Declaration and Enforcement of Access Restrictions for Distributed Geospatial Information Objects (2005)

Today, geographic information is the key data for enabling decision making in many business sectors. Government agencies, private institutions and commercial companies provide geographic data of different kinds. Independent from each other, they collect and maintain geographic data in different formats. This results in an infrastructure of heterogenous and distributed geographic data. A serviceoriented infrastructure can make the geographic data accessible in an interoperable way, independent from the original data format. A specific implementation of this infrastructure is based on Geo Web Services. A Geo Web Service is a specialization of a Web Service that allows the creation, continuation and geoprocessing. The required functionality is available through standardized service interfaces. The combined use of different kinds of geographic data relies on the capabilities of a service, as it transforms the original data format to an interoperable format, based on the service invocation. The access to geographic data can be restricted due to different issues such as licensing or commercial use. The data providers can achieve the desired protection by the declaration and enforcement of restrictions as they regulate the use of a service. The functional capabilities for the declaration and enforcement can be provided by an access control system. Assuming an objectoriented data model of the geographic data, access restrictions can be enforced for individual objects according to the following requirements: <ul> <li>A restriction must be enforceable for all objects of a particular class.</li> <li>A restriction must be enforceable for individual objects.</li> <li>A restriction must be enforceable for individual objects based on their geometry if a particular topological relation between the object geometry and a given geometry is satisfied.</li> </ul> The aim of this work is the declaration and enforcement of these requirements for the infrastructure of heterogenous and distributed geospatial information objects, as they are accessible via the serviceoriented infrastructure. Assuming a valid XML markup of the objects and their geometry using the Geographic Markup Language (GML), which is an international standard of the Open GIS Consortium, Inc. (OGC), a solution is introduced that allows the declaration an enforcement. Due to the introduced restrictions, the declaration of access restrictions can result in different kinds of inconsistencies. This work describes mechanism for the detection and classification of the different kinds of inconsistencies as they help to correct the problems. The declaration and enforcement of the access restrictions is based on an extension of the eXtensible Access Control Markup Language (XACML), which is an international standard of the Organization for the Advancement of Structured Information Standards (OASIS). This extension (GeoXACML) contains the language constructs in order to declare the spatial restrictions and provides the algorithms to allow enforcement. The prototype implementation of the introduced solution for the service oriented infrastructure provides a comprehensive contribution for the use of protected heterogenous and distributed geographic information.