Attribute based access control constraint based on subject similarity

Helil, Nurmamat; Rahman, Kaysar

doi:10.1109/wartia.2014.6976238

Cited by 4 publications

(6 citation statements)

References 8 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…� d(ar j ))∧(op(ar i )∩op(ar j )! � ∅) then (10) for each ap inS ap i orO ap i of ar i do (11) for each ap' inS ap j orO ap j of ar j do (12) if (att(ap) � � att(ap'))∧(ap∩ap' � � ∅) then (13) continue; (14) else (15) CP�CP∪{(ar i , ar j )}; (16) calculate Prob(ar i , ar j ); (17) end if (18) end for (19) end for (20) end if (21) end for ALGORITHM 1: Novel method of conflict detection.…”

Section: Performance Evaluations For the Conflict Detectionsmentioning

confidence: 99%

“…To address this problem while uniformly specifying various types of ABAC constraints, Bijon et al [20] proposed the attribute-based constraint specification language (ABCL). Based on the subject similarity, Helil and Rahman [21] used the ABAC constraint to check and determine the potential relationships between different entities. To further specify and verify the SoD constraints in ABAC systems, Jha et al [22] presented a novel approach for analyzing the complexity of enforcing the SOD constraints.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Attribute-Based Policy Evaluation Using Constraints Specification Language and Conflict Detections

Sun

2022

Mobile Information Systems

View full text Add to dashboard Cite

Attribute-based access control (ABAC) has attracted widespread interest and has become an ideal mechanism due to its flexibility characteristic and the powerful expressiveness for various security policies, such as the separation-of-duty constraint and cardinality constraint. The formulation of appropriate ABAC policies is critical for ensuring system security and robustness. However, conflicts occur frequently in existing state-of-the-art systems. Most conventional detection methods either lack the evaluation of the policy quality or consider no constraint. To resolve these problems, a novel method for the ABAC policy evaluation is proposed in this study. First, to meet diverse organizational requirements, we use the attribute-based constraints specification language to uniformly formulate and specify the conflict relations among attributes and present the satisfiability of conflict relations. Second, to comprehensively detect the conflict problems, we present the evaluation criteria for conflicts on attributes and rules and propose a novel algorithm for detecting conflicts. Last, we validate the effectiveness and efficiency of the proposal through experiments, which demonstrate that it not only improves the policy quality but also reduces the conflicting number and conflicting probability.

show abstract

Section: Performance Evaluations For the Conflict Detectionsmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Attribute-Based Policy Evaluation Using Constraints Specification Language and Conflict Detections

Sun

2022

Mobile Information Systems

View full text Add to dashboard Cite

show abstract

“…In this case, a mutual exclusion constraint over the values of these attribute, namely adjunct and full-time, has to be defined in order to satisfy the given policy. Numerous studies have researched how to specify and enforce such constraints in ABAC systems [2,3,7,11]. To the best of our knowledge, the proposal of Bijon et al is the most comprehensive work to date on constraint specifications in ABAC [2,3].…”

Section: Overview Of Constraints Specifications In Abacmentioning

confidence: 99%

Towards an Automated Extraction of ABAC Constraints from Natural Language Policies

Alohaly¹,

Takabi²,

Blanco³

2019

ICT Systems Security and Privacy Protection

View full text Add to dashboard Cite

Due to the recent trend towards attribute-based access control (ABAC), several studies have proposed constraints specification languages for ABAC. These formal languages enable security architects to express constraints in a precise mathematical notation. However, since manually formulating constraints involves analyzing multiple natural language policy documents in order to infer constraints-relevant information, constraints specification becomes a repetitive, time-consuming and error-prone task. To bridge the gap between the natural language expression of constraints and formal representations, we propose an automated framework to infer elements forming ABAC constraints from natural language policies. Our proposed approach is built upon recent advancements in natural language processing, specifically, sequence labeling. The experiments, using Bidirectional Long-Short Term Memory (BiLSTM), achieved an F1 score of 0.91 in detecting at least 75% of each constraint expression. The results suggest that the proposed approach holds promise for enabling this automation.

show abstract

“…There are quite a few research works on the formal specification of access control constraints [13,16,17,[21][22][23][24]. Crampton [16] analyzed and classified RBAC constraints in detail.…”

Section: Related Workmentioning

confidence: 99%

“…Crampton [16] analyzed and classified RBAC constraints in detail. In our previous works [13,24], we proposed general access control constraints against similar users' successive access to permissions from a sensitive combination of permissions. Joshi et al [21] presented the formal specification of RBAC constraints, therein considering time and location in access control decision-making.…”

Section: Related Workmentioning

confidence: 99%

CP-ABE Access Control Scheme for Sensitive Data Set Constraint with Hidden Access Policy and Constraint Policy

Helil

Rahman

2017

Security and Communication Networks

Self Cite

View full text Add to dashboard Cite

CP-ABE (Ciphertext-Policy Attribute-Based Encryption) with hidden access control policy enables data owners to share their encrypted data using cloud storage with authorized users while keeping the access control policies blinded. However, a mechanism to prevent users from achieving successive access to a data owner’s certain number of data objects, which present a conflict of interest or whose combination thereof is sensitive, has yet to be studied. In this paper, we analyze the underlying relations among these particular data objects, introduce the concept of the sensitive data set constraint, and propose a CP-ABE access control scheme with hidden attributes for the sensitive data set constraint. This scheme incorporates extensible, partially hidden constraint policy. In our scheme, due to the separation of duty principle, the duties of enforcing the access control policy and the constraint policy are divided into two independent entities to enhance security. The hidden constraint policy provides flexibility in that the data owner can partially change the sensitive data set constraint structure after the system has been set up.

show abstract

Attribute based access control constraint based on subject similarity

Cited by 4 publications

References 8 publications

Attribute-Based Policy Evaluation Using Constraints Specification Language and Conflict Detections

Attribute-Based Policy Evaluation Using Constraints Specification Language and Conflict Detections

Towards an Automated Extraction of ABAC Constraints from Natural Language Policies

CP-ABE Access Control Scheme for Sensitive Data Set Constraint with Hidden Access Policy and Constraint Policy

Contact Info

Product

Resources

About