Granularity and Usability in Authorization Policies

Author(s):  
Boyun Zhang ◽  
Puneet Gill ◽  
Nelu Mihai ◽  
Mahesh Tripunitara
Author(s):  
Yehia Elrakaiby ◽  
Frédéric Cuppens ◽  
Nora Cuppens-Boulahia

Pre-obligations denote actions that may be required before access is granted. The successful fulfillment of pre-obligations leads to the authorization of the requested access. Pre-obligations enable a more flexible enforcement of authorization policies. This paper formalizes interactions between the obligation and authorization policy states when pre-obligations are supported and investigates their use in a practical scenario. The main advantage of the presented approach is that it gives pre-obligations both declarative semantics using predicate logic and operational semantics using Event-Condition-Action (ECA) rules. Furthermore, the presented framework enables policy designers to easily choose to evaluate any pre-obligation either (1) statically (an access request is denied if the pre-obligation has not been fulfilled); or (2) dynamically (users are given the possibility to fulfill the pre-obligation after the access request and before access is authorized).


2008 ◽  
pp. 2865-2891
Author(s):  
Sarath Indrakanti ◽  
Vijay Varadharajan ◽  
Michael Hitchens

In this paper, we discuss the design issues for an authorization framework for Web Services. In particular, we describe the features required for an authorization policy language for Web Services. We briefly introduce the authorization service provided by Microsoft .NET MyServices and describe our extended authorization model that proposes extensions to the .NET MyServices authorization service to support a range of authorization policies required in commercial systems. We discuss the application of the extended authorization model to a health care system built using Web Services. We use the XML Access Control Language (XACL) in our implementation to demonstrate our extended authorization model. This also enables us to evaluate the range of authorization policies that XACL supports.


2017 ◽  
Vol 132 (6) ◽  
pp. 654-659 ◽  
Author(s):  
Rachel L. Hulkower ◽  
Meghan Kelley ◽  
Lindsay K. Cloud ◽  
Susanna N. Visser

Objectives: In 2011, the American Academy of Pediatrics updated its guidelines for the diagnosis and treatment of children with attention-deficit/hyperactivity disorder (ADHD) to recommend that clinicians refer parents of preschoolers (aged 4-5) for training in behavior therapy and subsequently treat with medication if behavior therapy fails to sufficiently improve functioning. Data available from just before the release of the guidelines suggest that fewer than half of preschoolers with ADHD received behavior therapy and about half received medication. About half of those who received medication also received behavior therapy. Prior authorization policies for ADHD medication may guide physicians toward recommended behavior therapy. Characterizing existing prior authorization policies is an important step toward evaluating the impact of these policies on treatment patterns. We inventoried existing prior authorization policies and characterized policy components to inform future evaluation efforts. Methods: A 50-state legal assessment characterized ADHD prior authorization policies in state Medicaid programs. We designed a database to capture data on policy characteristics and authorization criteria, including data on age restrictions and fail-first behavior therapy requirements. Results: In 2015, 27 states had Medicaid policies that prevented approval of pediatric ADHD medication payment without additional provider involvement. Seven states required that prescribers indicate whether nonmedication treatments were considered before Medicaid payment for ADHD medication could be approved. Conclusion: Medicaid policies on ADHD medication treatment are diverse; some policies are tied to the diagnosis and treatment guidelines of the American Academy of Pediatrics. Evaluations are needed to determine if certain policy interventions guide families toward the use of behavior therapy as the first-line ADHD treatment for young children.


Sign in / Sign up

Export Citation Format

Share Document