Semantic Web is a vision for future of the current Web which aims at automation, integration and reuse of data among different Web applications. Access to resources on the Semantic Web can not be controlled in a safe way unless the access decision takes into account the semantic relationships among entities in the data model under this environment. Decision making for permitting or denying access requests by assuming entities in isolation and not considering their interrelations may result in security violations. In this paper, we present a Semantic Based Access Control model (SBAC) which considers this issue in the decision making process. To facilitate the propagation of policies in these three domains, we show how different semantic interrelations can be reduced to the subsumption problem. This reduction enhances the space and time complexity of the access control mechanisms which are based on SBAC. Our evaluations of the SBAC model along with experimental results on a sample implementation of the access control system show that the proposed model is very promising.
Semantic Web is an extension for the current Web which gives information a
well–defined meaning, making machines capable of interpreting and processing
the information. The shift from current Web to semantic aware environments
such as the Semantic Web poses new security requirements [
To overcome these challenges, there is a need for semantic aware access
control systems. In this paper, we present a Semantic Based Access Control model
(SBAC) that authenticates users based on the credentials they offer when
requesting an access right. Ontologies are used for modeling entities along with
their semantic interrelations in three domains of access control, namely subject
domain, object domain and action domain. Decision making in SBAC for
permitting or denying an access request is automated by inference engines. We show
how semantic interrelations can be used in the authorization process; and for
enhancing the expressiveness of authorization rules defined in SBAC, we show
how rule languages like SWRL [
The remainder of this paper is as follows: Section 2 describes the related works on this topic and section 3 states the fundamentals of SBAC. Semantic authorization flow of access rights in different levels of an ontology are described in section 4. In section 5, the formal definition of SBAC is presented and it is shown how the reasoning can be done in different domains of access control. Our proposed architecture for implementing the SBAC model is presented in section 6 and the experimental results and qualitative evaluations of the model are described in section 7. Finally, section 8 underlines some conclusions and future research lines. 2
Access control systems for protecting Web resources along with credential based
approaches for authenticating users have been studied in recent years [
Object-Oriented authorization models for databases were the first models
that tried to consider the semantic relationships for authorization. Such models
showed the effect of the semantic relationships like subclass/superclass in
access decision making [
Fundamentally, SBAC consists of three basic components: Ontology Base, Authorization Base and Operations. Ontology Base is a set of ontologies: Subject– Ontology (SO), Object–Ontology (OO) and Action–Ontology (AO). These ontologies are described in the following: OO : is an Object Ontology for describing objects. Objects are entities which are accessed and/or modified. An Object–Ontology shows the structure in which the objects (Concepts, Individuals and Properties) are organized along with the semantic relationships among them. Fig. 2 is an example OO. It shows a part of a Bank-Service ontology. The ovals show concepts and individuals and labels on the directed arcs show axioms and properties. Individuals are represented by ovals that have arcs with ‘Is A’ labels to other ovals. SO : is the Subject Ontology where subjects are active entities which require access to objects. Subjects are represented using concepts or individuals in a Subject-Ontology. Fig. 3.a shows a Subject-Ontology which is based on credentials. Presenting credentials determine users eligibility for accessing a resource. AO : Actions depend on the type of the actions that subjects aim to execute on objects. Each action type is a concept in the action ontology. Fig. 3.b demonstrates an example of Action Ontology.
By modeling the access control domains using ontologies, SBAC aims at considering semantic relationships in different levels of an ontology to perform inferences to make decision about an access request. Authorization Base is a set of authorization rules in form of (s, o, ±a) in which s is an entity in SO , o is an entity defined in OO, and a is an action defined in AO. In other words, a rule determines whether a subject which presents a credential s can have the access right a on object o or not. Predefined access rights can be saved in Authorization Base in the form of authorization rules and for making decisions for incoming requests (permit/deny), inference is done based on the semantic relationships between the requested authorization and the explicit authorization rules in Authorization Base. In fact, inferences on the explicit authorization rules result in some implicit authorization rules. For example, if an explicit authorization rule states that a subject can read an object of type “Account”, then if s/he requests an access right to read a subobject of type “ShortTermDeposit”, then the latter can be inferred from the former without having its authorization rule explicitly. Since SBAC works based on inference, for preventing propagation of same decision (permit/deny) on all the inferred rules, it allows the definition of exception rules with higher priority. For example, an exception rule can be defined if the authority of a bank wants to prohibit the credit cards issued from a specific bank from settling money to any account in Bankx while there is another explicit authorization rule that lets all credit cards settle money in any account. 4
Different semantic relations in an ontology result in semantic authorization flow
among entities in different levels of that ontology. OWL is the W3C
recommendation for representing ontologies in a machine–processable format. To automate
the inference process in SBAC, we used this language since its well–defined
structure lets machines automatically process the knowledge described in it; besides
it supports strong semantic relations among concepts. Based on OWL, we have
identified three levels: concept–level, individual–level and property–level where
the semantic authorization flow can occur in each level or between different
levels. To simplify the effect of semantic authorization flow in decision making, first
we classify the possible semantic inferences that can occur, and then we explain
different types of inferences in each category. This classification is done based on
the fundamental OWL structures [
– Concept-Concept (C-C): Inference can be done in the level of concepts (between two concepts) in an ontology. Concept constructors in OWL result in new concepts with an intrinsic semantic authorization flow. For example, when the concept ‘Credit Card’ is defined as the union of ‘Master Card’ and ‘VISA Card’, then access rights such as eligibility of the owner of a credit card for checking an account will be propagated to both the owner of a ‘Master Card’ and the owner of a ‘VISA Card’. – Concept-Individual (C-I): All the individuals are influenced by the access conditions enforced on the concept they belong to. – Individual-Individual (I-I): Individual axioms cause this kind of authorization flow. For example the ‘same as’ axiom states that two individuals are semantically equal, hence the access conditions on each of them should be applied on the other one too. – Property-Concept (P-C): The semantic authorization flow from properties to concepts happens when an access right on a property is granted. A property is interpreted by a set of ordered pairs of individuals where the first individual is in the domain of the property and the latter is in the range of it. Therefore, any access right on a property can result in the same access right on the domain and range of the property. For example, when a subject can modify a property, s/he should be able to access the domain and range of that property. – Property-Property (P-P): Semantic relations between various properties can result in new properties which are necessary to decision making but are not explicitly mentioned in the ontology. For example, when a bank authority wants to prevent master cards supported by Asian banks from settling money in a special account by defining (AsianM asterCards, Accountx, −settelement), by having knowledge on two properties ‘Issued in’ and ‘Registered in’, the new property of ‘Supported by’ can be made. The related SWRL rule is as follows:
Registered in(Bankx, Asia) ∧ Issued in(M asterCard, Bankx)
→ Supported by(M asterCard, AsianBank)
– Property-Individual (P-I): All the individuals are influenced by the
access conditions enforced on the property that they belong to. Moreover,
property characteristics like being transitive or symmetric imply
membership of some new individuals to the same property which are also affected by
the access conditions defined on the property. For example, if we define the
‘Support Of’ property as a symmetric property then by having the
knowledge that (Accountx, Accounty) is an individual of a property then it can
be inferred that (Accounty, Accountx) is also an individual of that property.
An SWRL rule like the following can be added for the inference:
Support of (Accountx, Accounty) → Supported of (Accounty, Accountx)
– Concept-Property (C-P): When an access right on a concept is granted,
then there would be semantic authorization flows from this concept to the
restricted concepts that are result of property restrictions on this concept. For
example, when a subject is eligible to ‘Check Balance’ of some credit cards
then s/he should be authorized to ‘Check Balance’ of any restricted concept
like Issued In.Bankx which returns credit cards issued in the Bankx.
It is worth noting that the ontology languages in the fourth layer of the
Semantic Web stack are not expressive enough to support all of the inference
classifications that should be performed in the machine level. Fig. 4 shows
the degree of coverage of OWL DL and SWRL. As can be seen in this figure,
using SWRL rules provide better expressivity.
Different kinds of semantic relations and inference problems based on them
motivated us to reduce the possible inferences on the semantic relationships in OWL
DL to the general problem of Subsumption. Checking the subsumption property
is the basic reasoning method of description logics [
A
B = ( A v B, if A and B are concepts
A Is A B, if A is an individual and B is a concept
A sameAs B, if A and B are individuals
When there is A B relation between A and B, the authorization rules enforced on B should also be enforced on A. Table 1 shows the reduction based on OWL class axioms. Table 2 is for individual axioms and Table 3 shows the reductions for OWL Property Restrictions. Table 4 shows SWRL rule definition for OWL Property Characteristics. 5
This section presents a formal definition of the topics described informally in
preceding sections. SBAC is defined by the triple (OB, AB, Oprs). OB stands
P1 equivalentProperty P2
for Ontology Base which contains decision making ontologies (OO, SO, AO). AB
stands for Authorization Base that includes explicit authorization rules. Oprs
are the operations that can be performed on the Authorization Base.
SBAC = (OB, AB, Oprs)
OB = {Ont | Ont = SO ∨ Ont = OO ∨ Ont = AO}
Ont = (C, T, ≤C , ≤T , R, A, σA, σR, ≤A, ≤R)
AB = {(s, o, ±a) | s ∈ SO ∧ o ∈ OO ∧ a ∈ AO}
Oprs = (CA, Grant, Revoke)
In the definition of ontology (Ont), which is from [
Access rights are stored in AB in the form of Authorization rules where:
AB ⊆ S × O × A
An authorization rule is a triple like (s, o, ±a) where s ∈ SO, o ∈ OO, and a ∈ AO.
The knowledge base consists of explicit authorization rules and is formally defined AB ⊆ S × O × A. An authorization rule is a triple (s, o, +a) where s ∈ SO, o ∈ OO, a ∈ AO.
The operations are executed on AB and are for making decision about a request, granting an access right or revoking an access right and the formal definition is Opr = (CA, Grant, Revoke).
– CA(s, o, a): the function of decision making is CA : S×O×A → {true, f alse}.
CA(s, o, a) = true, if (s, o, +a) ∈ AB or there is an authorization rule (si, oj , ak) ∈ AB such that (si, oj , +ak) → (s, o, +a). CA(s, o, a) = f alse, if (s, o, −a) ∈ AB or there is an authorization rule (si, oj , ak) ∈ AB such that (si, oj , −ak) → (s, o, −a). Otherwise, due to the close policy the function returns ‘False’. The reasoning ‘→’ from (s, o, a) to (si, oj , ak) can be performed on domains subject SO, object OO or action AO. Definition of function CA is as follows: T rue, (s, o, +a) ∈ AB ∨ (∃(si, oj , +ak) ∈ AB : CA(s, o, a) = (si, oj , +ak) → (s, o, +a))
F alse, otherwise Conflicts are possible in CA(s, o, a) in the time of decision making. Exception rules are one of the sources of conflicts. Since for making a decision about a request two conflicting inferences can lead to different results, conflict resolution is necessary in SBAC. Inference from exception rules should have higher priority than inference from other explicit rules. Hence for resolving the conflict, the inference from the most specific rule which is the most specific exception takes precedence than other inferences. This conflict resolution policy is possible since the conflicting sources of inference are on the same inference path and comparing the conflicting rules is possible. In the cases that the conflicting rules are not comparable or in other words they are not on the same inference path, a “negative take precedence” policy which gives the priority to the negative authorization rule is used for resolving the conflict. – Grant(s, o, a): Granting an authorization (s, o, a) means inserting the rule in AB . This operation is executed by the operation Grant(s, o, a) , which returns the Boolean value True if the rule is added and False if the rule can not be added to AB.
if (s, o, a) ∈ AB or CA(s, o, a) = true then return false else add (s,o,a) return True – Revoke(s, o, a): Revoking an authorization (s, o, a) means deleting it from AB. This operation is executed by the operation Revoke(s, o, a), which returns the Boolean value True if the rule is deleted and False if the rule can not be deleted from AB.
if (s, o, a) ∈ AB then delete (s, o, a) return True else return false 5.1
In this section, we explain how reducing the inference problem to the subsumption problem can result in an effective way for authorization propagation in three domains of access control. In the domains of subjects and objects, the authorizations are propagated from subsumee to subsumer; but the propagation of access rights in the domain of actions is different and the negative access rights will be propagated from subsumer to subsumee. It means that the subsumee can not have a positive right while the subsumer does not have it. But the positive access rights are propagated in the opposite direction. In other words, if the subsumee has a positive access right, the subsumer should also have it. The following is a formal description of the propagation mechanism: – Propagation in subject domain: Given (si, o, ±a), If sj si then the new authorization rule (sj , o, ±a) can be derived by inference from si to sj , we denote this rule as (si, o, ±a) → (sj , o, ±a). – Propagation in object domain:Given (s, oi, ±a), If oj oi then the new authorization rule (s, oj , ±a) can be derived by inference from oi to oj , we denote this rule as (s, oi, ±a) → (s, oj , ±a). – Propagation in action domain: • Given (s, o, +ai), If aj ai then the new authorization rule (s, o, +ai) can be derived by inference from ai to aj , we denote this rule as (s, o, +ai) → (s, o, +aj ). • Given (s, o, −aj ), If aj ai then the new authorization rule (s, o, −ai) can be derived by inference from aj to ai, we denote this rule as (s, o, −aj ) → (s, o, −ai). 6
External Components: External components are subjects, ontological definitions of credentials, objects, and actions, Reputation system, and administration tools. Subjects are the ones that request for access rights. ontological definitions of credentials, objects, and actions are as described in previous sections. The reputation system is used for checking the validity of credentials that are provided by subjects. Administration tools are used for managing the Authorization Base. For example, adding or revoking rules in this base are performed using these tools.
Authorization Components: Authorization components are as follows:
Reputation System
Authorization System
Semantic Authorizer Inference Engine
Subjects
Authorization Base Request
Permit / Deny Reduced Ontologies
Administration
Tools Credentials
Ontology Base
Ontology Parser Actions
Objects
The most obvious advantage of SBAC compared with other access control models
is its Semantic–awareness property. But, besides Semantic-awareness SBAC has
the following advantages:
– Interoperability: Interoperating across administrative boundaries is achieved
through exchanging authorizations for distributing and assembling
authorization rules. The ontological modeling of authorization rules in SBAC
results in a higher degree of interoperability compared with other approaches
to access control. This is because of the nature of ontologies in providing
semantic interoperability.
– Expressivity: The expressiveness of the security policies directly depends
on the expressiveness of the language using which the policies are described.
SBAC authorization rules are defined using OWL DL which is based on
an expressive description logic namely, SHOIN (D) [
On the other hand, as is shown in Fig. 6, for representing the expression C = C1 ∪ . . . ∪ Cn using RDF triples, 2n + 1 triples are required. While as is shown in Fig. 7 after reducing this expression using the subsumption relation, only n triples are required. This situation is valid for most of the other OWL constructors. In order to experimentally show this fact, we generated random ontologies and created a program called OntGenerator which receives three parameters, namely conceptCount, expCount, and expMaxSize, as input parameters and generates a random ontology based on the values of these parameters. conceptCount shows the number of atomic concepts and expCount shows the number of complex concepts in this ontology. expMaxSize shows the maximum number of concepts (whether atomic or complex) that are used for creating each complex concept.
Table 5 shows number of statements in standard and reduced ontologies for random ontologies generated for different values of conceptCount, expCount, expMaxSize. As can be seen in this table, the number of statements is reduced after applying the reduction algorithm on these ontologies. This shows that, SBAC needs to work with smaller ontologies and therefore it requires a lower space capacity.
unionOf
A0 first rest
A2 first rest rest
nil
B C D Fig. 6. Representing A = B ∪ C ∪ D using RDF triples
A1 first
A subClassOf subClassOf
subClassOf B – Low Response Time: most of the time complexity of decision making functions refers to the reasoning part. Since we have reduced reasoning problems to the subsumption problem and because of the existence of highly efficient subsumption reasoners, the response time of SBAC is very promising. For evaluating the reasoning time of SBAC, we designed an experiment. In our experiment, we used the PELLET reasoner which is a highly efficient OWL DL reasoner for reasoning on standard ontologies. On the other hand, since reduced ontologies only include subsumption relation between concepts, we designed and implemented a fast reasoning engine which can only handle the subsumption relation but in a better time period compared with reasoners such as PELLET. In fact, this point that SBAC can do its decision making using reasoning engines that only need to handle the subsumption relation is one of the biggest strengths of this model. Table 6 shows a comparison of reasoning time of the PELLET reasoner which must work with the standard ontology and the reasoning time of our reasoner which can work with the reduced ontology. As can be seen in this table, our reasoner can do the decision making process in a smaller time period. 8
In this paper, we presented SBAC as an access control model for protecting Semantic Web resources. SBAC takes into account semantic interrelations among entities in the domains of decision making of access control. Automated decision making in SBAC for permitting or denying an access request is done through inference processes based on the semantic relation among entities. We have shown that SBAC can provide space-efficient expression of rules with faster reasoning time than by using a standard ontology.
One of the useful features that is not addressed in SBAC is context-awareness. For example, currently a security administrator can not specify “(s,o,a) allowed only between 9am–5pm”. One of our future works is to extend SBAC to DSBAC (Dynamic SBAC) which uses context ontologies to capture the current context and use it for more expressive reasoning.
To enhance the expressiveness of the model for describing the authorization
rules, more expressive logics in logic layer of Semantic Web stack can be applied.
Since more expressive logics are less decidable, approaches like client based access
control approaches [