Modelling Dynamic Access Control Policies for Web-Based Collaborative Systems

Abstract. We present a modelling language, called X-Policy, for webbased collaborative systems with dynamic access control policies. The access to resources in these systems depends on the state of the system and its configuration. The X-Policy language models systems as a set of actions. These actions can model system operations which are executed by users. The X-Policy language allows us to specify execution permissions on each action using complex access conditions which can depend on data values, other permissions, and agent roles. We demonstrate that X-Policy is expressive enough to model collaborative conference management systems. We model the EasyChair conference management system and we reason about three security attacks on EasyChair.

• Type: Conference
• Year: 2010
• Where: DBSEC
• Authors: Hasan Qunoo, Mark Ryan
• Keywords: Database, DBSEC 2010, Language Models Systems, Webbased Collaborative Systems, X-Policy Language