Challenges in Engineering Self-Adaptive Authorisation Infrastructures

Abstract

As organisations expand and interconnect, authorisation infrastructures become increasingly difficult to manage. Several solutions have been proposed, including self-adaptive authorisation, where the access control policies are dynamically adapted at run-time to respond to misuse and malicious behaviour. The ultimate goal of self-adaptive authorisation is to reduce human intervention, make authorisation infrastructures more responsive to malicious behaviour, and manage access control in a more cost effective way. In this paper, we scope and define the emerging area of self-adaptive authorisation by describing some of its developments, trends and challenges. For that, we start by identifying key concepts related to access control and authorisation infrastructures, and provide a brief introduction to self-adaptive software systems, which provides the foundation for investigating how self-adaptation can enable the enforcement of authorisation policies. The outcome of this study is the identification of several technical challenges related to self-adaptive authorisation, which are classified according to the different stages of a feedback control loop.

Malicious changeload for the resilience evaluation of self-adaptive authorisation infrastructures

“…Self-adaptive systems are able to modify their behaviour and/or structure in response to changes that occur to the system, its environment, or even its goals [26]. A self-adaptive authorisation infrastructure is a selfadaptive system tailored to adapt, at run-time, access control policies and their enforcement [30]. An important aspect when evaluating the resilience of a self-adaptive authorisation infrastructure is to demonstrate its ability to mitigate abuse in access control.…”