Semantically Enriching Access Control Rules for Web Services

1
Semantically Enriching Access Control Rules for
Web Services

• Brian Shields
• PhD Candidate,
• Department of Information Technology,
• National University of Ireland, Galway

2
Overview

• Using Semantic Web rules to enforce access
  control in a Web Services security framework
• Semantic Web Rule Language (SWRL)
• OWL-DL fact base
• Existing reasoning engine used
• W3C and OASIS standards and recommendations
• XML Signature
• XML Encryption
• XML Key Management Specification (XKMS)
• WS-Security
• Evaluated using Health Informatics industry
• Health Level 7

3
Description of Purpose

• Growth
• Information available over the Web
• Ways to access it
• Popularity of Web Services
• Concern for security, particularly authorisation
• Current access control models
• Access control lists (ACLs)
• Role Based Access Control
• Access definition
• Rules?
• Benefits of Semantic Web rules
• Added support for complex relationships between
  properties
• uncle(?x, ?y)

4
Goal Statement

• Build a Web Service security framework
• Web Service access control rules written in SWRL
• Encorporate SWRL rules and a SWRL and OWL
  reasoner into a Web Service security framework
• Build a OWL-DL ontology of the Health Level 7
  Reference Information Model (HL7 RIM)
• Will it work for the health informatics industry?
• Addresses the issue of data protection
• Particularly within the Web Service space
• Novel approach to access control
• A solution to authorisation within the health
  industry

5
Methodology

• Research part of the iWise project
• Statistical Processes Monitoring, event
  emulation, legacy system integration
• Security framework
• Message Security
• Access control
• Technologies
• XML Signature
• XML Encryption
• XML Key Management Specification (XKMS)
• WS-Security
• Web Ontology Language (OWL)
• Semantic Web Rule Language (SWRL)

6
iWISE Security Architecture

• SOAP Message Interceptor
• Apache Axis Filters
• Authentication
• Signature Validation
• Encryption/Decryption engine
• Apache WSS4J
• Key Management
• Access Control at two levels
• Initial access control to verify requested
  endpoints and schema validation
• Fine grained, semantically aware access control
  model
• Management Console

7
iWISE Security Architecture
8
iWISE Access Control

• Level One
• Verify that Web Service exists
• Validate all documents against schemas
• Level Two
• Request made to the Policy Decision Point for
  authorisation
• Three types of response
• Authorisation failed
• Authorisation limited
• Authorisation granted
• Policy Decision Point response result of Semantic
  reasoning of ontology and rules
• doctor(?x1) ? patient(?x2) ? isTreatingPhysican(?x
  1,x2) ? hasReadRecordAccess(?x1,?x2)

9
SWRL Rule
ltrulemlimpgt ltruleml_rlab rulemlhrefrea
dRecordAccess/gt ltruleml_bodygt
ltswrlxclassAtomgt ltowlxClass
owlxnameDoctor/gt ltrulemlvargtx1lt/rulemlvar
gt lt/swrlxclassAtomgt ltswrlxclassAtomgt
ltowlxClass owlxnamePatient/gt
ltrulemlvargtx2lt/rulemlvargt lt/swrlxclassAtomgt
ltswrlxindividualPropertyAtom
swrlxpropertyisTreatingPhysicangt
ltrulemlvargtx1lt/rulemlvargt ltrulemlvargtx2lt/rul
emlvargt lt/swrlxindividualPropertyAtomgt
lt/ruleml_bodygt ltruleml_headgt
ltswrlxindividualPropertyAtom swrlxproperty
hasReadRecordAccessgt ltrulemlvargtx1lt/rulemlv
argt ltrulemlvargtx2lt/rulemlvargt
lt/swrlxindividualPropertyAtomgt
lt/ruleml_headgt ltrulemlimpgt
10
Rule Reasoning

• Numerous options available
• Jena
• Pellet
• Racer
• Involve restricting expressiveness of SWRL
• Hoolet has been extended to handle SWRL rules
• WonderWeb for parsing and processing OWL
• Vampire used for reasoning, first order prover

11
Restricted Document Access

• Fine grained access control
• An an XML element level
• Organisational level
• Many people with access to same document
• Should all people have the same authorisation?
• Propose limited access
• Documents must be defined semantically at an
  element level
• All users are defined semantically
• iWISE access control rules define who can access
  what
• Semantic Reasoner will enforce these rules

12
Case Study Health Sector

• Security and access control critical.
• Access control usually achieved by defining
  static rule sets.
• Poor adoption of standards.
• Health Level 7 HL7
• Standard for information representation in health

13
Case Study Health Sector

• Member of hospital staff requests patient files.
• Staff member is first authenticated, then access
  rights are determined
• Doctor on case gets full access
• Admin staff get personal/billing information
• Consulting doctor gets clinical data but not
  personal data

14
Conclusions

• Completed
• Soap message interceptor
• Basic authentication
• Encryption/Decryption engine
• Basic key management
• Access control level one
• To do
• Management Framework
• Advanced key management (XKMS)
• Semantic access control