Towards a Top-down Policy Engineering Framework for Attribute-based Access Control

Narouei, Masoud; Khanpour, Hamed; Takabi, Hassan; Parde, Natalie; Nielsen, Rodney D.

doi:10.1145/3078861.3078874

Cited by 30 publications

(12 citation statements)

References 22 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Deep learning was used to identify relevant attributes [1] to mine ABAC policies from natural language. Other methods including classification trees [13], deep recurrent neural network (RNN) [53], K-Nearest Neighbor (KNN) [20], Decision Tree [8,9,71] and Restricted Boltzmann Machine (RBM) model [50] have also been used to mine ABAC policy. The first unsupervised learning-based ABAC mining method used k-modes clustering to mine rules from historical operation data [40].…”

Section: Related Workmentioning

confidence: 99%

Toward Deep Learning Based Access Control

Nobi,

Krishnan,

Huang

et al. 2022

Preprint

View full text Add to dashboard Cite

A common trait of current access control approaches is the challenging need to engineer abstract and intuitive access control models. This entails designing access control information in the form of roles (RBAC), attributes (ABAC), or relationships (ReBAC) as the case may be, and subsequently, designing access control rules. This framework has its benefits but has significant limitations in the context of modern systems that are dynamic, complex, and large-scale, due to which it is difficult to maintain an accurate access control state in the system for a human administrator. This paper proposes Deep Learning Based Access Control (DLBAC) by leveraging significant advances in deep learning technology as a potential solution to this problem. We envision that DLBAC could complement and, in the long-term, has the potential to even replace, classical access control models with a neural network that reduces the burden of access control model engineering and updates. Without loss of generality, we conduct a thorough investigation of a candidate DLBAC model, called DLBAC α , using both real-world and synthetic datasets. We demonstrate the feasibility of the proposed approach by addressing issues related to accuracy, generalization, and explainability. We also discuss challenges and future research directions. CCS CONCEPTS• Security and privacy → Access control; • Computing methodologies → Machine learning.

show abstract

Section: Related Workmentioning

confidence: 99%

Toward Deep Learning Based Access Control

Nobi,

Krishnan,

Huang

et al. 2022

Preprint

View full text Add to dashboard Cite

show abstract

“…In the context of deployment of ABAC in organizations, there is some existing work on standardization [12], policy engineering [18] [10] [23] [9], etc. Moreover, procedures have been developed for enabling organizations to migrate to ABAC from other access control models [14].…”

Section: Related Workmentioning

confidence: 99%

PolTree

Nath

Das

Sural

et al. 2019

Proceedings of the 24th ACM Symposium on Access Control Models and Technologies

View full text Add to dashboard Cite

In Attribute-Based Access Control (ABAC), a user is permitted or denied access to an object based on a set of rules (together called an ABAC Policy) specified in terms of the values of attributes of various types of entities, namely, user, object and environment. Efficient evaluation of these rules is therefore essential for ensuring decision making at on-line speed when an access request comes. Sequentially evaluating all the rules in a policy is inherently time consuming and does not scale with the size of the ABAC system or the frequency of access requests. This problem, which is quite pertinent for practical deployment of ABAC, surprisingly has not so far been addressed in the literature. In this paper, we introduce two variants of a tree data structure for representing ABAC policies, which we name as PolTree. In the binary version (B-PolTree), at each node, a decision is taken based on whether a particular attribute-value pair is satisfied or not. The n-ary version (N-PolTree), on the other hand, grows as many branches out of a given node as the total number of possible values for the attribute being checked at that node. An extensive experimental evaluation with diverse data sets shows the scalability and effectiveness of the proposed approach.

show abstract

“…They also include the environment attributes while mining the policy. Narouei et al [14] propose a top-down policy engineering framework for ABAC that extracts policies from unrestricted natural language documents using a deep recurrent neural network.…”

Section: Related Workmentioning

confidence: 99%

HyPE: A Hybrid Approach toward Policy Engineering in Attribute-Based Access Control

Das

Sural

Vaidya

et al. 2018

IEEE Lett. of the Comput. Soc.

View full text Add to dashboard Cite

Successful deployment of attribute-based access control requires the process of policy engineering which involves constructing a set of appropriate rules, known as a policy. Policy engineering is performed either by a top-down approach that may ignore some of the existing accesses in the organization or a bottom-up approach that may form rules which are not relevant to the organizational processes. In this work, we propose a hybrid approach toward policy engineering that addresses the limitations of the top-down and the bottom-up approaches while preserving their individual advantages.

show abstract

Towards a Top-down Policy Engineering Framework for Attribute-based Access Control

Cited by 30 publications

References 22 publications

Toward Deep Learning Based Access Control

Toward Deep Learning Based Access Control

PolTree

HyPE: A Hybrid Approach toward Policy Engineering in Attribute-Based Access Control

Contact Info

Product

Resources

About