\documentclass[11pt,twoside]{article}\makeatletter

\IfFileExists{xcolor.sty}%
  {\RequirePackage{xcolor}}%
  {\RequirePackage{color}}
\usepackage{colortbl}
\usepackage{wrapfig}
\usepackage{ifxetex}
\ifxetex
  \usepackage{fontspec}
  \usepackage{xunicode}
  \catcode`⃥=\active \def⃥{\textbackslash}
  \catcode`❴=\active \def❴{\{}
  \catcode`❵=\active \def❵{\}}
  \def\textJapanese{\fontspec{Noto Sans CJK JP}}
  \def\textChinese{\fontspec{Noto Sans CJK SC}}
  \def\textKorean{\fontspec{Noto Sans CJK KR}}
  \setmonofont{DejaVu Sans Mono}
  
\else
  \IfFileExists{utf8x.def}%
   {\usepackage[utf8x]{inputenc}
      \PrerenderUnicode{–}
    }%
   {\usepackage[utf8]{inputenc}}
  \usepackage[english]{babel}
  \usepackage[T1]{fontenc}
  \usepackage{float}
  \usepackage[]{ucs}
  \uc@dclc{8421}{default}{\textbackslash }
  \uc@dclc{10100}{default}{\{}
  \uc@dclc{10101}{default}{\}}
  \uc@dclc{8491}{default}{\AA{}}
  \uc@dclc{8239}{default}{\,}
  \uc@dclc{20154}{default}{ }
  \uc@dclc{10148}{default}{>}
  \def\textschwa{\rotatebox{-90}{e}}
  \def\textJapanese{}
  \def\textChinese{}
  \IfFileExists{tipa.sty}{\usepackage{tipa}}{}
\fi
\def\exampleFont{\ttfamily\small}
\DeclareTextSymbol{\textpi}{OML}{25}
\usepackage{relsize}
\RequirePackage{array}
\def\@testpach{\@chclass
 \ifnum \@lastchclass=6 \@ne \@chnum \@ne \else
  \ifnum \@lastchclass=7 5 \else
   \ifnum \@lastchclass=8 \tw@ \else
    \ifnum \@lastchclass=9 \thr@@
   \else \z@
   \ifnum \@lastchclass = 10 \else
   \edef\@nextchar{\expandafter\string\@nextchar}%
   \@chnum
   \if \@nextchar c\z@ \else
    \if \@nextchar l\@ne \else
     \if \@nextchar r\tw@ \else
   \z@ \@chclass
   \if\@nextchar |\@ne \else
    \if \@nextchar !6 \else
     \if \@nextchar @7 \else
      \if \@nextchar (8 \else
       \if \@nextchar )9 \else
  10
  \@chnum
  \if \@nextchar m\thr@@\else
   \if \@nextchar p4 \else
    \if \@nextchar b5 \else
   \z@ \@chclass \z@ \@preamerr \z@ \fi \fi \fi \fi
   \fi \fi  \fi  \fi  \fi  \fi  \fi \fi \fi \fi \fi \fi}
\gdef\arraybackslash{\let\\=\@arraycr}
\def\@textsubscript#1{{\m@th\ensuremath{_{\mbox{\fontsize\sf@size\z@#1}}}}}
\def\Panel#1#2#3#4{\multicolumn{#3}{){\columncolor{#2}}#4}{#1}}
\def\abbr{}
\def\corr{}
\def\expan{}
\def\gap{}
\def\orig{}
\def\reg{}
\def\ref{}
\def\sic{}
\def\persName{}\def\name{}
\def\placeName{}
\def\orgName{}
\def\textcal#1{{\fontspec{Lucida Calligraphy}#1}}
\def\textgothic#1{{\fontspec{Lucida Blackletter}#1}}
\def\textlarge#1{{\large #1}}
\def\textoverbar#1{\ensuremath{\overline{#1}}}
\def\textquoted#1{‘#1’}
\def\textsmall#1{{\small #1}}
\def\textsubscript#1{\@textsubscript{\selectfont#1}}
\def\textxi{\ensuremath{\xi}}
\def\titlem{\itshape}
\newenvironment{biblfree}{}{\ifvmode\par\fi }
\newenvironment{bibl}{}{}
\newenvironment{byline}{\vskip6pt\itshape\fontsize{16pt}{18pt}\selectfont}{\par }
\newenvironment{citbibl}{}{\ifvmode\par\fi }
\newenvironment{docAuthor}{\ifvmode\vskip4pt\fontsize{16pt}{18pt}\selectfont\fi\itshape}{\ifvmode\par\fi }
\newenvironment{docDate}{}{\ifvmode\par\fi }
\newenvironment{docImprint}{\vskip 6pt}{\ifvmode\par\fi }
\newenvironment{docTitle}{\vskip6pt\bfseries\fontsize{22pt}{25pt}\selectfont}{\par }
\newenvironment{msHead}{\vskip 6pt}{\par}
\newenvironment{msItem}{\vskip 6pt}{\par}
\newenvironment{rubric}{}{}
\newenvironment{titlePart}{}{\par }

\newcolumntype{L}[1]{){\raggedright\arraybackslash}p{#1}}
\newcolumntype{C}[1]{){\centering\arraybackslash}p{#1}}
\newcolumntype{R}[1]{){\raggedleft\arraybackslash}p{#1}}
\newcolumntype{P}[1]{){\arraybackslash}p{#1}}
\newcolumntype{B}[1]{){\arraybackslash}b{#1}}
\newcolumntype{M}[1]{){\arraybackslash}m{#1}}
\definecolor{label}{gray}{0.75}
\def\unusedattribute#1{\sout{\textcolor{label}{#1}}}
\DeclareRobustCommand*{\xref}{\hyper@normalise\xref@}
\def\xref@#1#2{\hyper@linkurl{#2}{#1}}
\begingroup
\catcode`\_=\active
\gdef_#1{\ensuremath{\sb{\mathrm{#1}}}}
\endgroup
\mathcode`\_=\string"8000
\catcode`\_=12\relax

\usepackage[a4paper,twoside,lmargin=1in,rmargin=1in,tmargin=1in,bmargin=1in,marginparwidth=0.75in]{geometry}
\usepackage{framed}

\definecolor{shadecolor}{gray}{0.95}
\usepackage{longtable}
\usepackage[normalem]{ulem}
\usepackage{fancyvrb}
\usepackage{fancyhdr}
\usepackage{graphicx}
\usepackage{marginnote}

\renewcommand{\@cite}[1]{#1}


\renewcommand*{\marginfont}{\itshape\footnotesize}

\def\Gin@extensions{.pdf,.png,.jpg,.mps,.tif}

  \pagestyle{fancy}

\usepackage[pdftitle={A Fine Grained Access Control Model Based on Diverse Attributes},
 pdfauthor={}]{hyperref}
\hyperbaseurl{}

	 \paperwidth210mm
	 \paperheight297mm
              
\def\@pnumwidth{1.55em}
\def\@tocrmarg {2.55em}
\def\@dotsep{4.5}
\setcounter{tocdepth}{3}
\clubpenalty=8000
\emergencystretch 3em
\hbadness=4000
\hyphenpenalty=400
\pretolerance=750
\tolerance=2000
\vbadness=4000
\widowpenalty=10000

\renewcommand\section{\@startsection {section}{1}{\z@}%
     {-1.75ex \@plus -0.5ex \@minus -.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\Large\bfseries}}
\renewcommand\subsection{\@startsection{subsection}{2}{\z@}%
     {-1.75ex\@plus -0.5ex \@minus- .2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\Large}}
\renewcommand\subsubsection{\@startsection{subsubsection}{3}{\z@}%
     {-1.5ex\@plus -0.35ex \@minus -.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\large}}
\renewcommand\paragraph{\@startsection{paragraph}{4}{\z@}%
     {-1ex \@plus-0.35ex \@minus -0.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\normalsize}}
\renewcommand\subparagraph{\@startsection{subparagraph}{5}{\parindent}%
     {1.5ex \@plus1ex \@minus .2ex}%
     {-1em}%
     {\reset@font\normalsize\bfseries}}


\def\l@section#1#2{\addpenalty{\@secpenalty} \addvspace{1.0em plus 1pt}
 \@tempdima 1.5em \begingroup
 \parindent \z@ \rightskip \@pnumwidth 
 \parfillskip -\@pnumwidth 
 \bfseries \leavevmode #1\hfil \hbox to\@pnumwidth{\hss #2}\par
 \endgroup}
\def\l@subsection{\@dottedtocline{2}{1.5em}{2.3em}}
\def\l@subsubsection{\@dottedtocline{3}{3.8em}{3.2em}}
\def\l@paragraph{\@dottedtocline{4}{7.0em}{4.1em}}
\def\l@subparagraph{\@dottedtocline{5}{10em}{5em}}
\@ifundefined{c@section}{\newcounter{section}}{}
\@ifundefined{c@chapter}{\newcounter{chapter}}{}
\newif\if@mainmatter 
\@mainmattertrue
\def\chaptername{Chapter}
\def\frontmatter{%
  \pagenumbering{roman}
  \def\thechapter{\@roman\c@chapter}
  \def\theHchapter{\roman{chapter}}
  \def\thesection{\@roman\c@section}
  \def\theHsection{\roman{section}}
  \def\@chapapp{}%
}
\def\mainmatter{%
  \cleardoublepage
  \def\thechapter{\@arabic\c@chapter}
  \setcounter{chapter}{0}
  \setcounter{section}{0}
  \pagenumbering{arabic}
  \setcounter{secnumdepth}{6}
  \def\@chapapp{\chaptername}%
  \def\theHchapter{\arabic{chapter}}
  \def\thesection{\@arabic\c@section}
  \def\theHsection{\arabic{section}}
}
\def\backmatter{%
  \cleardoublepage
  \setcounter{chapter}{0}
  \setcounter{section}{0}
  \setcounter{secnumdepth}{2}
  \def\@chapapp{\appendixname}%
  \def\thechapter{\@Alph\c@chapter}
  \def\theHchapter{\Alph{chapter}}
  \appendix
}
\newenvironment{bibitemlist}[1]{%
   \list{\@biblabel{\@arabic\c@enumiv}}%
       {\settowidth\labelwidth{\@biblabel{#1}}%
        \leftmargin\labelwidth
        \advance\leftmargin\labelsep
        \@openbib@code
        \usecounter{enumiv}%
        \let\p@enumiv\@empty
        \renewcommand\theenumiv{\@arabic\c@enumiv}%
	}%
  \sloppy
  \clubpenalty4000
  \@clubpenalty \clubpenalty
  \widowpenalty4000%
  \sfcode`\.\@m}%
  {\def\@noitemerr
    {\@latex@warning{Empty `bibitemlist' environment}}%
    \endlist}

\def\tableofcontents{\section*{\contentsname}\@starttoc{toc}}
\parskip0pt
\parindent1em
\def\Panel#1#2#3#4{\multicolumn{#3}{){\columncolor{#2}}#4}{#1}}
\newenvironment{reflist}{%
  \begin{raggedright}\begin{list}{}
  {%
   \setlength{\topsep}{0pt}%
   \setlength{\rightmargin}{0.25in}%
   \setlength{\itemsep}{0pt}%
   \setlength{\itemindent}{0pt}%
   \setlength{\parskip}{0pt}%
   \setlength{\parsep}{2pt}%
   \def\makelabel##1{\itshape ##1}}%
  }
  {\end{list}\end{raggedright}}
\newenvironment{sansreflist}{%
  \begin{raggedright}\begin{list}{}
  {%
   \setlength{\topsep}{0pt}%
   \setlength{\rightmargin}{0.25in}%
   \setlength{\itemindent}{0pt}%
   \setlength{\parskip}{0pt}%
   \setlength{\itemsep}{0pt}%
   \setlength{\parsep}{2pt}%
   \def\makelabel##1{\upshape ##1}}%
  }
  {\end{list}\end{raggedright}}
\newenvironment{specHead}[2]%
 {\vspace{20pt}\hrule\vspace{10pt}%
  \phantomsection\label{#1}\markright{#2}%

  \pdfbookmark[2]{#2}{#1}%
  \hspace{-0.75in}{\bfseries\fontsize{16pt}{18pt}\selectfont#2}%
  }{}
      \def\TheFullDate{2011-09 2011-08-22 (revised: 2011 September 22 August 2011)}
\def\TheID{\makeatother }
\def\TheDate{2011-09 2011-08-22}
\title{A Fine Grained Access Control Model Based on Diverse Attributes}
\author{}\makeatletter 
\makeatletter
\newcommand*{\cleartoleftpage}{%
  \clearpage
    \if@twoside
    \ifodd\c@page
      \hbox{}\newpage
      \if@twocolumn
        \hbox{}\newpage
      \fi
    \fi
  \fi
}
\makeatother
\makeatletter
\thispagestyle{empty}
\markright{\@title}\markboth{\@title}{\@author}
\renewcommand\small{\@setfontsize\small{9pt}{11pt}\abovedisplayskip 8.5\p@ plus3\p@ minus4\p@
\belowdisplayskip \abovedisplayskip
\abovedisplayshortskip \z@ plus2\p@
\belowdisplayshortskip 4\p@ plus2\p@ minus2\p@
\def\@listi{\leftmargin\leftmargini
               \topsep 2\p@ plus1\p@ minus1\p@
               \parsep 2\p@ plus\p@ minus\p@
               \itemsep 1pt}
}
\makeatother
\fvset{frame=single,numberblanklines=false,xleftmargin=5mm,xrightmargin=5mm}
\fancyhf{} 
\setlength{\headheight}{14pt}
\fancyhead[LE]{\bfseries\leftmark} 
\fancyhead[RO]{\bfseries\rightmark} 
\fancyfoot[RO]{}
\fancyfoot[CO]{\thepage}
\fancyfoot[LO]{\TheID}
\fancyfoot[LE]{}
\fancyfoot[CE]{\thepage}
\fancyfoot[RE]{\TheID}
\hypersetup{citebordercolor=0.75 0.75 0.75,linkbordercolor=0.75 0.75 0.75,urlbordercolor=0.75 0.75 0.75,bookmarksnumbered=true}
\fancypagestyle{plain}{\fancyhead{}\renewcommand{\headrulewidth}{0pt}}

\date{}
\usepackage{authblk}

\providecommand{\keywords}[1]
{
\footnotesize
  \textbf{\textit{Index terms---}} #1
}

\usepackage{graphicx,xcolor}
\definecolor{GJBlue}{HTML}{273B81}
\definecolor{GJLightBlue}{HTML}{0A9DD9}
\definecolor{GJMediumGrey}{HTML}{6D6E70}
\definecolor{GJLightGrey}{HTML}{929497} 

\renewenvironment{abstract}{%
   \setlength{\parindent}{0pt}\raggedright
   \textcolor{GJMediumGrey}{\rule{\textwidth}{2pt}}
   \vskip16pt
   \textcolor{GJBlue}{\large\bfseries\abstractname\space}
}{%   
   \vskip8pt
   \textcolor{GJMediumGrey}{\rule{\textwidth}{2pt}}
   \vskip16pt
}

\usepackage[absolute,overlay]{textpos}

\makeatother 
      \usepackage{lineno}
      \linenumbers
      
\begin{document}

             \author[1]{Dr. Rajender  Nath}

             \author[2]{Gulshan  Ahuja}

             \affil[1]{  Kurukshetra University, Kurukshetra, Haryana, India.}

\renewcommand\Authands{ and }

\date{\small \em Received: 16 July 2011 Accepted: 8 August 2011 Published: 22 August 2011}

\maketitle


\begin{abstract}
        


As the web has become a place for sharing of information and resources across varied domains, there is a need for providing authorization services in addition to authentication services provided by public key infrastructure (PKI). In distributed systems the use of attribute certificates (AC) has been explored as a solution for implementation of authorization services and their use is gaining popularity. AC issued by attribute authority (AA) facilitates identification of a service requester and can be used to enforce access control for resources. AC of a service requester is used as part of credentials supplied during the service request for accessing any resource. As there exist potentially multiple issuing domains which issue credentials, therefore the target domain must allow access to resources by considering different credentials and must be able to decide about which set of attributes can be considered as valid attributes for making access control decisions. In this paper, we present an authorization based access control model that allows a fine grained access control to resources in an open domain by utilizing attributes issued by diverse attribute authorities.

\end{abstract}


\keywords{attribute certificates, attribute authority, authorization, access control.}

\begin{textblock*}{18cm}(1cm,1cm) % {block width} (coords) 
\textcolor{GJBlue}{\LARGE Global Journals \LaTeX\ JournalKaleidoscope\texttrademark}
\end{textblock*}

\begin{textblock*}{18cm}(1.4cm,1.5cm) % {block width} (coords) 
\textcolor{GJBlue}{\footnotesize \\ Artificial Intelligence formulated this projection for compatibility purposes from the original article published at Global Journals. However, this technology is currently in beta. \emph{Therefore, kindly ignore odd layouts, missed formulae, text, tables, or figures.}}
\end{textblock*}


\let\tabcellsep& 	 	 		 
\section[{INTRODUCTION}]{INTRODUCTION}\par
ith continually changing business environment privacy and protection of resources is becoming more and more important. The access control to resources is bound up with the authentication and the authorization. There is a strong need felt for receptive authorization infrastructure that can cater for rapidly changing dynamic environments and should be able to validate the identity of service requesters.\par
The commonly used credentials for access are identity credentials, attribute credentials and authorization credentials. Identity based access control systems require identity certificates which are issued and certified by certification authorities (CA). When a CA issues an identity certificate, it binds a particular public key to the name of the service requester (SR) identified by the certificate. In addition to a public key, a certificate always includes information such as the validity period, the name of the CA, the digital signature of the issuing CA etc. Identity based credentials are more suitable where service requesters are already known to the service provider (SP) through the process of registration. This approach works well in a tightly coupled environment. Identity based access control puts a constraint of prior registration of every service requester which limits the scalability of overall system. Another access control approach is based on the authorization certificates which are based on the principle of delegation of rights and responsibilities. The authorization certificates are issued by the authorization authorities who have rights to access the specific resource and thus can delegate full or subset of rights to other users. The authorization certificates usually contain the identity of the resource, identity of the service requester, access rights to access the resource, etc. The advantage of authorization certificates are that service requesters are authenticated in their own domain and another service requester to whom the rights have been delegated can realize the access control based on delegated rights. A different area of research developments is access control based on attributes. In attributes based access control systems the access policy is based on the various attributes which are assigned to the service requesters. The attribute certificates are issued by Attribute Authority (AA) and these contain the name value pairs of the various attributes. Attributes based authorization offers more flexibility and scalability for an open and distributed environment. The use of AC based on privilege management infrastructure (PMI), allows including and revoking attributes and can contain information about the privileges or roles of a user. AC conveys a short-lived attribute about a given subject and can be used to authenticate the identity of the attribute certificate holder. A real time problem arises when the request made by a service requester requires attributes which have been issued by diverse attribute authorities and are located at different locations. The authorization efforts become more difficult when two or more AAs save attributes for a service requester with different identities. The rest of this paper is structured as follows. Section II highlights the related work. Section III highlights the requirements to develop a new model based on diverse attributes. Section IV describes the implementation architecture and explains the working of proposed model. Finally Section V concludes and briefly describes scope for the future work.  
\section[{RELATED WORK}]{RELATED WORK}\par
Traditional access control approaches base their authorization decisions on subject's identity. A number of research papers based on attributes based authorization have been proposed by researchers. Ioannis Mavridis et al. \hyperref[b0]{[1]} proposed a mechanism for access control based on attribute certificates for medical Internet applications. David Chadwick \hyperref[b1]{[2]} proposed X.509 privilege management infrastructure. Later David Chadwick et al. \hyperref[b2]{[3]} proposed Role-Based Access Control with X.509 Attribute Certificates. The proposed approach in paper adopted the standard X.509 PMI to build an efficient role-based trust management system in which role assignments can be widely distributed among organizations, and an XMLbased local policy determines which roles to trust and which privileges to grant. Jordi Forne et al. \hyperref[b4]{[4]} presented an implementation of an authorization system for web based applications based on the ITU-T X509 recommendations which specifies use of privilege management infrastructure for realizing access control. Access control mechanism based on authorization, using attributes issued by a remote attribute authority, has been proposed by S. Cantor. \hyperref[b5]{[5]}. Wei Zhou et al. \hyperref[b6]{[6]} proposed a role based access control with attribute certificates. Alfieri R. et al. presents a VOMS model \hyperref[b7]{[7]} for managing authorization in a Grid Environment and allows coalition of multiple attributes. Eric Yuan \hyperref[b8]{[8]} proposed an attribute based access control (ABAC) model as a new approach, which is based on subject, object, and environment attributes and supports both mandatory and discretionary access control needs. M Liu et al. \hyperref[b9]{[9]} proposed an attribute and role based access control model ARBAC for web services. However, the role remains static and when assigned it becomes out of date. Alan H. Karp \hyperref[b10]{[10]} proposed an implementation based on authorization based access control (ABAC) for services oriented architecture. David W Chadwick \hyperref[b11]{[11]} presented a model and protocol elements for linking AAs, service providers and user attributes together, under the sole control of the user and allowed merging the attributes from multiple AAs in order to grant the user access to its resources. Frikken K et al. \hyperref[b12]{[12]} proposed an approach for attribute based access control with hidden policies and hidden credentials. Shen Hai Bo et al. \hyperref[b13]{[13]} proposed an attribute based access control model for web services. Nirmal Dagdee et al. \hyperref[b14]{[14]} proposed an access control methodology for sharing of open and Domain confined data using Standard Credentials. The methodology requires that various types of standard credentials and related attributes are identified and published by some apex authority so that the resource providers can define their access policies in terms of these standard credentials. In real terms, identification of standard credentials is a very difficult task and is not suitable for largely distributed systems having millions of service requesters. Regina N. Hebig et al. \hyperref[b15]{[15]} describe a prototype implementation with an architecture based on the standards XACML, SAML, WSPolicy, WS-SecurityPolicy and WS-Trust which puts the focus on sharing identity and attribute information across independent domains for the purpose of access control. 
\section[{III.}]{III.} 
\section[{PROBLEM FORMULATION}]{PROBLEM FORMULATION}\par
The service requester's credentials may be stored or issued in a variety of places, for example, each AA may store the attributes or the credentials it issues in its own repository. When a service requester makes a request to service provider for accessing a resource and presents its credentials. At service provider's end, the presented set of attributes may not be sufficient enough to grant access to a resource. This necessitates that service requester must collect together the credentials required for making access to a resource. David W Chadwick \hyperref[b11]{[11]} presented a model and protocol elements for linking attributes from multiple AAs. His approach requires input from the user who wish to link attributes from multiple AAs. However, the main issue with his approach is that user has to initiate multiple browser instances and execute steps for cross linkages between multiple attribute authorities. If the number of attributes required for grant of access belongs to multiple attribute authorities, the same process is to be carried multiple times for providing linkages between multiple attribute authorities. This makes the task of service requester more complex and time consuming. We propose a new model where the service requester's task of creating linkages is eliminated and the process of linkage is initiated by service provider only. The proposed work also takes care of the privacy concern of the service requester to ensure that service provider will be able to link attributes from multiple attribute authorities only when service requester desires to create linkages with multiple attribute authorities.\par
IV. 
\section[{PROPOSED MODEL}]{PROPOSED MODEL}\par
This section describes the details of proposed model. The approach requires that all organizations who are willing to exchange and share information among them must form agreements for a number of conditions i.e. security mechanisms to be used, attribute definitions etc. and must pre establish a certain level of trust. Such sort of arrangement is termed as federation and is same as Shibboleth federations  {\ref [16]}. The mechanism assumes that linking between AAs is based on secured shared information and there also has to be secured shared information between a service requester and all attribute authorities where service requester is registered for attribute sharing.\par
An authorization model based on diverse attributes from different attribute authorities is shown in Figure 1. The diagram reflects following components involved in the access mechanism.  
\section[{a) Overview}]{a) Overview}\par
A service requester can acquire multiple identities by registering with a number of attribute authorities. The decision to register with the attribute authority can be based on its reputation, quality of service etc. The mechanism requires that every service requester and all AAs to whom requester wishes to link must exchange and agree upon conversation framework for transfer of information between them.  
\section[{PDP PEP}]{PDP PEP}\par
The service provider should not be able to obtain attributes from any AA without knowledge and permission from the service requester. The AAs who are willing to exchange information must make groups with predefined policies and rules. There has to be one or more than one primary attribute authority. The primary attribute authorities act as the root for all other AAs which are members of the group. Before making a request for accessing any resource, the service requester must acquire credentials from one of the primary certified authority. The attributes returned by the primary AA contain a basic set of the attributes along with information about all AAs for which service requester has already registered and has agreed to use additional attributes. Each service provider in the federation is free to decide about the number and types of attributes for granting access requests. The service providers may grant access on basic set of attributes or may decide to impose more security check by imposing requirement for additional attributes from one or more AAs. 
\section[{b) SAML based conversation framework}]{b) SAML based conversation framework}\par
We use SAML assertions for describing conversation tokens. Figure 2 depicts conversation framework between service requester and provider. Figure 3 describes the format of SAML based conversation tokens.\par
Let ATS b be the basic set of attributes and ? is an alphabet, a non-empty finite set.  Let service requester SR is registered with three attribute authorities. As identity SR 1 with attribute authority AA1, as identity SR 2 with AA2, as identity SR 3 with AA3. The conversation token from the primary attribute authority to service requester will be of the form as defined below.\par
ATS \{SR, Time\textunderscore Stamp\}P B K SR AA1\{ SR 1, Time\textunderscore Stamp\}P B K AA1 AA2\{ SR 2, Time\textunderscore Stamp\}P B K AA2 AA3\{ SR 3, Time\textunderscore Stamp\}P B K AA3 c) Authentication of conversation tokens As per figure 1 and figure 2, the authorization process is divided in to 2 parts: obtaining of basic set of attributes from the primary attribute authority and use of attributes for making authorization decisions. For the first part, since it is assumed that service requester trusts the primary attribute authority and can decrypt and obtain the basic set of attributes using its private key P V K SR. The primary attribute authority also passes on the encrypted info for every other AA where service requester's attributes are already located. This encryption is carried using public key of the corresponding attribute authority. The second part is an establishment stage where ECT is used by service provider to make access decision. When a service requester makes a request for accessing a resource, the service provider executes following tasks:\par
Task 1: Service requester obtains credentials from primary attribute authority. The credentials issued by primary attribute authority to the service requester are encrypted using public key of respective authority and are sent in format as in figure 3.\par
Task 2 : The service requester decrypts the basic attributes, using its private key P V K SR and presents the basic set of attributes along with encrypted info about AAs, acquired from primary AA, to service provider.\par
Task 3 : On receiving the request, the service provider checks for the basic set of attributes against already specified policies in the policy store to decide whether access can be granted or not.\par
Task 4 : In case the existing policies do not allow access based on basic set of attributes contained in the service request, the PDP module passes the service request to the AALM module.\par
Task 5 : AALM module extracts the information from the service request to find out for which all other AAs service requester has already registered. The request message along with the requester's URL was encrypted using public key of concerned AA so it can be decrypted using private key by the concerned AA only. The service provider just knows that at which attribute authority the service requester is registered so this helps to maintain the privacy concern of the requester because service provider can not determine the identity and attributes of the requester located on a particular AA.\par
Task 6 : AALM sends a request message for the required attributes to the concerned AAs along with the encrypted info about requester's identity and date time stamp.\par
Task 7 : AA decrypts the information corresponding to its requested attribute set using its private key and extracts the identity of service requester and also verifies the date and time stamp for validity of message. For example SR had already registered with AA1 as SR 1 , therefore upon successful decryption of the message, AA1 can ascertain about SR 1 .\par
Task 8 : To make sure that SR is willing to allow attributes from AA, it redirects an authentication request to SR.\par
Task 9 : Once the service requester authenticates with AA, the information regarding attributes required by the service provider is shown and service requester is given a choice to allow passing back the set of attributes to the service provider.\par
Task 10 : Once the confirmation is made by the service requester, the one or more required attributes are sent back to the service provider.\par
Tasks from 6 to 9 are repeated for every AA to whom AALM module sends a request for additional attributes. In the event of any AA failing to provide required attributes the request is terminated with an appropriate response to the service requester.\par
The access control decision based on diverse attributes can be realized in terms of a function f (ATS b ) or f (ATS b × ATS i × ATS j × ATS j )\par
Where ATS b is the basic set of attributes for SR, and ATS i , ATS j , ATS j are the set of attributes for three different attribute authorities identified as AA i , AA j , AA k respectively.\par
The above mentioned function is implemented and used by PEP component to decide whether the access to resource can be allowed based on basic set of attributes or attribute assignments from multiple AAs can be evaluated. The implementation of function solely depends upon the policies and requirements of the service provider. The evaluation outcome can be considered for granting access to the resource. The access control mechanism discussed in this paper allows in implementing fine grained access control based on multiple attributes. The proposed approach allows every service provider to decide the level of security for granting access request. The service provider can choose to allow access request based on the basic set of attributes or may put more restrictions by imposing requirements for attributes from one or more AAs. The use of basic set of attributes works well\begin{figure}[htbp]
\noindent\textbf{}\includegraphics[]{image-2.png}
\caption{\label{fig_0}}\end{figure}
    \begin{figure}[htbp]
\noindent\textbf{} \par 
\begin{longtable}{P{0.4738505747126437\textwidth}P{0.37614942528735634\textwidth}}
\tabcellsep attributes and sends back the attributes received\\
\tabcellsep from multiple attribute authorities to PDP.\\
\tabcellsep ? Policy store contains policies for making access\\
\tabcellsep control decisions. The policies can be stored in XML\\
\tabcellsep format as it allows standard representation of\\
\tabcellsep access control rules. Extensible access control\\
\tabcellsep markup language (XACML) [17] [17] can be used to\\
? Policy Decision Point (PDP) evaluates the applicable policies against service requests. PDP checks for the available attributes in the service request to\tabcellsep allow implementation of access control policies. ? Policy management interface allows handling of policies in the policy store.\\
check whether access request can be granted or\tabcellsep \\
not. In case the attributes contained in service\tabcellsep \\
request are not sufficient enough for grant of access\tabcellsep \\
to resource, it hands over the request parameters\tabcellsep \\
along with information about additional attributes\tabcellsep \\
required for grant of access request.\tabcellsep \\
? Attributes authorization and linker module (AALM) is\tabcellsep \\
responsible for contacting concerned attribute\tabcellsep \\
authorities for making request of additional\tabcellsep \end{longtable} \par
 
\caption{\label{tab_0}?}\end{figure}
 			\footnote{© 2011 Global Journals Inc. (US) Global Journal of Computer Science and Technology Volume XI Issue XV Version I} 		 		\backmatter  			 \par
V. 
\subsection[{CONCLUSION}]{CONCLUSION}\par
In this paper, authors have proposed a mechanism for allowing access to a resource based on the multiple attributes from one or more AAs. The merit of the proposed approach is that service provider can link to the attribute authorities and obtain attributes for grant of access only when it is permitted by the service requester. Even if the service provider is able to determine that to which all AAs the service requester has already registered, it can not automatically obtain attributes without service requester's permission. The proposed approach focuses only on authorization of requests based on attributes. The future work may consider other aspects related with attributes based access without involvement of centralized authority and automated trust establishment.			 			  				\begin{bibitemlist}{1}
\bibitem[Hebig ()]{b15}\label{b15} 	 		‘A Web Service Architecture for Decentralized Identity-and Attribute-based Access Control’.  		 			Regina N Hebig 		.  	 	 		\textit{IEEE International Conference on Web Services},  				2009.  	 
\bibitem[Mavridis et al. ()]{b0}\label{b0} 	 		‘Access Control based on Attribute certificates for Medical Internet applications’.  		 			Ioannis Mavridis 		,  		 			Christos Georgiadis 		,  		 			George Pangalos 		,  		 			Khair Marie 		.  	 	 		\textit{Journal of medical Internet Research}  		2001. 3.  	 
\bibitem[Dagdee and Vijaywargiya ()]{b14}\label{b14} 	 		‘Access control methodology for sharing of open and Domain confined data using Standard Credentials’.  		 			Nirmal Dagdee 		,  		 			Ruchi Vijaywargiya 		.  	 	 		\textit{International Journal on Computer Science and Engineering}  		2009. 1  (3)  p. .  	 
\bibitem[Liu and Guo H Q (2005)]{b9}\label{b9} 	 		‘An Attribute and Role-Based Access Control Model for Web Services’.  		 			M Liu 		,  		 			Su J D Guo H Q 		.  	 	 		\textit{proceedings of The Fourth International Conference on Machine Learning and Cybernetics},  				 (The Fourth International Conference on Machine Learning and CyberneticsGuangzhou, China)  		August 2005. p. .  	 
\bibitem[Shen et al. ()]{b13}\label{b13} 	 		‘An attribute based access control model for web services’.  		 			Hai Shen 		,  		 			Hong Bo 		,  		 			Fan 		.  	 	 		\textit{Proceeding of the 7th International Conference on Parallel and Distributed Computing, Applications and Technologies},  				 (eeding of the 7th International Conference on Parallel and Distributed Computing, Applications and Technologies)  		2006. IEEE.  	 
\bibitem[Attribute Certificates IEEE internet computing (2003)]{b3}\label{b3} 	 		‘Attribute Certificates’.  	 	 		\textit{IEEE internet computing},  				march-april 2003. p. .  	 
\bibitem[Frikken et al. (2006)]{b12}\label{b12} 	 		‘Attribute-Based Access Control with Hidden Policies and Hidden Credentials’.  		 			K Frikken 		,  		 			M Atallah 		,  		 			Jiangtao Li 		.  	 	 		\textit{IEEE Transactions on Computers}  		Oct. 2006. 55  (10)  p. .  	 
\bibitem[Yuan ()]{b8}\label{b8} 	 		‘Attributed Based Access Control (ABAC) for Web Services’.  		 			Eric Yuan 		.  	 	 		\textit{IEEE International Conference on Web Services},  				2005.  	 
\bibitem[David and Chadwick ()]{b11}\label{b11} 	 		‘Authorisation using Attributes from Multiple Authorities’.  		 			W David 		,  		 			Chadwick 		.  	 	 		\textit{Proceedings of the 15th IEEE International Workshops on Enabling Technologies Infrastructure for Collaborative Enterprises},  				 (the 15th IEEE International Workshops on Enabling Technologies Infrastructure for Collaborative Enterprises)  		2006.  	 
\bibitem[Karp ()]{b10}\label{b10} 	 		‘Authorization-Based Access Control for the Services Oriented Architecture’.  		 			Alan H Karp 		.  	 	 		\textit{Proceedings of the Fourth International Conference on Creating, Connecting and Collaborating through Computing},  				 (the Fourth International Conference on Creating, Connecting and Collaborating through Computing)  		2006.  	 
\bibitem[Chadwick ()]{b1}\label{b1} 	 		 			David Chadwick 		.  		 \url{http://sec.cs.kent.ac.uk/download/X509pmiNATO.pdf}  		\textit{The X.509 Privilege Management Infrastructure},  				2002.  	 
\bibitem[Alfieri et al. (2005)]{b7}\label{b7} 	 		‘From gridmap-file to VOMS: managing authorization in a Grid environment’.  		 			R Alfieri 		,  		 			R Cecchini 		,  		 			V Ciaschini 		,  		 			L Dell'agnello 		,  		 			A Frohner 		,  		 			K Lorentey 		,  		 			F Spataro 		.  	 	 		\textit{Future Generation Computer Systems}  		Apr. 2005. 21  (4)  p. .  	 
\bibitem[Zhou and Meinel ()]{b6}\label{b6} 	 		‘Implement Role based access control with attribute certificates’.  		 			Wei Zhou 		,  		 			Christoph Meinel 		.  	 	 		\textit{The 6th IEEE International Conference on Advanced Communication Technology},  				2004. p. .  	 
\bibitem[Chadwick et al.]{b2}\label{b2} 	 		\textit{Role-Based Access Control},  		 			David W Chadwick 		,  		 			Alexander Otenko 		,  		 			Edward Ball 		.  		 with X.509.  		 	 
\bibitem[Cantor (2004)]{b5}\label{b5} 	 		\textit{Shibboleth Architecture, Protocols and Profiles},  		 			S Cantor 		.  		 \url{http://shibboleth.internet2.edu/}  		22 September 2004.  	 	 (Working Draft 02) 
\bibitem[Hanarejos ()]{b4}\label{b4} 	 		‘Web-based Authorization based on X.509 Privilege Management Infrastructure’.  		 			J 		,  		 			M F Hanarejos 		.  	 	 		\textit{IEEE Pacific Rim Conference on Communications, Computers and signal Processing},  				2003.  	 
\end{bibitemlist}
 			 		 	 
\end{document}
