A Context-Risk-Aware Access Control Model for Ubiquitous Environments

摘要

This paper reports our ongoing work to design a Context-Risk-Aware Access Control (CRAAC) model for Ubiquitous Computing (UbiComp) environments. CRAAC is designed to augment flexibility and generality over the current solutions. Risk assessment and authorisation level of assurance play a key role in CRAAC. Through risk assessment, resources are classified into groups according to their sensitivity levels and potential impacts should any unauthorised access occurs. The identified risks are mapped onto their required assurance levels, called Object Level of Assurance (OLoA). Upon receiving an object access request, the requester's run-time contextual information is assessed to establish a Requester's Level of Assurance (RLoA) denoting the level of confidence in identifying that requester. The access request is granted iif RLoA ≥ OLoA. This paper describes the motivation for, and the design of, the CRAAC model, and reports a case study to further illustrate the model.