A Conceptual Framework for GroupCentric Secure Information Sharing

A Conceptual Framework for Group-Centric Secure Information Sharing Ram Krishnan (George Mason University) Ravi Sandhu, Jianwei Niu, William Winsborough (University of Texas at San Antonio) ASIACCS 2009, Sydney, Australia

Secure Information Sharing (SIS) • A fundamental problem in cyber security – Share but protect • Current approaches not satisfactory • Classic models (DAC/MAC/RBAC) do not work • Recent approaches • Proprietary systems for Enterprise Rights Management • Many solutions: IBM, CA, Oracle, Sun, Authentica, etc. • Interoperability is a major issue • Many languages have been standardized • Xr. ML, ODRL, XACML, etc. • Primarily, dissemination or object centric 2

Dissemination Centric Sharing • Attach attributes and policies to objects – Objects are associated with sticky policies – Xr. ML, ODRL, XACML, etc. provide sticky policies Attribute + Policy Cloud Object Alice Attribute Cloud Object Bob Attribute Cloud Attribute + Policy Cloud Object Charlie Attribute Cloud Attribute + Policy Cloud Object Ravi Attribute Cloud Dissemination Chain with Sticky Policies on Objects Shashi Attribute Cloud 3

Group Centric Sharing (g-SIS) • Advocates bringing users & objects together in a group – In practice, co-exists with dissemination centric sharing Join Never Group Subject Join Current Group Subject Leave Add Past Group Subject Never Group Object Add Current Group Object Remove Past Group Object • Two useful metaphors – Secure Meeting/Document Room • Users’ access may depend on their participation period • E. g. Program committee meeting, Collaborative Product Development, Merger and Acquisition, etc. – Subscription Model • Access to content may depend on when the subscription began • E. g. Magazine Subscription, Secure Multicast, etc. 4

Core g-SIS Properties 1. Provenance: Authorization can only originate during a simultaneous period of membership Authz Join Add Authz Add Join 2. Bounded Authorization: Authorization cannot grow during nonmembership periods 3. Persistence: Authorization cannot change if no group event occurs

g-SIS Operation Semantics Strict Join Liberal Join Subjects Strict Leave Liberal Leave GROUP Strict Add Liberal Add Authz (S, O, R)? Objects Strict Remove 6 Liberal Remove 6

Operation Semantics (Continued) • • Strict Join (SJ): Only access objects added after Join time Liberal Join (LJ): Also access objects added before Join time Strict Leave (SL): Lose access to all objects Liberal Leave (LL): Retain authorizations held at Leave time 7

Operation Semantics (Continued) • Strict Add (SA): Only existing subjects at Add time are authorized • Liberal Add (LA): No such restrictions • Strict Remove (SR): All subjects lose access • Liberal Remove (LR): Subjects who had authorization at Remove time can retain access 8

Family of g-SIS Models Traditional Groups: <LJ, SL, LA, SR> Secure Multicast: <SJ, LL, LA, *> Most Restrictive g-SIS Specification: 9

Conclusion & Future Work • • Group-centric Vs Dissemination-centric Focus on group operation semantics Lattice of g-SIS models Ongoing Work – Extension to other operations such as write, etc. – Multiple groups • Investigate information flow • Compare with Lattice Based Access Control models – Attribute Based Access Control in g-SIS 10

Comments & Questions Thank You! Email: rkrishna@gmu. edu Web: http: //mason. gmu. edu/~rkrishna 11

Backup 12

Presentation Outline • Secure Information Sharing (SIS) – Dissemination Vs Group Centric • • • Group Centric SIS (g-SIS) g-SIS Core Properties g-SIS Operation Semantics Family of g-SIS Models Usage Scenarios Conclusions 13

g-SIS (continued) Join Never Group Subject Join Current Group Subject Leave Past Group Subject Membership States Add Never Group Object Add Current Group Object Remove Past Group Object Membership States

Operation Semantics (Continued) 15

Re-visiting Metaphors • Program Committee Meeting – Committee members initially enter room with LJ – Exit room with LL – Re-admitted with SJ if no access allowed to conversations during periods of absence • LJ, on the other hand, will allow access • Objects added with SA are accessible to existing members in the room 16