Context plays a key role, as recongnized by a wide body of research, in application and entity adaptation in the ubiquitous computing world characterized by extensive platform heterogenity and environment dynamicity and unpredictability. Implicit in the notion of context, as used by context-aware applications, is the actual effects, including constraints, context has on target entities. We believe that making a step further from explicit reasoning about context to explicit reasoning about its implicit effects will facilitate more effective and exible adaptation. In this work we present an approach to modeling the world based on natural notions of container and containment and show how it enables explicit reasoning about and acting upon context-implied effects on target entities, data objects in particular. We also outline a practical use of the model through its application in a system for autonomic context-aware infromation security and privacy protection.
Irrelevant of a particular context de nition or categorization the very notion of context as used in context-aware computing has two fundamental aspects: a particular set of entities affected by a context and a set of contextual effects of interest. Both are application-speci c. The mapping from context description to a set of contextual effects affecting an entity is often implicit in application design or policy speci cation, e.g.: a set of constraints imposed by a device's rendering capabilities on presentation of a document; a set of options available in activityaware decision support applications; a set of security and privacy threats present for a entity in its environment.
In this paper we neither offer a novel de nition of
context nor propose a context categorization approach.
What we are interested in is modeling, reasoning about
and controlling effects that contextual states imply for
target entities. The advent of ubiquitous and pervasive
computing has necessitated a move away from static
security policies to more dynamic models [
2.1
We de ne a container to be a physical or virtual enclosure, a bounded region with a distinctive interior, boundary and exterior, in which another container, or ultimately a piece of information, may exist. 2.1.1
Containers are classi ed into a container class hierarchy based on their characteristics and primary functionality. Container characteristics are inherited down the hierarchy going from abstract towards more specialized classes. An example classi cation is depicted in Figure 1. At the top level, we de ne the classes directly inheriting from the container as physical, intermediate and virtual containers while the lower levels are application speci c. Physical containers exist in the physical world, i.e. are object of three dimensions, such as e.g. a room or a space within a secure perimeter. Virtual containers, on the other hand, exist solely in the virtual, digital, realm such as e.g. a GUI window, a le system, a le, a TCP packet or a IPSEC/SSL tunnel. Intermediate containers represent a bridge between the physical and the virtual realms by being physical objects or a composition, in the UML sense, of physical objects but containing only virtual entities. Examples of intermediate containers are: a mobile phone, a laptop, a storage device, a display, a communications link etc. Classi cation granularity impacts on the physical and intermediate class boundaries.
We de ne a containable relationship to denote, for each container class, which container classes may t, i.e. be contained, within it. For example, a le system may contain a le, a communications link may contain a TCP packet or an IPSEC tunnel etc. In the general case, physical containers may contain further physical or intermediate containers - based on their physical characteristics, namely the size/volume; intermediate containers may contain intermediate or virtual containers while virtual containers may contain only containers of the same class.
We de ne the data object class as an atomic class in a way that it denotes pure information content and may not contain any other container classes. The notion of a data object is different from the traditional notion of a le and represents a collection of information indivisible according to some criteria, e.g. a security classi cation. A le, being a virtual container, may contain one or more data objects, e.g. a document containing distinctive paragraphs of text, pictures and tables. 2.1.2
Inherent to the notion of container is its boundary, either physical or virtual. With respect to the container boundary we can divide the context into internal and external. To in uence the internal context, effects implied by the external context have to cross the container boundary. For example, if it is daylight and if a room has an outside window then there is going to be daylight in the room as well; or if a person has physical access to a mobile device and the device is not tamper resistant then physical access to the stored information is implicit.
Container transparency denotes ltering characteristics that a container's boundary poses for different types of contextual effects crossing it. With respect <<abstract>> Physical Space ...
17" LCD Room <<abstract>> Intermediate ... <<abstract>>
Virtual ...
AES File Data Object ...
Input Dev
Comms Channel Click Keyboard to a speci c contextual effect a container's boundary may be: opaque, in which case the effect does not cross the boundary and thus has no in uence on container's internal context; fully transparent, when the boundary poses no barrier for the effect; and partially transparent, when the boundary has an qualitative impact on the effect. Apart from being a function of container's class and contextual effect type, transparency is affected by the internal state of a container, e.g. the level to which glass in a window is dimmed impacts the amount and the specter of daylight that enters the room while the level of tamper resistance of a device determines the skill, determination and knowledge required to access the data stored within. 2.2
We model the world, in graph theoretic notion, as a
nite-path-length, nite-degree, rooted trees in which
nodes represent containers and directed edges
represent containment. We call these trees Containment
Trees. The niteness of a containment tree is
guaranteed by the bounding characteristics of containers in
conjunction with the existence of the minimum
granularity container - the data object. Containers of class
data object are always leaf nodes of a tree. The notion
of the Containment Tree is similar to the notion of
Information Tree in [
Containment Expressions represent the syntax of
Containment Trees and draw from Cardelli's work on
Ambient Calculus [
To start, absence of contents at any level is represented simply by 0. At the top level, on its own, 0 represents an empty world.
A tree, with only a root node labeled is written as the expression : a a
A tree, with a root node labeled , leading to a subtree represented by P is written as the expression [P]:
P
A forest, consisting of two trees P and Q, is written as the expression PjQ:
P|Q
P
Q
Multiple instances of the same tree P is written as the expression !P: !P
P
P ...
P
A tree obtained by joining two trees P and Q at the root is written by the expression [PjQ]: a[P|Q] a P
Q 2.2.2
Using the containment syntax the state of the world at any point in time can be represented as: world world world pspace pspace pspace pspace intermediate intermediate intermediate intermediate virtual virtual virtual worldjworld pspace intermediate pspacejpspace pspace[pspace] pspace[intermediate] 0 0 0 intermediatejintermediate intermediate[intermediate] intermediate[virtual] virtualjvirtual virtual[virtual] where pspace, intermediate and virtual represent instances of container classes physical, intermediate and virtual container or any inheriting classes respectively. The containable relationship needs to be obeyed at each level in a containment tree for it to be wellstructured.
Figure 2 represents a partial snapshot of a state of the world representing two containment trees. Double circled nodes in the gure denote containers of data object class.
To re ect dynamic changes in the con guration of the world we provide for updating the model through three operations: enter operation causes a container, or a containment, to enter another containment; leave operation is the converse; while migrate operation binds the previous two in an atomic way and denotes change of containment within a realm. 2.2.3
To be able to reference a containment we use path expressions. A path can be de ned as a sequence of containers linked by the contains relationship, written as Location Service
Room Personal Digital
Assistant !. A sequence ! denotes that is contained within and that is its immediate, rst-level, container i.e. direct parent in the Container Tree representation. Path expressions are speci ed using the following syntax: element path j ?
element j path = element j path = ::: = element
A matching set of a path expression is either an empty set or a set with one element where:
A trivial expression element matches a container of class or of a more specialized class. Expression element ? matches container of any class.
Expression e1=e2 matches 1 !
1 and e2 matches 2.
Expression e1=:::=en matches if e1 matches 1, en matches between obey the previous rule.
2 if e1 matches 1 ! ::: ! n n and all steps in
The use of container classes in matching path elements, rather than unique container identi ers, shall be supported in the next section. 2.3
Although we talk about modeling the state of the world we do not envisage a holistic containmentbased picture of a ubiquitous system to exist in a centralized fashion, let alone that such a requirement would be infeasible considering the nature and inherent characteristics of the ubiquitous computing world. The model is devised to be established and maintained in an distributed and independent fashion, representing only small portions of what would be a true holistic state of the world, posing no consistency issues and used locally by ubiquitous devices and infrastructural services.
A device or service that is resource capable to establish and maintain a portion of the model is called a model authority or simply authority. Portion of the model, maintained by a single authority, is called a model realm or just realm. In Figure 2 we can distinguish four realms enclosed in dash-lined squares and labeled with their respective authorities: the personal digital assistant (P.D.A.), the table top PC (T.PC), the mobile phone (M.P.) and the location service. The fact that the mobile phone is not a part of the location service's realm denotes that it is either not-locatable by the particular technology employed or is out of its reach. Realm authorities are not necessarily represented as a node in the model, as is the case with the location service in the above example, which depends on they themselves representing a container class relevant for the model application.
The granularity of the model provided by an authority depends on its model establishment and maintenance capabilities. To model the full range of physical and virtual containers and maintain their state an authority needs support and awareness at both the system and application layers. The former is required for device hardware and operating platform software container representation. The latter is needed for modeling the application level containers such as e.g. GUI windows, application level communications channel tunnels or le types. Thus, an authority's individual level of model support de nes the minimum local quality and quantity of service for the model application. 2.4
By exploiting container transparency, establishing context at any level in a containment tree allows us to determine its effects at any other level in the model. Consequently, contextual effects a data object is exposed to in a particular context can be determined by identifying a set of effects implicit in the context and reasoning about their propagation across boundaries of containers comprising in the data object's containment.
Figure 3 a) shows how a set of effects a container boundary is exposed to ( ) is affected by the boundary's transparency ( filtered) and combined together with a set of effects originating from inside the container ( i) propagated down a containment tree ( ) in set theoretic notation:
i = [ i=1::n i [ filtered
Figure 3 b) represents an illustration of how a contextual effect is propagated down a data object's containment. The changing thickness and solidity of the arrows representing the contextual effect denotes the effect of the container boundaries (horizontal lines).
Reasoning about contextual effect propagation is not to be confused with a much more general notion of inter-container context dependencies. A context dependency can be described as a situation in which a contextual state within a container depends on the contextual state of another container. These dependencies may span containers in ways which can not be expressed in the proposed containment-based model of the world. Resolving and acting upon context dependencies is seen as a job of context awareness mechanisms and techniques and it precedes reasoning about the contextual effects as presented here.
A container's boundary transparency, as stated previously, can change based on container's state, e.g. open vs. closed door of a room with respect to sound permeability. This enables, by controlling state of containers on the containment propagation path between the context occurrence and a data object, to affect the set and the degree of contextual effects experienced by the data object. Furthermore, the same can be accomplished by purposeful insertion of a new container on the path.
The main application target of the model is acting upon analysis of contextual effects experienced by a data object in an environment. For this we leverage container transparency as speci ed by the relevant container class. Thus using container classes, and not unique container identi ers, to express containment paths (Section 2.2.3) facilitates specifying policies to match all data objects affected by a set of contextual effects; rather than having a policy rule on per container instance basis causing unnecessary duplication. For example, a path /pda/storage device matches both /pda/hard drive and /pda/sd card, where sd card and hard drive are specializations of storage device and where it is the storage device class that de nes transparency for the particular contextual effect. 2.5
Other Modeling Approaches Related Work
Spatial models have been a focus of research in
several different areas of computer science such as
mobility theory, ubiquitous computing [
Theoretical foundations of mobility models have
been laid by the work on the -calculus [
Y Yfiltered l1,...,ln
Context
State Container Boundary Context Effect Data Object a) Propagation across container boundary.
b) Propagation down a containment.
proaches to structuring the world in mobility models
range from at, in M obadtl [
The presented model is signi cantly in uenced by
Cardelli's work on Ambient Calculus for mobile
ambients [
The key difference is in the underlying philosophy. We model the world using passive entities, containers, that have no computational power whatsoever. Rather than being concerned about the legality of migrations, i.e. model updates, and control over them we are interested in the way in which the represented entities affect external forces imposed on them, i.e. contextual effects, passively. We go further to analyse how compositions, i.e. nesting, of such entities and model recon gurations affect contextual effects propagation. We depart from a binary, allow-deny, decision model to provide for a plethora of container and model operations to control the degree of contextual effect propagation.
Scott's approach, being more practical, is founded on premises of pervasive location service and embedding of a notion of an owner to the entities which both bare scalability issues. The proposed model, being inherently distributed in an independent fashion poses no such issues. One of the consequences of this is a support for variable levels of granularity at which different realms are maintained - which greatly aids the model deployment in ubiquitous computing environments. 3
The presented containment-based model of the world is suitable for a class of context-aware applications that satisfy the following two fundamental requirements: the world can be structured as a forest of containment trees based on container classes that have an explicit role in reasoning about an external set of forces, e.g. contextual effects; those forces can be explicitly identi ed, e.g. application-speci c effects implicit in context. Model exibility allows for its application in a wide variety of settings.
We brie y present our application of the model in an Autonomic System for Context-Adaptive Information Security and Privacy Protection. 3.1
Ubiquitous computing vision [
The availability of contextual information plays an
important part in reasoning about information
security and privacy in the face of frequent and
unpredictable context changes, as inherent in the ubiquitous
computing world. In more traditional environments,
characterized by the existence of a secure perimeter
and its implications together with the limited means
of information access and usage, contextual factors,
being predictable, are reasoned about implicitly and
built into static security policies. For adequate
information security and privacy protection in ubiquitous
computing we need explicit reasoning about the
context, this is especially true for authorization and access
control mechanisms [
In our work on context-adaptive security, presented
in detail in a companion publication [
Expecting users to reason about and act upon security issues of such complexity is highly unrealistic and contrary to the vision of the disappearing computer. Thus, we develop an autonomic system for context-adaptive information security and privacy protection founded on the previously presented containment-based model of the world. The main goal of the system is to provide maximum information availability for information custodian while protecting its security and privacy according to the perceived threat level implied in current context at any point in time. 3.2
An information exposure threat has two main characteristics: type and degree. The former determines the nature of a threat while the latter denotes the actual risk or the likelihood of the particular threat materializing in the given context. The notion of information exposure, as we de ne it, assumes information access. For illustrative purposes only we can typify information exposure threats according to the nature of information access implied as: physical, visual, audio and network access. Thus, for example, we could say that an information exposure threat described in natural language as mobile device outside secure perimeter implies a risk of physical access to information stored on the device due to increased likelihood of device abduction.
Unlike the usual binary, nothing or all, decision model of authorization policies we strive to provide maximum information availability while adequately protecting its security and privacy. The perceived or estimated degree of an information exposure threat plays an important role in this process. While the mere presence or absence of a threat would force a binary protective action employment such as e.g. information destruction i.e. deletion in the presence of a threat, the degree allows for a choice of matching actions which balance information availability with its exposure. For example, considering the following three contexts: inside a secure perimeter, outside a secure perimeter and outside secure perimeter and owner away; we could establish the respective degrees of physical access to information stored on a mobile device as: low, medium and high. This enables us to perform, for example, the following protective actions: none i.e. retain the information in its current form, encrypt the information and erase the information, respectively. Similar considerations would apply for a piece of sensitive information displayed on a public screen exposed to threats described as: inside a secure perimeter and a third-person present or outside a secure perimeter. To mitigate these threats the GUI window hosting the information representation could be shrunk or migrated to an available mobile phone's display lowering the observability of the information.
Levels of Exposure (LoEs) are introduced to quantify the degree or likelihood of information exposure due to a speci c threat or collection of threats present in an context and are used to discriminate between appropriate protective actions to be applied as hinted at above. As information of different sensitivity classes is expected to have different handling policies in the face of information exposure threats we specify LoE models on per information sensitivity class basis. The granularity of a LoE model for a sensitivity class depends directly on context capturing capabilities of the policy enforcement device and on the range of available protective actions. Individual LoE models can take the form anywhere from independent points in the threat-action space to structures like hierarchies or lattices. 3.3
Information exposure threats are, as outlined previously, implicit in the context. We classify containers according to their primary functionality, e.g. a display, a keyboard or a storage device, but choose classes to be represented based on their distinctive transparency characteristics. Transparency of each of the container class' boundary is de ned in terms of threat types, e.g. physical, visual, audio or network access, and its impact on the threat degree.
For example, consider a piece of information classied as SECRET within containment speci ed using a path expression as /pda/hard drive/encrypted le and a threat described as outside secure perimeter characterized with types physical, visual and audio access and a degree of 8 out of 10. The LoE establishment for the relevant data object would proceed as follows: container class hard drive is opaque for threats of visual and audio access but it is fully transparent for threats of the type physical access, therefore only the physical access threat of degree 8 is propagated further down the containment tree; container class encrypted le is partially transparent for the threat and impacts its degree by 40%, the reasoning being that it is much easier to access information stored as plain-text than in an encrypted fashion, provided that the encryption key is secure; the resulting threat that the data object is exposed to is of type physical access with the degree of 4.8; considering that the information is classi ed as SECRET the degree may imply the LoE de ned as HIGH which requires information destruction, in other words, the information is not allowed to leave the secure perimeter. For another data object classied at CONFIDENTIAL the same threat type and degree might have implied a LoE of LOW thereby denoting that information of that classi cation level may leave the secure perimeter stored on the hard drive if encrypted. Although simplistic, the example illustrates the containment based reasoning about context implied information security and privacy threats. 3.4
From the point of view of information security and
privacy protection the goal of the system is to
maintain the lowest LoE for all data objects in all contexts
what we call the state of homeostasis. This is
accomplished by two sets of protective actions: containment
manipulation and information reduction. Containment
modi cation actions are aimed at blocking threats
before they reach data objects in question by exploiting
container transparency characteristics. Containment
modi cation actions consist of: a new container
insertion somewhere on the threat's propagation path,
e.g. le encryption, SSL tunneling; state alteration
of an container already on the path, e.g. GUI
window shrinking or a data object migration to a different
containment. Information reduction [
Ubiquitous device's context sensing capabilities,
including user pro ling i.e. context information
solicitation, and containment-model granularity
supported by the platform determines the granularity
of the protective actions that may be applied
ranging from: the binary, all or nothing, decision model
to ne-grained container manipulation and
information reduction techniques. Our system for autonomic
context-adaptive security [
Scalability. The main factor considering model scalability is the possible size of the container classi cation hierarchy. Individual container classes to be represented are chosen based on their distinguishing transparency characteristics for model application-relevant set of contextual effects. Thus, comparing to the envisaged software and hardware heterogeneity in the ubiquitous world, we expect the size of the classi cation to remain manageable. For example, considering the presented model application, we can divide all available storage devices into: xed and removable, denoting the level of available control over stored data at all times; and tamper-resistant and otherwise, denoting the ease of physical access to the stored information.
The size of the model at every individual authority will, in-line with the container classi cation granularity, depend on container classes supported by the authority as determined by its hardware and software con guration. Representation of the model at an authority may range, application-speci cally, from implicit, in cases where model is used only in an abstract way, e.g. to form policies, and there is no actual data structure representing the model, to explicit, in cases where containment con guration is needed run-time for reasoning about contextual effects or otherwise. Formal methods may be used to approximate individual containers into larger ones, maintaining model correctness while reducing its overall size.
Complexity. Complexities involved in model maintenance and use are highly application speci c. Although the model maintenance overheads depend on the chosen representation, judging by its structure and the nature of update operations, we expect them to be close to trivial. Model use involved complexities may vary from, again, trivial where the model is used just for querying environment con guration at a point in time to substantially more signi cant in cases where explicit contextual effect reasoning process is performed on the model. 4.2
In this work we have presented a model that provides a uni ed representation of space, joining physical and virtual realms, based on the notions of a container and containment. We leverage inherent characteristics of a container, and its class, to model contextual effects propagation across its boundary. Together, these two pieces of work facilitate reasoning about and provide a means of localized reaction to the quality and quantity of contextual effects as experienced by a target entity in a dynamically recongurable environment. The model allows for independent and distributed maintenance at granularities matching available resources and capabilities of devices it is deployed on. This provides for minimum level of service guarantees to the model applications - making it particularly attractive for ubiquitous computing environments. To demonstrate its effectiveness we have brie y presented the use of model in a system for autonomic, context-adaptive, and ne-grained information security protection.