This Article 
   
 Share 
   
 Bibliographic References 
   
 Add to: 
 
Digg
Furl
Spurl
Blink
Simpy
Google
Del.icio.us
Y!MyWeb
 
 Search 
   
Secure Collaboration in a Mediator-Free Distributed Environment
October 2008 (vol. 19 no. 10)
pp. 1338-1351
The internet and related technologies have made multidomain collaborations a reality. Collaboration enables domains to effectively share resources; however it introduces several security and privacy challenges. Managing security in the absence of a central mediator is even more challenging. In this paper, we propose a distributed secure interoperability framework for mediator-free collaboration environments. We introduce the idea of secure access paths which enables domains to make localized access control decisions without having global view of the collaboration. We also present a path authentication technique for proving path authenticity. Furthermore, we present an on-demand path discovery algorithms that enable domains to securely discover paths in the collaboration environment. We implemented a simulation of our proposed framework and ran experiments to investigate the effect of several design parameters on our proposed access path discovery algorithm.

[1] M. Abadi, M. Burrows, B. Lampson, and G. Plotkin, “A Calculus for Access Control in Distributed Systems,” ACM Trans. Programming Languages and Systems, vol. 15, no. 4, pp. 706-734, Sept. 1993.
[1] M. Abadi, M. Burrows, B. Lampson, and G. Plotkin, “A Calculus for Access Control in Distributed Systems,” ACM Trans. Programming Languages and Systems, vol. 15, no. 4, pp. 706-734, Sept. 1993.
[2] M. Abadi and C. Fournet, “Access Control Based on Execution History,” Proc. 10th Ann. Network and Distributed System Symp. (NDSS), 2003.
[2] M. Abadi and C. Fournet, “Access Control Based on Execution History,” Proc. 10th Ann. Network and Distributed System Symp. (NDSS), 2003.
[3] H. Afsarmanesh, C. Garita, and L. Hertzberger, “Virtual Enterprises and Federated Information Sharing,” Proc. Ninth Int'l Conf. Database and Expert Systems Applications (DEXA '98), pp. 374-383, Aug. 1998.
[3] H. Afsarmanesh, C. Garita, and L. Hertzberger, “Virtual Enterprises and Federated Information Sharing,” Proc. Ninth Int'l Conf. Database and Expert Systems Applications (DEXA '98), pp. 374-383, Aug. 1998.
[4] E. Barka and R. Sandhu, “A Role-Based Delegation Model and Some Extensions,” Proc. 16th Ann. Computer Security Application Conf., pp. 11-15, Dec. 2000.
[4] E. Barka and R. Sandhu, “A Role-Based Delegation Model and Some Extensions,” Proc. 16th Ann. Computer Security Application Conf., pp. 11-15, Dec. 2000.
[5] D. Bell and L. LaPadula, “Secure Computer Systems: Mathematical Foundations,” Technical Report MTR-2547, vol. 1, Mar. 1973.
[5] D. Bell and L. LaPadula, “Secure Computer Systems: Mathematical Foundations,” Technical Report MTR-2547, vol. 1, Mar. 1973.
[6] E. Bertino, E. Ferrari, and V. Atluri, “The Specification and Enforcement of Authorization Constraints in Workflow Management Systems,” ACM Trans. Information and Systems Security, vol. 2, no. 1, pp. 65-104, Feb. 1999.
[6] E. Bertino, E. Ferrari, and V. Atluri, “The Specification and Enforcement of Authorization Constraints in Workflow Management Systems,” ACM Trans. Information and Systems Security, vol. 2, no. 1, pp. 65-104, Feb. 1999.
[7] E. Bertino, P. Samarati, and S. Jajodia, “Authorizations in Relational Database Management Systems,” Proc. First ACM Conf. Computer and Comm. Security (CCS '93), pp. 130-139, 1993.
[7] E. Bertino, P. Samarati, and S. Jajodia, “Authorizations in Relational Database Management Systems,” Proc. First ACM Conf. Computer and Comm. Security (CCS '93), pp. 130-139, 1993.
[8] E. Bertino and R. Sandhu, “Database Security-Concepts, Approaches, and Challenges,” IEEE Trans. Dependable Secure Computing, vol. 2, no. 1, pp. 2-19, 2005.
[8] E. Bertino and R. Sandhu, “Database Security-Concepts, Approaches, and Challenges,” IEEE Trans. Dependable Secure Computing, vol. 2, no. 1, pp. 2-19, 2005.
[9] P. Bonatti, M. Sapino, and V. Subrahmanian, “Merging Heterogenous Security Orderings,” J. Computer Security, vol. 5, no. 1, pp. 3-29, 1997.
[9] P. Bonatti, M. Sapino, and V. Subrahmanian, “Merging Heterogenous Security Orderings,” J. Computer Security, vol. 5, no. 1, pp. 3-29, 1997.
[10] P. Bonatti, S.D.C. Vimercati, and P. Samarati, “An Algebra for Composing Access Control Policies,” ACM Trans. Information and System Security, vol. 5, no. 1, Feb. 2002.
[10] P. Bonatti, S.D.C. Vimercati, and P. Samarati, “An Algebra for Composing Access Control Policies,” ACM Trans. Information and System Security, vol. 5, no. 1, Feb. 2002.
[11] D. Brewer and M. Nash, “The Chinese Wall Security Policy,” Proc. IEEE Symp. Security and Privacy (SP '89), pp. 206-214, 1989.
[11] D. Brewer and M. Nash, “The Chinese Wall Security Policy,” Proc. IEEE Symp. Security and Privacy (SP '89), pp. 206-214, 1989.
[12] D. Clark and D. Wilson, “A Comparison of Commercial and Military Computer Security Policies,” Proc. IEEE Symp. Security and Privacy (SP '87), pp. 184-194, 1987.
[12] D. Clark and D. Wilson, “A Comparison of Commercial and Military Computer Security Policies,” Proc. IEEE Symp. Security and Privacy (SP '87), pp. 184-194, 1987.
[13] J. Crampton, “On Permissions, Inheritance and Role Hierarchies,” Proc. 10th ACM Conf. Computer and Comm. Security (CCS '03), pp. 85-92, Oct. 2003.
[13] J. Crampton, “On Permissions, Inheritance and Role Hierarchies,” Proc. 10th ACM Conf. Computer and Comm. Security (CCS '03), pp. 85-92, Oct. 2003.
[14] D. Ferraiolo, D. Kuhn, and R. Chandramouli, Role-Based Access Control. Artech House, Apr. 2003.
[14] D. Ferraiolo, D. Kuhn, and R. Chandramouli, Role-Based Access Control. Artech House, Apr. 2003.
[15] A. Dan, D. Davis, R. Kearney, R. King, A. Keller, D. Kuebler, H. Ludwig, M. Polan, M. Spreitzer, and A. Youssef, “Web Services on Demand: WSLA-Driven Automated Management,” IBM Systems J., special issue on utility computing, vol. 43, no. 1, pp. 136-158, Mar. 2004.
[15] A. Dan, D. Davis, R. Kearney, R. King, A. Keller, D. Kuebler, H. Ludwig, M. Polan, M. Spreitzer, and A. Youssef, “Web Services on Demand: WSLA-Driven Automated Management,” IBM Systems J., special issue on utility computing, vol. 43, no. 1, pp. 136-158, Mar. 2004.
[16] S. Dawson, S. Qian, and P. Samarati, “Providing Security and Interoperation of Heterogeneous Systems,” Distributed Parallel Databases, vol. 8, no. 1, pp. 119-145, 2000.
[16] S. Dawson, S. Qian, and P. Samarati, “Providing Security and Interoperation of Heterogeneous Systems,” Distributed Parallel Databases, vol. 8, no. 1, pp. 119-145, 2000.
[17] A. Desai and N. Awad, “Special Issue on Adaptive Complex Enterprises,” Comm. ACM, vol. 48, no. 5, May 2005.
[17] A. Desai and N. Awad, “Special Issue on Adaptive Complex Enterprises,” Comm. ACM, vol. 48, no. 5, May 2005.
[18] G. Edjlali, A. Acharya, and V. Chaudhary, “History-Based Access Control for Mobile Code,” Proc. First ACM Conf. Computer and Comm. Security (CCS '98), pp. 38-48, 1998.
[18] G. Edjlali, A. Acharya, and V. Chaudhary, “History-Based Access Control for Mobile Code,” Proc. First ACM Conf. Computer and Comm. Security (CCS '98), pp. 38-48, 1998.
[19] R. Fagin, “On an Authorization Mechanism,” ACM Trans. Database Systems, vol. 3, no. 3, pp. 310-319, 1978.
[19] R. Fagin, “On an Authorization Mechanism,” ACM Trans. Database Systems, vol. 3, no. 3, pp. 310-319, 1978.
[20] D. Ferraiolo, R. Sandhu, S. Gavrila, D. Kuhn, and R. Chandramouli, “Proposed NIST Standard for Role-Based Access Control,” ACM Trans. Information and Systems Security, vol. 4, no. 3, pp. 224-274, Aug. 2001.
[20] D. Ferraiolo, R. Sandhu, S. Gavrila, D. Kuhn, and R. Chandramouli, “Proposed NIST Standard for Role-Based Access Control,” ACM Trans. Information and Systems Security, vol. 4, no. 3, pp. 224-274, Aug. 2001.
[21] M. Gasser and E. Mcdermott, “An Architecture for Practical Delegation a Distributed System,” Proc. IEEE CS Symp. Research in Security and Privacy, pp. 7-9, May 1990.
[21] M. Gasser and E. Mcdermott, “An Architecture for Practical Delegation a Distributed System,” Proc. IEEE CS Symp. Research in Security and Privacy, pp. 7-9, May 1990.
[22] H. Gladney, “Access Control for Large Collections,” ACM Trans. Information Systems, vol. 15, no. 2, pp. 154-194, Apr. 1997.
[22] H. Gladney, “Access Control for Large Collections,” ACM Trans. Information Systems, vol. 15, no. 2, pp. 154-194, Apr. 1997.
[23] C. Goh and A. Baldwin, “Towards a More Complete Model of Role,” Proc. Third ACM Workshop Role-Based Access Control, Oct. 1998.
[23] C. Goh and A. Baldwin, “Towards a More Complete Model of Role,” Proc. Third ACM Workshop Role-Based Access Control, Oct. 1998.
[24] L. Gong and X. Qian, “The Complexity and Composability of Secure Interoperation,” Proc. IEEE Symp. Security and Privacy (SP '94), pp. 190-200, 1994.
[24] L. Gong and X. Qian, “The Complexity and Composability of Secure Interoperation,” Proc. IEEE Symp. Security and Privacy (SP '94), pp. 190-200, 1994.
[25] L. Gong and X. Qian, “Computational Issues in Secure Interoperation,” IEEE Trans. Software and Eng., vol. 22, no. 1, Jan. 1996.
[25] L. Gong and X. Qian, “Computational Issues in Secure Interoperation,” IEEE Trans. Software and Eng., vol. 22, no. 1, Jan. 1996.
[26] P. Griffiths and B. Wade, “An Authorization Mechanism for a Relational Database System,” ACM Trans. Database Systems, vol. 1, no. 3, pp. 242-255, 1976.
[26] P. Griffiths and B. Wade, “An Authorization Mechanism for a Relational Database System,” ACM Trans. Database Systems, vol. 1, no. 3, pp. 242-255, 1976.
[27] Y. Hu, A. Perrig, and D. Johnson, “Ariadne: A Secure On-Demand Routing Protocol for Adhoc Networks,” Proc. Eighth Ann. Int'l Conf. Mobile Computing and Networking (MobiCom '02), pp. 12-23, Sept. 2002.
[27] Y. Hu, A. Perrig, and D. Johnson, “Ariadne: A Secure On-Demand Routing Protocol for Adhoc Networks,” Proc. Eighth Ann. Int'l Conf. Mobile Computing and Networking (MobiCom '02), pp. 12-23, Sept. 2002.
[28] D. Johnson, D. Maltz, and J. Broch, “DSR: The Dynamic Source Routing Protocol for Multihop Wireless Adhoc Networks,” Ad Hoc Networking, pp. 139-172, 2001.
[28] D. Johnson, D. Maltz, and J. Broch, “DSR: The Dynamic Source Routing Protocol for Multihop Wireless Adhoc Networks,” Ad Hoc Networking, pp. 139-172, 2001.
[29] D. Jonscher and K. Dittrich, “An Approach for Building Secure Database Federations,” Proc. 20th Int'l Conf. Very Large Data Bases (VLDB '94), pp. 24-35, Sept. 1994.
[29] D. Jonscher and K. Dittrich, “An Approach for Building Secure Database Federations,” Proc. 20th Int'l Conf. Very Large Data Bases (VLDB '94), pp. 24-35, Sept. 1994.
[30] S. Keoh, E. Lupu, and M. Sloman, “PEACE: A Policy-Based Establishment of Ad-Hoc Communities,” Proc. 20th Ann. Computer Security Applications Conf. (ACSAC '04), pp. 386-395, Dec. 2004.
[30] S. Keoh, E. Lupu, and M. Sloman, “PEACE: A Policy-Based Establishment of Ad-Hoc Communities,” Proc. 20th Ann. Computer Security Applications Conf. (ACSAC '04), pp. 386-395, Dec. 2004.
[31] N. Li, Z. Bizri, and M. Tripunitara, “On Mutually Exclusive Roles and Separation of Duty,” Proc. ACM Conf. Computer and Comm. Security (CCS '04), Oct. 2004.
[31] N. Li, Z. Bizri, and M. Tripunitara, “On Mutually Exclusive Roles and Separation of Duty,” Proc. ACM Conf. Computer and Comm. Security (CCS '04), Oct. 2004.
[32] Psim-J Simulation Library, http://science.kennesaw.edu/jgarridopsimj.html , 2008.
[32] Psim-J Simulation Library, http://science.kennesaw.edu/jgarridopsimj.html , 2008.
[33] H. Ludwig, C. Bussler, M. Shan, and P. Grefen, “Cross-Organisational Workflow Management and Co-Ordination— WACC,” 99 Workshop Report, vol. 20, no. 1, 1999.
[33] H. Ludwig, C. Bussler, M. Shan, and P. Grefen, “Cross-Organisational Workflow Management and Co-Ordination— WACC,” 99 Workshop Report, vol. 20, no. 1, 1999.
[34] E. Lupu and M. Sloman, “Conflicts in Policy-Based Distributed Systems Management,” IEEE Trans. Software Eng., vol. 25, no. 6, pp. 852-869, Nov. 1999.
[34] E. Lupu and M. Sloman, “Conflicts in Policy-Based Distributed Systems Management,” IEEE Trans. Software Eng., vol. 25, no. 6, pp. 852-869, Nov. 1999.
[35] J. Madhavan, P. Bernstein, A. Doan, and A. Halevy, “Corpus-Based Schema Matching,” Proc. 21st Int'l Conf. Data Eng. (ICDE '05), Apr. 2005.
[35] J. Madhavan, P. Bernstein, A. Doan, and A. Halevy, “Corpus-Based Schema Matching,” Proc. 21st Int'l Conf. Data Eng. (ICDE '05), Apr. 2005.
[36] J. Madhavan and A. Halevy, “Composing Mappings among Data Sources,” Proc. 29th Int'l Conf. Very Large Databases (VLDB), 2003.
[36] J. Madhavan and A. Halevy, “Composing Mappings among Data Sources,” Proc. 29th Int'l Conf. Very Large Databases (VLDB), 2003.
[37] P. McDaniel and A. Prakash, “Methods and Limitations of Security Policy Reconciliation,” Proc. IEEE Symp. Security and Privacy, pp. 73-87, May 2002.
[37] P. McDaniel and A. Prakash, “Methods and Limitations of Security Policy Reconciliation,” Proc. IEEE Symp. Security and Privacy, pp. 73-87, May 2002.
[38] J. Mirkovic, S. Dietrich, D. Dittrich, and P. Reiher, Internet Denial of Service: Attack and Defense Mechanisms. Prentice Hall, 2005.
[38] J. Mirkovic, S. Dietrich, D. Dittrich, and P. Reiher, Internet Denial of Service: Attack and Defense Mechanisms. Prentice Hall, 2005.
[39] M. Morgenstern, T. Lunt, B. Thuraisingham, and D. Spooner, “Security Issues in Federated Database Systems: Panel Contributions,” Proc. Results of the IFIP WG 11.3 Workshop Database Security, pp. 131-148, 1992.
[39] M. Morgenstern, T. Lunt, B. Thuraisingham, and D. Spooner, “Security Issues in Federated Database Systems: Panel Contributions,” Proc. Results of the IFIP WG 11.3 Workshop Database Security, pp. 131-148, 1992.
[40] N. Nagaratnam and D. Lea, “Secure Delegation for Distributed Object Environments,” Proc. Usenix Conf. Object Oriented Technologies and Systems, Apr. 1998.
[40] N. Nagaratnam and D. Lea, “Secure Delegation for Distributed Object Environments,” Proc. Usenix Conf. Object Oriented Technologies and Systems, Apr. 1998.
[41] R. Ramnath and D. Landsbergen, “IT-Enabled Sense-and-Respond Strategies in Complex Public Organizations,” Comm. ACM, vol. 48, no. 5, pp. 58-64, May 2005.
[41] R. Ramnath and D. Landsbergen, “IT-Enabled Sense-and-Respond Strategies in Complex Public Organizations,” Comm. ACM, vol. 48, no. 5, pp. 58-64, May 2005.
[42] R. Sandhu, V. Bhamidipati, and Q. Munawer, “The ARBAC97 Model for Role-Based Administration of Roles,” ACM Trans. Information and System Security, vol. 2, no. 1, Feb. 1999.
[42] R. Sandhu, V. Bhamidipati, and Q. Munawer, “The ARBAC97 Model for Role-Based Administration of Roles,” ACM Trans. Information and System Security, vol. 2, no. 1, Feb. 1999.
[43] R. Sandhu, E. Coyne, H. Feinstein, and C. Youman, “Role-Based Access Control Models,” IEEE Computer, vol. 29, no. 2, pp. 38-47, Feb. 1996.
[43] R. Sandhu, E. Coyne, H. Feinstein, and C. Youman, “Role-Based Access Control Models,” IEEE Computer, vol. 29, no. 2, pp. 38-47, Feb. 1996.
[44] B. Schneier, Applied Cryptography, second ed.  John Wiley & Sons, 1996.
[44] B. Schneier, Applied Cryptography, second ed.  John Wiley & Sons, 1996.
[45] K. Seamons, M. Winslett, and T. Yu, “Limiting the Disclosure of Access Control Policies during Automated Trust Negotiation,” Proc. Symp. Network and Distributed System Security (NDSS '01), Feb. 2001.
[45] K. Seamons, M. Winslett, and T. Yu, “Limiting the Disclosure of Access Control Policies during Automated Trust Negotiation,” Proc. Symp. Network and Distributed System Security (NDSS '01), Feb. 2001.
[46] B. Shafiq, J. Joshi, E. Bertino, and A. Ghafoor, “Secure Interoperation in a Multidomain Environment Employing RBAC Policies,” IEEE Trans. Knowledge and Data Eng., vol. 17, no. 11, pp. 1557-1577, 2005.
[46] B. Shafiq, J. Joshi, E. Bertino, and A. Ghafoor, “Secure Interoperation in a Multidomain Environment Employing RBAC Policies,” IEEE Trans. Knowledge and Data Eng., vol. 17, no. 11, pp. 1557-1577, 2005.
[47] Use SLAs in a Web Services Context, Part 1: Guarantee Your Web Service with a SLA, http://www-128.ibm.com/developerworks/library ws-sla/, Oct. 2004.
[47] Use SLAs in a Web Services Context, Part 1: Guarantee Your Web Service with a SLA, http://www-128.ibm.com/developerworks/library ws-sla/, Oct. 2004.
[48] S. Vimercati and P. Samarati, “Authorization Specification and Enforcement in Federated Database Systems,” J. Computer Security, vol. 5, no. 2, pp. 155-188, 1997.
[48] S. Vimercati and P. Samarati, “Authorization Specification and Enforcement in Federated Database Systems,” J. Computer Security, vol. 5, no. 2, pp. 155-188, 1997.
[49] H. Wang and S. Osborn, “Delegation in the Role Graph Model,” Proc. 11th ACM Symp. Access Control Models and Technologies (SACMAT '06), pp. 91-100, 2006.
[49] H. Wang and S. Osborn, “Delegation in the Role Graph Model,” Proc. 11th ACM Symp. Access Control Models and Technologies (SACMAT '06), pp. 91-100, 2006.
[50] G. Wiederhold, M. Bilello, and C. Donahue, “Web Implementation of a Security Mediator for Medical Databases,” Proc. IFIP TC11 WG11.3 11th Int'l Conf. Database Security, pp. 60-72, 1998.
[50] G. Wiederhold, M. Bilello, and C. Donahue, “Web Implementation of a Security Mediator for Medical Databases,” Proc. IFIP TC11 WG11.3 11th Int'l Conf. Database Security, pp. 60-72, 1998.
[51] W. Winsborough and N. Li, “Protecting Sensitive Attributes in Automated Trust Negotiation,” Proc. ACM Workshop Privacy in the Electronic Soc., pp. 41-51, 2002.
[51] W. Winsborough and N. Li, “Protecting Sensitive Attributes in Automated Trust Negotiation,” Proc. ACM Workshop Privacy in the Electronic Soc., pp. 41-51, 2002.
[52] W. Winsborough and N. Li, “Towards Practical Automated Trust Negotiation,” Proc. Third Int'l Workshop Policies for Distributed Systems and Networks (POLICY '02), pp. 92-103, June 2002.
[52] W. Winsborough and N. Li, “Towards Practical Automated Trust Negotiation,” Proc. Third Int'l Workshop Policies for Distributed Systems and Networks (POLICY '02), pp. 92-103, June 2002.
[53] W. Winsborough and N. Li, “Safety in Automated Trust Negotiation,” Proc. IEEE Symp. Security and Privacy, pp. 147-160, May 2004.
[53] W. Winsborough and N. Li, “Safety in Automated Trust Negotiation,” Proc. IEEE Symp. Security and Privacy, pp. 147-160, May 2004.
[54] W. Winsborough, K. Seamons, and V. Jones, “Automated Trust Negotiation,” Proc. DARPA Information Survivability Conf. and Exposition, vol. 1, pp. 88-102, Jan. 2000.
[54] W. Winsborough, K. Seamons, and V. Jones, “Automated Trust Negotiation,” Proc. DARPA Information Survivability Conf. and Exposition, vol. 1, pp. 88-102, Jan. 2000.
[55] T. Yu, X. Ma, and M. Winslett, “PRUNES: An Efficient and Complete Strategy for Automated Trust Negotiation over the Internet,” Proc. Seventh ACM Conf. Computer and Comm. Security, pp. 210-219, 2000.
[55] T. Yu, X. Ma, and M. Winslett, “PRUNES: An Efficient and Complete Strategy for Automated Trust Negotiation over the Internet,” Proc. Seventh ACM Conf. Computer and Comm. Security, pp. 210-219, 2000.
[56] T. Yu and M. Winslett, “Unified Scheme for Resource Protection in Automated Trust Negotiation,” Proc. IEEE Symp. Security and Privacy, pp. 110-122, May 2003.
[56] T. Yu and M. Winslett, “Unified Scheme for Resource Protection in Automated Trust Negotiation,” Proc. IEEE Symp. Security and Privacy, pp. 110-122, May 2003.
[57] T. Yu, M. Winslett, and K. Seamons, “Interoperable Strategies in Automated Trust Negotiation,” Proc. Eighth ACM Conf. Computer and Comm. Security, pp. 146-155, Nov. 2001.
[57] T. Yu, M. Winslett, and K. Seamons, “Interoperable Strategies in Automated Trust Negotiation,” Proc. Eighth ACM Conf. Computer and Comm. Security, pp. 146-155, Nov. 2001.
[58] L. Zhang, G. Ahn, and B. Chu, “A Rule-Based Framework for Role-Based Delegation and Revocation,” ACM Trans. Information and System Security, vol. 6, no. 3, pp. 404-441, 2003.
[58] L. Zhang, G. Ahn, and B. Chu, “A Rule-Based Framework for Role-Based Delegation and Revocation,” ACM Trans. Information and System Security, vol. 6, no. 3, pp. 404-441, 2003.

Index Terms:
Access controls, Distributed systems
Citation:
Mohamed Shehab, Arif Ghafoor, Elisa Bertino, "Secure Collaboration in a Mediator-Free Distributed Environment," IEEE Transactions on Parallel and Distributed Systems, vol. 19, no. 10, pp. 1338-1351, Oct. 2008, doi:10.1109/TPDS.2008.26
Usage of this product signifies your acceptance of the Terms of Use.