Dynamic Access Control Framework for Enterprise Content

Management Systems

Nadia Hocine and Ismail Bokhari

University of Abdelhamid Ibn Badis of Mostaganem, Mostaganem, Algeria

Keywords:

Access Control, Enterprise Content Management System.

Abstract:

With the large adoption of telework business model, employees can work anytime, anywhere and sometimes

with their own personal devices due to the limited financial capabilities of their companies. Many issues of

access control needs to be dynamically managed to reduce human intervention. In this paper, we suggest an

agent-based access control framework that focuses on M5StickC external device used as an access badge. The

framework is based on a multi-level rule engine to dynamically generate policies according to users’ context,

profile and device. It is implemented and proposed as an open-source solution for small companies to manage

their own ECM access control.

1 INTRODUCTION

Telework becomes a popular alternative to work that

consists in relocating work to reduce costs while in-

creasing the well-being and the safety of employees.

It may also be an alternative solution for employees

account not only the context and user various devices

but also their profile in terms of work and health con-

ditions in order to enhance the usability of the access

control applications.

Diffrent dynamic access control strategies have

been proposed in the literature to deal with dynamic

nature of user environments and contexts (Freuden-

thal et al., 2002) (Calo et al., 2018) (Oluwatimi et al.,

2018). However, most access control models do not

take into account the variability of users devices in

and users’ profile.

Providing users with an intelligent system can im-

prove not only the management of contextual data for

access control in a lightweight decentralized infras-

tructure (Uddin, 2019), but also allows more person-

alized access control that deals with usability issues.

Indeed, with their capability to think and make deci-

sion, software agents can control the dynamic context

information and can help in making decision on re-

sources access authorization. Agents use a rule-based

system to set resources permissions. In fact, an ac-

formance with a large number of rules, known as the

redundancy issue (B

this issue, our proposed framework considers a multi-

level rule engine that selects only a set of rules to gen-

erate dynamically an access control policy on the ba-

sis of resources’ sensibility.

tion 2 discusses related works on dynamic access con-

Hocine, N. and Bokhari, I.

Dynamic Access Control Framework for Enterprise Content Management Systems.

trol techniques. In section 3, we introduce our pro-

posed agent-based control framework. We describe

in this section the architecture of the proposed frame-

work as well as the policy specification and genera-

tion. Section 4 presents the implementation details

and the test of the proposed framework. Finally, Sec-

tion 5 concludes the paper and outlines our future

works.

2 RELATED WORKS

Access control is the verification of whether user ac-

Role-based access control approach has been ini-

tially adopted in various institutions and companies

due to its simplicity in large-scale authorization man-

agement (Ferraiolo et al., 2016). This approach uses a

model that considers three concepts: users, roles and

permissions. Roles are users’ job functions within

the organizations and permissions are the approvals

to perform certain operations on resources. The ac-

cess permissions are assigned to roles in order to man-

age easily permissions (Liu et al., 2017). However,

ferent works extended the role-based approach by

considering temporal and spatial information (Joshi

et al., 2005) (Damiani et al., 2007) as well as the

resource and environment dimensions (Hosseinzadeh

et al., 2016) (Trnka and Cerny, 2016). They fo-

cused on the dynamic user-role and role-permission

assignments through contextual constraints, called

dynamic attributes (Zheng et al., 2011). For exam-

ple, Kulkarni and Tripathi proposed a programming

framework that extended the role-based access con-

trol model by considering user and resource condi-

tions in role-permission assignments (Kulkarni and

Tripathi, 2008). In Trnka and Cerny’ work, user roles

and context information such as the IP addresses and

times of the day were used to determine resources au-

thorization (Trnka and Cerny, 2016). In addition to

situations. For instance, Kayes et al. proposed a

situation-aware access control framework based on an

ontology (Kayes et al., 2019). A policy model was

defined using conditional expression of users’ situa-

tions. In the previous reviewed works, the user-role

assignment policies related to dynamic context con-

straints require the continuous administrator interven-

tion. They also depend on context data regardless

users’ profiles and their devices capabilities and vari-

to resources (Squicciarini et al., 2009) (Calo et al.,

2018). For instance, Verma et al. suggested a frame-

work in which the manager uses an interaction graph

to define the roles that devices may play in the sys-

tem (Verma et al., 2017). Other works considered

the networked environment model in order to give

the possibility of each device to obtain security con-

straints of other devices of its environment (Squiccia-

rini et al., 2009). However, this approach requires the

deployment of an environment model specification

requests. Existing dynamic access control models can

difficult to execute in distributed systems that have a

large number of users and/or ressources. The central-

ized management of access control in distributed sys-

tems may cause access delay or unauthorized access

because of the server overload. Moreover, due to its

centralized nature, it can become easily the target of

network malicious attacks.

To deal with the previous issues, a distributed

management of access control can be used. It consists

in allowing each node of the network to control the

dynamic mapping between users and permissions to

improve the access control management performance.

It can be also used to personalize the access control

to users with various devices, profiles and situations

without requiring continuous administrator interven-

tion. In this paper, we propose an agent-based ac-

cess control framework for Entreprise Content Man-

agement systems (ECM). Agent-based systems can

play an important role in building distributed intelli-

gent access control management frameworks that take

into account various user device, context and profiles.

a distributed access control management that focuses

on an agent-based architecture. We also provide users

with an external ”access badge” to initiate and obtain

their access permissions. The objective is to deal with

the variability of user devices and their limited capa-

bilities in terms of energy and sensors disposition. In

order to limit vulnerabilities in the case of mobility,

the access request is limited to Bluetooth connexion

with small amplitude parameters and within limited

well as the dynamic policy generation for ECM.

work is dedicated to small companies that need the

personalization of access control by taking into ac-

count users’ context and conditions while limiting ad-

ministrator intervention. As shown in Figure 1, the

user is provided with a M5STICK device used to ob-

tain access authorization from user device (such as

laptop and phone). M5STICK device includes various

features and sensors such as Bluetooth 4.0, Wifi, Ac-

celerometer, etc. Using his or her M5STICK badge,

Bluetooth connection to his or her telework device.

• User Agent. It is responsible on communicating

with the authorization server to acquire the ac-

cess policy. It also provides the latter with context

information from sensors. In fact, to obtain per-

missions on his or her laptop or smartphone, the

user has to obtain access authorization through a

own User Agent.

specification has been largely used due to its extensi-

markup language or XACML was proposed initially

for role-based approach and has then been extended

and used in various works (Ferraiolo et al., 2016).

Using XACML to encode the policy consists in the

definition of expressions that return values that reflect

the kind of authorization or deny of access.

the decision on resources permission. Using Markup

Scheme such as XML also allows the communication

between agents and data transfer via a network.

Figure 3: Policy specification.

The Agent Policy Generator uses the rule-based sys-

tem to generate a policy by mapping user-agents to

permissions. However, a rule-based system may re-

quire high level computing performance due to the

large number of rules, known as the redundancy is-

sue. We propose therefore a personalized access con-

rules that consider the context information, such as

working time and location.

According to resources sensibility, three rules lev-

els were considered in our framework. The first level,

consists of role-based rules that represent the con-

straints that use agent-role mapping without consider-

is based on user profile data such as availability and

characteristics mapping with resources classification.

The Policy Generator Agent generates an XML file

with the appropriate policy that uses the general spec-

ification shown in Figure 3.

4 IMPLEMENTATION

The project repository can be obtained from Github,

with this link: https://github.com/AuthorisationTool

We have performed an initial test of the framework

using M5StickC device and two laptops. The devices

used were Intel I7-7500U, 8 GB DDR4 RAM, SSD

240 GB. M5StickC device is an internet of things

development card based on ESP32 micro-controller

cludes the identifier of the badge and the identifier of

the process HID (Holder ID) used to identify the user.

Using a Bluetooth 4.0 connection, the user can obtain

access from his or her telework device. The server of

the badge was based on GATT protocol and Google

Chrome as navigator. Figure 4 shows the badge used

in our first test.

Figure 4: M5StickC device.

To generate policies, rules were implemented

through a simple rule engine that we developed. An

example of generated policy is shown in Figure 5. The

profile constraint that we have considered in our first

test was: ”Health” which is a list of abstract health

conditions of the user such as ”Healthy” and ”Dis-

ability”. The latter determines personalized time and

spatial conditions to be considered for specific user’s

straints have been included in the test : (i) ”User

recorded when the user asks access permission (iii)

category, sensitivity levels and owners for role cre-

ation. The ressources configuration follows the possi-

ble considerations of Alfresco ECM. Once the role

is created, the administrator can add levels that in-

clude context and/or profile constraints. The adminis-

trator can also add his or her personalized constraints

or uses the default possible constraints.

The results of the first test with two experts

showed the simplicity of the interface and efficiency

of the access badge to get rapid and easy access to the

In this paper, we presented an agent-based access

control framework architecture for enterprise con-

tent management systems. An open source tool is

proposed following this architecture to help small

companies in controlling access to ECM ressources

while limiting administrator’s intervention. The tool

is based on a rule engine that generates dynamically

an access control policy on the basis of users’ condi-

tions and context information obtained with the help

of an M5StickC access badge. Furthermore, we pro-

posed an authoring tool that allows administrators to

introduce general constraints without having strong

knowledge about the rule and policy specification.

The results of the initial test of the tool with two ex-

with a large number of employees and administra-

tors through different case studies. The objective is

to evaluate the efficiency of the tool to improve both

authoring tool and policy generation. Finally, we plan

to test the usability of the system with employees with

particular health conditions (such as post-stroke pa-

tients) by considering various profile-based rules that

include personalized spatial and temporal constraints.

Workshop on Rules and Rule Markup Languages for

the Semantic Web, pages 3–28. Springer.

Calo, S., Verma, D., Chakraborty, S., Bertino, E., Lupu, E.,

and Cirincione, G. (2018). Self-generation of access

control policies. In Proceedings of the 23nd ACM on

Symposium on Access Control Models and Technolo-

gies, pages 39–47.

Corradi, A., Montanari, R., and Tibaldi, D. (2004). Context-

based access control for ubiquitous service provision-

ing. In Proceedings of the 28th International Com-

(2016). Extensible access control markup language

(xacml) and next generation access control (ngac).

In International Workshop on Attribute Based Access

Control, pages 13–24.

Freudenthal, E., Pesin, T., Port, L., Keenan, E., and Karam-

cheti, V. (2002). drbac: distributed role-based ac-

cess control for dynamic coalition environments. In

Proceedings 22nd International Conference on Dis-

tributed Computing Systems, pages 411–420. IEEE.

Hosseinzadeh, S., Virtanen, S., D

generalized temporal role-based access control model.

IEEE transactions on knowledge and data engineer-

ing, 17(1):4–23.

Katuu, S. (2018). A comparative assessment of enter-

prise content management maturity models. In E-

manufacturing and e-service strategies in contempo-

rary organizations, pages 93–118. IGI Global.

Kayes, A., Han, J., Rahayu, W., Dillon, T., Islam, M. S.,

and Colman, A. (2019). A policy model and frame-

work for context-aware access control to information

113–122.

Liu, Q., Zhang, H., Wan, J., and Chen, X. (2017). An access

Nyakomitta, P. S. and Abeka, S. O. (2020). Security inves-

Oluwatimi, O., Damiani, M. L., and Bertino, E. (2018). A

Squicciarini, A. C., Shehab, M., and Paci, F. (2009). Col-

Trnka, M. and Cerny, T. (2016). On security level usage in

Uddin, I. (2019). A rule-based framework for developing

Wong, K. and Hunter, A. (2017). Bluetooth for decoy sys-

Zheng, J., Zhang, Q., Zheng, S., and Tan, Y. (2011). Dy-