc networks, Proceedings of the 8th annual international conference on Mobile computing and networking, September 23-28, 2002, Atlanta, Georgia, USA [doi>10.1145/570645.570648]
• 14: David B. Johnson , David A. Maltz , Josh Broch, DSR: the dynamic source routing protocol for multihop wireless ad hoc networks, Ad hoc networking, Addison-Wesley Longman Publishing Co., Inc., Boston, MA, 2001
• 15: Dirk Jonscher , Klaus R. Dittrich, An Approach for Building Secure Database Federations, Proceedings of the 20th International Conference on Very Large Data Bases, p.24-35, September 12-15, 1994
• 16: Ninghui Li , Ziad Bizri , Mahesh V. Tripunitara, On mutually-exclusive roles and separation of duty, Proceedings of the 11th ACM conference on Computer and communications security, October 25-29, 2004, Washington DC, USA [doi>10.1145/1030083.1030091]
• 17: Heiko Ludwig , Keith Whittingham, Virtual enterprise co-ordinator—agreement-driven gateways for cross-organisational workflow management, Proceedings of the international joint conference on Work activities coordination and collaboration, p.29-38, February 22-25, 1999, San Francisco, California, United States
• 18: Jayant Madhavan , Philip A. Bernstein , AnHai Doan , Alon Halevy, Corpus-Based Schema Matching, Proceedings of the 21st International Conference on Data Engineering (ICDE'05), p.57-68, April 05-08, 2005 [doi>10.1109/ICDE.2005.39]
• 19: J. Madhavan and A. Halevy. Composing Mappings Among Data Sources. In VLDB'2003: Proceedings of the Twenty Ninth International Conference on Very Large Databases, 2003.
• 20: Matthew Morgenstern , Teresa F. Lunt , Bhavani M. Thuraisingham , David L. Spooner, Security Issues in Federated Database Systems: Panel Contributions, Results of the IFIP WG 11.3 Workshop on Database Security V: Status and Prospects, p.131-148, November 01, 1991
• 21: Rajiv Ramnath , David Landsbergen, IT-enabled sense-and-respond strategies in complex public organizations, Communications of the ACM, v.48 n.5, May 2005 [doi>10.1145/1060710.1060740]
• 22: R. L. Rivest , A. Shamir , L. Adleman, A method for obtaining digital signatures and public-key cryptosystems, Communications of the ACM, v.21 n.2, p.120-126, Feb. 1978 [doi>10.1145/359340.359342]
• 23: Ravi S. Sandhu , Edward J. Coyne , Hal L. Feinstein , Charles E. Youman, Role-Based Access Control Models, Computer, v.29 n.2, p.38-47, February 1996 [doi>10.1109/2.485845 ]
• 24: Sabrina De Capitani di Vimercati , Pierangela Samarati, Authorization specification and enforcement in federated database systems, Journal of Computer Security, v.5 n.2, p.155-188, Jan. 1997
• 25: Gio Wiederhold , Michel Bilello , Chris Donahue, Web Implementation of a Securtty Mediator for Medical Databases, Proceedings of the IFIP TC11 WG11.3 Eleventh International Conference on Database Securty XI: Status and Prospects, p.60-72, August 10-13, 1997

INDEX TERMS

Primary Classification:
  D. Software
  D.4 OPERATING SYSTEMS
      D.4.6 Security and Protection
          Subjects: Access controls

Additional Classification:
  H. Information Systems
  H.2 DATABASE MANAGEMENT
      H.2.7 Database Administration
          Subjects: Security, integrity, and protection

General Terms:
Design, Security, Theory

Keywords:
access path, collaboration, decentralized secure interoperability, path discovery, role based access control