Computer and Information Technology, International Conference on (2010)
Bradford, West Yorkshire, UK
June 29, 2010 to July 1, 2010
DOI Bookmark: http://doi.ieeecomputersociety.org/10.1109/CIT.2010.199
In this paper we describe extensions to the access control industry standards XACML and SAML to enable privacy-preserving and credential-based access control. Rather than assuming that an enforcement point knows all the requester’s attributes, our extensions allow the requester to learn which attributes have to be revealed and which conditions must be satisfied, thereby enabling to leverage the advantages of privacy-preserving technologies such as anonymous credentials. Moreover, our extensions follow a credential-based approach, i.e., attributes are regarded as being bundled together in credentials, and the policy can refer to attributes within specific credentials. In addition to defining language extensions, we also show how the XACML architecture and model of evaluating policies can be adapted to the credential-based setting, and we discuss the problems that such extensions entail.
Access control, privacy, anonymous credentials, XACML, SAML
Claudio A. Ardagna, Mario Verdicchio, Franz-Stefan Preiss, Gregory Neven, Sabrina De Capitani di Vimercati, Pierangela Samarati, Stefano Paraboschi, "Enabling Privacy-preserving Credential-based Access Control with XACML and SAML", Computer and Information Technology, International Conference on, vol. 00, no. , pp. 1090-1095, 2010, doi:10.1109/CIT.2010.199