![](bg5.png)
an access request was 20.47 ms, where the first re-
quest amounts to 25.02 ms and further requests can
get as fast as 10.87 ms
1
. This shows that even for
policies of reasonable size, the time required for de-
ciding access requests is satisfying and the DL-based
DRBAC model can be considered to be suited for use
in real-world applications.
5 CONCLUSIONS AND FUTURE
WORK
We have introduced the Apollon framework, an ex-
tensible policy framework which makes use of on-
tologies for representing and reasoning over security
policies. Apollon has been built to meet in particular
the challenges of pervasive systems, stated in the in-
troduction of this paper: by describing entities in DL
and in combination with easy-to-write syntaxes such
as Manchester DL or Turtle, policy specification is fa-
cilitated and the author’s actual intent, in terms of the
security model, becomes more visible. The DL rep-
resentation of the exemplary policy model described
in this paper allows us to separate the actual policy,
reflecting the security model, from domain knowl-
edge, reflecting assumptions about security mecha-
nisms and devices. Further, by example of a DRBAC
model, we have shown that DL reasoning can be used
to decide acces requests and verify security properties
like SoD. However, we acknowledge that DL alone is
not expressive enough for most policies and should
thus mainly be used for modeling domain knowledge
and reasoning over policies rather than performing the
actual policy decision process.
The modular software architecture allows to only
load the required policy modules, thereby reducing
the footprint of the policy framework to the actually
needed functionality. As part of our future work, we
will take into account context-specific access rights,
add features for security negotiations between peers
in order to support self-protecting systems and con-
tinue our research on policy analysis based on OWL
and reasoning.
REFERENCES
Baader, F., Horrocks, I., and Sattle, U. (2007). Handbook
of Knowledge Representation, chapter 3 Description
Logics, pages 135–180. Elsevier. ISBN 0444522115.
1
On Intel Core 2 Duo 2GHz, Ubuntu 10.04, Sun Java
1.6.0.22, leaving Pellet’s default optimization settings un-
touched.
Bacon, J., Moody, K., and Yao, W. (2002). A model of oa-
sis role-based access control and its support for active
security. ACM Trans. Inf. Syst. Secur., 5:492–540.
Becker, M. Y. and Sewell, P. (2004). Cassandra: Distributed
access control policies with tunable expressiveness. In
Proc. 5th IEEE Int’l Workshop on Policies for Dis-
tributed Systems and Networks (POLICY), pages 159–
168. IEEE Computer Society.
Ferraiolo, D. F., Sandhu, R., Gavrila, S., Kuhn, D. R., and
Chandramouli, R. (2001). Proposed NIST Standard
for Role-Based Access Control.
Ferrini, R. and Bertino, E. (2009). Supporting rbac with
xacml+owl. In Proceedings of the 14th ACM sym-
posium on Access control models and technologies
(SACMAT ’09), pages 145–154, New York, NY, USA.
ACM.
Finin, T., Joshi, A., Kagal, L., Niu, J., Sandhu, R., Winsbor-
ough, W. H., and Thuraisingham, B. (2008). ROWL-
BAC - Representing Role Based Access Control in
OWL. In Proceedings of the 13th Symposium on Ac-
cess control Models and Technologies. ACM Press.
Lalana Kagal (2006). The Rein Policy Framework for the
Semantic Web. http://dig.csail.mit.edu/2006/06/rein/.
Lee, A., Boyer, J. P., Olson, L. E., and Gunter, C. A. (2006).
Defeasible security policy composition for web ser-
vices. In Proceedings of the fourth ACM workshop on
Formal methods in security, FMSE ’06, pages 45–54,
New York, NY, USA. ACM.
OASIS (2005). Core and hierarchical role based access con-
trol (rbac) profile of xacml v2.0. OASIS.
Toninelli, A., Bradshaw, J. M., Kagal, L., and Montanari,
R. (2005). Rule-based and ontology-based policies:
Toward a hybrid approach to control agents in perva-
sive environments. In Proc. of the Semantic Web and
Policy Workshop.
Twidle, K., Dulay, N., Lupu, E., and Sloman, M. (2009).
Ponder2: A policy system for autonomous pervasive
environments. In The Fifth International Conference
on Autonomic and Autonomous Systems (ICAS), pages
330–335. IEEE Computer Society Press.
Uszok, A., Bradshaw, J. M., Jeffers, R., Suri, N., Hayes,
P. J., Breedy, M. R., Bunch, L., Johnson, M., Kulka-
rni, S., and Lott, J. (2003). Kaos policy and do-
main services: Toward a description-logic approach
to policy representation, deconfliction, and enforce-
ment. In Third International Workshop on Policies for
Distributed Systems and Networks (POLICY), pages
93–96.
APOLLON: TOWARDS A SEMANTICALLY EXTENSIBLE POLICY FRAMEWORK
395