Industry Alignment of the EDS Fellows and Distinguished SEs

1
T. Hill Review ofROWLBAC Representing Role
Based Access Control in OWLT. Finin, A. Joshi L.
Kagal, B. Thuraisingham, J. Niu, R. Sandhu, W.
Winsborough 10/13/2008
Problem Using the hierarchy diagram below,
describe how OWL (Web Ontology Language) can be
used to specify the following RBAC security model
access control functions assign the role of
Person and two sub-class roles of Citizen and
Visitor, assign to Citizen the permitted actions
of Vote, Work, Jury, assign to Visitor a
prohibited action of Work. Make Alice an active
Citizen and Bob an active Visitor. note -
general descriptive language is acceptable, exact
RDF/OWL syntax is not necessary.

• Motivation
• Applications sophisticated, intelligent, open
  and dynamic environments
• Future Grid computing, intelligent agents,
  negotiate exchange of information
• Security of future applications, regardless of
  infrastructure, including the cloud
• Bring together two parallel themes
• Access Control Models RBAC96, NIST Standard,
  RT, Usage Control
• Policy Languages XACML, Ponder, Rei, KAoS

2
ROWLBAC Semantic Web and OWL

• Semantic Web
• Berners-Lee vision
• Knowledge published so humans and computers can
  understand and reason
• Technology
• W3C standards RDF (Resource Description
  Framework) triple
• //..html has a creation-date whose value is
  August 16, 1999
• Description Logic

3
ROWLBAC Roles as Classes, Permissions,
Activation, Enforcing

• Hierarchy of roles

• Enforcing RBAC activation rule

?ACTION a ActivateRole
subject ?SUBJ object ?ROLE.
?SUBJ a ?ROLE. ?ROLE activeForm ?AROLE.
?AROLE rdfssubClassOf ActiveRole. gt
?ACTION a PermittedRoleActivation
subject ?SUBJ object ?ROLE.
?SUBJ a ?AROLE .

• Associating permissions with roles

PermittedVoteAction a rdfsClass
rdfssubClassOf rbacPermittedAction
owlequivalentClass a owlClass
owlintersectionOf ( Vote
a owlRestriction
owlallValuesFrom exActiveCitizen
owlonProperty rbacsubject
)

• Assigning roles and activation in a session

4
ROWLBAC A Proposed Solution
Problem Using the hierarchy diagram below,
describe how OWL (Web Ontology Language) can be
used to specify the following RBAC security model
access control functions assign the role of
Person and two sub-class roles of Citizen and
Visitor, assign to Citizen the permitted actions
of Vote, Work, Jury, assign to Visitor a
prohibited action of Work. Make Alice an active
Citizen and Bob an active Visitor. note -
general descriptive language is acceptable, exact
RDF/OWL syntax is not necessary.
Proposed solution 1. Use RDF/OWL to define
Citizen as a subclass of Person
and Visitor as a subclass of
Person 2. Use RDF/OWL to define Vote as a
permitted action of Citizen
and Work as a permitted action of
Citizen and Jury
as a permitted action of Citizen
And Work as a prohibited action of
Visitor 3. At run time, set Alice as an active
Citizen and Bob as an active
Visitor