Efficient Bottom-Up Mining of Attribute Based Access Control Policies

Abstract

Attribute Based Access Control (ABAC) is fast replacing traditional access control models due to its dynamic nature, flexibility and scalability. ABAC is often used in collaborative environments. However, a major hurdle to deploying ABAC is to precisely configure the ABAC policy. In this paper, we present an ABAC mining approach that can automatically discover the appropriate ABAC policy rules. We first show that the ABAC mining problem is equivalent to identifying a set of functional dependencies in relational databases that cover all of the records in a table. We also propose a more efficient algorithm, called ABAC-SRM which discovers the most general policy rules from a set of candidate rules. We experimentally show that ABAC-SRM is accurate and significantly more efficient than the existing state of the art.

Leveraging cloud computing for the semantic web: review and trends

“…Entities in the context will be annotation data, web documents and users. With Attribute-Based Access Control (ABAC), annotation data attributes are signed to security tokens which matches them with document or consumer attributes to either grant or deny access to an instance of annotation data (Talukdar et al, 2017). However, this is still based on the validity of a web document utilising an instance of annotation data previously generated for another document.…”

Enabling the Deployment of ABAC Policies in RBAC Systems

“…In this section, we briefly present the attribute based access control (ABAC) model [1,12] and the Role Based Access Control model [7], upon which all of the following work is based. In ABAC, the authorization to perform an operation (e.g.,read/write/modify) is granted based on the attributes of the requesting user, requested object, and the environment in which a request is made.…”

“…First, a synthetic ABAC policy base ( Π A ) is created. For creating synthetic ABAC Policies we used the data generator used by Talukdar et al [12]. Next, using the ABAC policy base and the User Attribute relation (UAR) and Object Attribute Relation (OAR), the (UPA) relation is created, on which Role Mining is done on the (UPA) relation to create the User Assignment (UA) and Role Assignment (PA) relation.…”

Using Gini Impurity to Mine Attribute-based Access Control Policies with Environment Attributes

“…While there is some work on mining ABAC policies [3] [5], and also on constrained versions of the ABAC policy mining problem [2], to the best of our knowledge, this is the first attempt towards formulating and solving ABAC policy mining problem which involves environment attributes.…”