Law-Aware Access Control and its Information Model

TL;DR

This paper presents a law-aware access control model that incorporates legal requirements into access decisions, ensuring cross-border data access compliance for global companies, especially in banking scenarios.

Contribution

It introduces an information model integrating legislation into access control, focusing on lawfulness in cross-border data access, which is a novel approach compared to existing systems.

Findings

Legislation can be integrated into access control policies.

The model supports law-compliant cross-border data access.

An event flow demonstrates practical decision-making process.

Abstract

Cross-border access to a variety of data such as market information, strategic information, or customer-related information defines the daily business of many global companies, including financial institutions. These companies are obliged by law to keep a data processing legal for all offered services. They need to fulfill different security objectives specified by the legislation. Therefore, they control access to prevent unauthorized users from using data. Those security objectives, for example confidentiality or secrecy, are often defined in the eXtensible Access Control Markup Language that promotes interoperability between different systems. In this paper, we show the necessity of incorporating the requirements of legislation into access control. Based on the work flow in a banking scenario we describe a variety of available contextual information and their interrelations. Different from other access control systems our main focus is on law-compliant cross-border data access. By including legislation directly into access decisions, this lawfulness can be ensured. We also describe our information model to demonstrate how these policies can be implemented into an existing network and how the components and contextual information interrelate. Finally, we outline an event flow for a request made from a remote user exemplifying how such a system decides about access.