A credible and trustworthy information system (TIS) is one that provides a reliable, cost-effective, interoperable, and secured information system for a company. An effective information system is able to collect, store, and manage the data and it also makes sure that the information is only accessible to the authorized persons. To develop reliable TIS, one must factor in certain aspects of security at the initial stages of developing the system. For authorization and access control systems that decide which specific users can access stipulated parts of the system, the knowledge of security patterns is invaluable in early stages of development. There are two kinds of recognized access control frameworks: discretionary and role-based access control models. However, when the figure of protected subjects rise, assign authorizations using either discretionary or role-based access control models become harder, more expensive, and more error-prone. In such scenarios, the metadata-based access control model offers an expedient and effective alternative for managing entree rights.
Yagüe, Maña & Lopez (2005) carried out a research at the University of Málaga, Spain which aims at providing a secure solution for web services (WS) through the development of an interoperable and distributed access control. The authors arrive at the interoperable access control for web services only after separating access control (AC) and authorization functions. In contrast, Priebe, Fernández, Mehlau & Pernul (2004) consider security aspects from the early stages of developing a trustworthy information system when, creating a secure access control system. The comparison of the two sources reveals that the development of a meta-data access system is more robust and flexible when access is only granted after a user satisfies all the required attributes based on existing metadata.
Yagüe, Maña & Lopez (2005) first define security terminologies and the security protocols that control web services (WS). The three standards that power WS include SOAP, UDDI, and WSDL. The authors criticize a single control point as representative of a weak structure for deterring cyber-attacks and faults. Furthermore, they discuss the concept of gaining access control using certificates, which entail a group membership, role, and clearance. For these authors, the best security system separates access control functionality from the verification function, treating them as two different entities. They propose the development of an external PMI (Privilege Management Infrastructure) in which they stated that PMI only allows the authorized members of an organization to access the specific resources according to the developed policy. The policy contains the data as which user is limited to which resources and operations. PMI only controls authorization which makes it different from the metadata-based access control model.
Yagüe, Maña & Lopez are able to define devices for the semantic account of elements of the access control unit, which allow administrators to consolidate authorization functions in their systems. Moreover, the authors used an XML language to stipulate the policies for access to the system. According to Yagüe, Maña & Lopez (2005), the best policy to deter unauthorized access is by separating access and the access control criteria, such that one end of the system validates access credentials, while the other end of the system grants access to verified users.
Fernández, Mehlau & Pernul (2004) leverage previously established software patterns to develop a robust access control system. The authors feel that a comprehensive assortment of best practices and patterns is important in creating a new system by relatively inexperienced web developers. The authors first present established access control models, which include discretionary and role-based access control models. These pave the way for the metadata-based access control model combining aspects of the two. According to Fernández, Mehlau & Pernul, the metadata-based access control model is the best structured and unified access system for various access needs.
Fernández, Mehlau & Pernul first identify a universal authorization pattern and session pattern of discretionary and role-based access. To cater to high flexibility needs of heterogeneous systems, the authors develop a pattern for the metadata-based access control model, one that administers users’ metadata, such as user attributes and credentials. The authors recommend that access control should thus be applied based on the current metadata, and that access be granted only when obligatory attributes and properties are satisfied by users wishing to gain access.
Supporting Access Control System with Graphical Passwords
A robust password access system can complement the metadata-based access control system. Graphical passwords that can be employed to make an access control system stronger include textual passwords with graphical assistance, as well as the ‘draw-a-secret’ (DAS) scheme (Jermyn et al., 1999). On one hand, the textual password selection can be augmented by graphical assistance, whereby a user may be prompted to enter his or her password in certain positions, such as left-to-right or right-to-left orientations. On the other hand, the DAS scheme is an entirely graphic password selection and input method, whereby the user is prompted to draw a secret sign or pattern to gain access. The DAS scheme is best for granting access to metadata-based access control systems because the user is freed from the burden of remembering any type of alphanumeric data (Jermyn et al., 1999).
Jermyn et al argue that the DAS scheme is best because drawing patterns in a pictorial format is more memorable than having to remember words (1999). Graphical passwords allow for imagination on the part of the user to gain access, thus adding to their memory of the access criterion. Additionally, graphical passwords are more universal compared to text-based passwords, which may be limiting for users who do not use the Latin alphabet. The metadata-based access control system is meant to be flexible, meaning that it gives users flexible ways of gaining access to a system.
When integrated with the metadata-based access control system, the password system should be made to cater to varying user attributes of the users. Memorable passwords should be used, since text-based passwords may be harder to remember, considering that most people use different passwords for different accounts (Jermyn et al., 1999). Hence, it is recommended that text-based passwords should rely on “simple shapes and patterns” when augmented by graphical assistance.
Conclusion
In my opinion, the meta-data access system is more robust and flexible because access is only granted when a user satisfies all the required attributes based on existing metadata. The separation of access and access control criteria, such that one end of the system validates access credentials while the other end of the system gives access to verified users, may be subject to hacking, since the faction granting access is manipulated to give access. Moreover, the meta-data access system is more flexible because it can leverage the metadata to verify users’ authenticity, thereby granting access in a heterogeneous system.
Works Cited
Jermyn, I. H., Mayer, A., Monrose, F., Reiter, M. K., & Rubin, A. D. (1999). The design and analysis of graphical passwords. USENIX Association.
Priebe, T., Fernández, E. B., Mehlau, J. I., & Pernul, G. (2004). A pattern system for access control. In Research Directions in Data and Applications Security XVIII (pp. 235-249). Springer, Boston, MA
Yagüe, M. I., Maña, A., & Lopez, J. (2005). A metadata‐based access control model for web services. Internet research.