Inconsistency detection method for access control policies

Abstract

In enterprise environments, the task of assigning access control rights to subjects for resources is not trivial. Because of their complexity, distribution and size, access control policies can contain anomalies such as inconsistencies, which can result in security vulnerabilities. A set of access control policies is inconsistent when, for specific situations different incompatible policies can apply. Many researchers have tried to address the problem of inconsistency using methods based on formal logic. However, this approach is difficult to implement and inefficient for large policy sets. Therefore, in this paper, we propose a simple, efficient and practical solution for detecting inconsistencies in access control policies with the help of a modified C4.5 data classification algorithm.

Automated and Efficient Analysis of Role-Based Access Control with Attributes

“…Several works [29,1,22,12,11,8,20] have proposed techniques to detect inconsistencies and redundancies in XACML or extensions of RBAC policies by leveraging a variety of verification engines. None of these works provides decidability and complexity results of the analysis techniques as we do in this paper.…”

Work-Based Access Control Model for Cooperative Healthcare Environments: Formal Specification and Verification

“…The complexity of access control policy revision is dependent on a number of factors, such as the number of users, number of roles, and number of resources. Due to these factors, one important aspect is to guarantee policy completeness [57] and consistency [58].…”

Challenges of Composing XACML Policies

“…Trees Decision trees [12] are well-known for expressing access control logic [14] [16]. They are in fact the most efficient representation from the point of view of request processing by a PDP, since a subtree will be explored only if its parent edge satisfies the request.…”

“…Currently the policy compression algorithm from [9] cannot handle such cases. Solutions to include absent attributes are proposed in [16] where they are called missing attributes. However, the use of such an approach is for further study.…”