REPOSITORY > RESULTS

Abstract

Ubiquitous environments which embrace the trends of enterprise mobility and consumerization
of IT have an increase in social importance. In these environments, the same
mobile device and applications are simultaneously used for both personal and professional
purposes. This type of usage blurs the boundaries between these domains and presents
numerous challenges for information security. Context-aware security has been proposed
as a solution for many of these; however, it is argued here that the existing context-aware
security systems are limited, and deal mainly with targeted use cases. They do not provide
a clear and complete understanding of the context relevant to security, and use contextual
information with an arbitrary level of abstraction. Moreover, they utilize security policies
which are burdened with context reasoning rules and policy enforcement actions. These
policies are specified according to policy models, which consider context only as an add-on,
and do not provide a means of modeling adaptable security behavior.
In order to address these issues, a new conceptual model of security context is proposed.
The model identifies the important concepts of security context and also takes into account
related social aspects. It represents the security context using a set of concepts at the
appropriate level of abstraction. Based on this model, a security policy model and language
are also proposed. These are centered around the notion of the security context, and enable
the specification and analysis of simple but expressive security policies which are applicable
to ubiquitous social systems. To achieve adaptable behavior, the policy model further
introduces an object lifecycle diagram. In addition, a range of security policy templates
are defined which capture recurring requirements in a diverse set of use cases.
The models and language are evaluated in an empirical and practical manner. First, it is
shown that the conceptual model is able to represent the security context covered by other
approaches. Then, the policy model is used to identify the possible threats to the assets
of interest during various activities, together with their potential consequences. Next,
both the models and the language are applied in order to analyze diverse ubiquitous social
system use cases from the perspective of security. Finally, the feasibility of this approach
is demonstrated by implementing a proof-of-concept prototype of a context-aware security
system, which enables the specification and enforcement of security policies according to
the policy model and language presented here.
The proposed conceptual model describes the security context more clearly than the
alternatives, and improves the current understanding by introducing social concepts as
abstractions. Furthermore, the new policy model provides more intuitive abstractions for
ubiquitous social systems and enables a clear and precise analysis of the way in which important
contextual information influence access control. Together with the policy language
and templates, this facilitates the specification, management and reuse of security policies
for ubiquitous security systems. Overall, this thesis provides a comprehensive view of ubiquitous
social systems and their security challenges, analyzing them systematically from the
perspective of security. In addition, it facilitates context specification and usage, making
the design and development of context-aware security systems more straightforward.