Torsten Priebe

Supporting attribute-based access control with ontologies

In highly open systems like the Internet, attribute-based access control (ABAC) has proven its appropriateness. The specification and maintenance of ABAC policies however has turned out to be complex and error-prone, especially if heterogeneous attribute schemes are involved. Here, the arising semantic Web can contribute to a solution. This paper presents an approach based on an extension of the established XACML standard. It simplifies the policies by providing an ontology-based attribute management facility.

A Pattern System for Access Control

In order to develop trustworthy information systems, security aspects should be considered from the early project stages. This is particularly true for authorization and access control services, which decide which users can access which parts of the system and in what ways. Software patterns have been used with success to encapsulate best practices in software design. A good collection of patterns is an invaluable aid in designing new systems by inexperienced developers and is also useful to teach and understand difficult problems. Following in this direction, this paper presents a pattern system to describe authorization and access control models. First, we present a set of patterns that include a basic authorization pattern that is the basis for patterns for the well-established discretionary and role-based access control models. Metadata access control models have appeared recently to address the high flexibility requirements of open, heterogeneous systems, such as enterprise or e-commerce portals. These models are complex and we use the basic patterns to develop a set of patterns for metadata-based access control.

Towards OLAP security design — survey and research issues

With the use of data warehousing and online analytical processing (OLAP) for decision support applications new security issues arise. The goal of this paper is to introduce an OLAP security design methodology, pointing out fields that require further research work. We present possible access control requirements categorized by their complexity. OLAP security mechanisms and their implementations in commercial systems are presented and checked for their suitability to address the requirements. Traditionally data warehouses were queried by high level users (executive management, business analysts) only. As the range of potential users with data warehouse access is steadily growing, this assumption is no longer appropriate and the necessity of proper access control mechanisms arises. However, a data warehouse is primarily built as an open system. Especially exploratory OLAP analysis requires this open nature; security controls may hinder the analytical discovery process.

A Pragmatic Approach to Conceptual Modeling of OLAP Security

Traditionally data warehouses were queried by high level users (executive management, business analysts) only. As the range of potential users with data warehouse access is steadily growing, this assumption is no longer appropriate and the necessity of proper access control mechanisms arises. The security capabilities of available commercial OLAP systems are highly proprietary and the syntax of their security constraints is not suitable for design and documentation purposes. Also, approaches trying to derive the access control policies from the operational data sources have not been very successful, as the relational model is predominate in operational systems while OLAP systems make use of the non-traditional multidimensional model. Access control schemes do not map easily. We approach the issue from the application side by introducing a methodology and a language for conceptual OLAP security design.

Ontology-based integration of OLAP and information retrieval

This paper describes an ontology-based approach for building an enterprise knowledge portal that integrates OLAP and information retrieval functionality to access both structured data stored in a data warehouse and unstructured data in form of documents. We discuss how to perform global searches over these information sources. In addition, our approach provides adaptive searching by tracking the user context. When a user performs ad-hoc navigation in an OLAP report, the system will be able to use the query context information to also search for relevant documents.

A search engine for RDF metadata

This paper presents a search engine for RDF metadata. Existing search facilities in this environment only support exact queries. We argue that a fuzzy approach as known from classic (full-text) Information Retrieval, providing fuzzy result sets ranked by relevance, is also desirable for metadata-based searches. Consequently, we develop an information retrieval model based on the similarity of RDF descriptions. The role of an ontology and implicit information that can be inferred from it will be discussed and the implementation within a knowledge portal prototype will be presented

A Context-Based Approach for Supporting Knowledge Work with Semantic Portals

Portals are an enabling technology for knowledge management (KM): They provide users with a consolidated interface that allows accessing various types of structured and unstructured information. From the view of KM, their success depends not only on the ability to provide information and knowledge depending on the user’s tasks in business processes (exploitation of knowledge) but also on the ability to support unstructured, creative and learning-oriented actions of knowledge work (exploration of knowledge). However, knowledge management lacks concepts for integrated support of these orientations of knowledge work. The concept of knowledge stance is seen as a promising starting point. This paper presents the INWISS portal prototype that employs Semantic Web technologies for context-based integration of various information sources and applications on a semantic level and discusses extensions to this portal for the support of knowledge stances.

Utilizing Semantic Web Technologies for Efficient Data Lineage and Impact Analyses in Data Warehouse Environments

Data warehouse (DWH) systems play an important role in the IT landscapes of today’s enterprises. In order to cope with the complex transformation processes and big data volumes, they have to be supplemented by metadata. Two main uses of such metadata are data lineage analyses, allowing data elements within the DWH to be traced back to their origin, and impact analyses, revealing which other elements may be impacted by planned modifications to certain data elements. As these types of queries operate on graphs (data elements being transformed through the different DWH layers), Semantic Web technologies should provide a perfect toolset. However, today’s metadata management tools utilize proprietary or regular SQL storage and querying mechanisms. Hence, this paper reviews the applicability of Semantic Web technologies for performing efficient data lineage or impact analyses in DWH environments.

Authrule: a generic rule-based authorization module

As part of the access control process an authorization decision needs to be taken based on a certain authorization model. Depending on the environment different models are applicable (e.g., RBAC in organizations, MAC in the military field). An authorization model contains all necessary elements needed for the decision (e.g., subjects, objects, and roles) as well as their relations. As these elements are usually inherent in the software architecture of an access control module, such modules limit themselves to the use of a certain specific authorization model. A later change of the model consequently results in a substantial effort for revising the software architecture of the given module. Rule-based systems are well suited to represent authorization models by mapping them to facts and rules, which can be modified in a flexible manner. In this paper we present a generic authorization module, which can take authorization decisions on the basis of arbitrary models utilizing rule-based technology. The implementation of the popular RBAC and ABAC (attribute-based access control) models is demonstrated.

Ein integrativer Ansatz für unternehmensweite Wissensportale

Wissensportale leisten einen wichtigen Beitrag zum Wissensmanagement eines Unternehmens, indem sie es Benutzern ermoglichen, direkt mit Geschaftsprozessen und Wissen zu arbeiten. Dabei bieten Wissensportale durch eine konsolidierte, personalisierte Benutzeroberflache einen effizienten Zugriff auf die immer unuberschaubarer werdende Flut an Informationen, die die Wissensbasis des Unternehmens bilden. Heutige Portalsysteme beschranken sich jedoch auf die gemeinsame Darstellung unterschiedlicher Wissensressourcen (Data Warehouse, Dokumentenmanagementsystem, Internet, etc.) in Form von sog. Portlets auf einer Portalseite. Eine Interaktion der Portlets untereinander erfolgt nicht. Navigiert ein Benutzer innerhalb eines Portlets, so bleiben die anderen statisch, was bedeutet, dass jede Wissensressource getrennt nach relevanten Informationen durchsucht werden muss. Dieser Beitrag stellt einen Integrationsansatz vor, der im Sinne einer effizienten Wissensnutzung den durch Navigation in einem Portlet offenbarten Informationsbedarf eines Benutzers auch in anderen Portlets zum Auffinden passender Informationen heranzieht. Zur Evaluation des Ansatzes ist ein prototypisches Portalsystem in Entwicklung, welches sich auf die Integration von OLAP und Information Retrieval konzentriert.