Usage Control in Service-Oriented Architectures

Usage control governs the handling of sensitive data after it has been given away. The enforcement of usage control requirements is a challenge because the service requester in general has no control over the service provider’s information processing devices. We analyze applicable trust models, conclude that observation-based enforcement is often more appropriate than enforcement by direct control over the service provider’s actions, and present a logical architecture that blends both forms of enforcement with the business logics of serviceoriented architectures.

• Type: Conference
• Year: 2007
• Where: TRUSTBUS
• Authors: Alexander Pretschner, Fabio Massacci, Manuel Hilty
• Keywords: Enforcement, Security Privacy, TRUSTBUS 2007, Usage Control, Usage Control Requirements