Generic Access Rights Delegation Framework for Collaborative Environment

Abstract

Protection of shared data from unauthorized users is the most challenging problem of cyber security for which di erent access control models have been introduced. However, to provide exibility in access control models, access rights are delegated within a single security domain or across multiple secu- rity domains for di erent collaborative activities. To the best of our knowl- edge, there is no published standard for delegation models. Therefore, orga- nizations are unable to evaluate existing delegation models when they have to choose appropriate solution that best satis es their business requirements. In this thesis, we have carried out research in two major folds, where one direction includes the comparative analysis of di erent delegation models. We have done literature survey and presented the taxonomy of delegation model, which classi es and elaborates the di erent features, concepts and scenarios of delegation. Presented taxonomy has been used, in this thesis, as an assessment criterion for the evaluation of existing delegation models. We have compared these models against our taxonomy. Our presented taxon- omy is very useful to understand the basic delegation concepts and may be rst step toward standardization process. In second fold of research, we have proposed a generic framework for delegation of access rights. In this fold, we have analyzed that di erent proposed delegation model are strongly coupled with their speci c access control model (ACM). For instance, if organization has deployed Role based Access Control (RBAC) model then it must use Role Based Delegation Model (RBDM). Similarly, Attribute Based Access Control (ABAC) model requires Attribute Based Delegation (ABDM) and so on. However, when organizations need to work in a collaborative environ- ment, their heterogeneous environment in the context of ACMs, makes the delegation process di cult to achieve. To solve this issue, we have proposed a Generic Access Rights Delegation (GARD) framework for collaborative environment. We have considered group-centric Secure Information Shar- ing (g-SIS) model to develop a collaborative environment. Our framework generates a delegation policy as per underlying ACM of participating or- ganization, dynamically. GARD provides interoperability between di erent 2 Abstract ACMs during generation of delegation policies.