A comparison of modeling strategies in defining XML-based access control languages