Towards an Automatic Top-down Role Engineering Approach Using Natural Language Processing Techniques

Abstract

Role Based Access Control (RBAC) is the most widely used model for access control due to the ease of administration as well as economic benefits it provides. In order to deploy an RBAC system, one requires to first identify a complete set of roles. This process, known as role engineering, has been identified as one of the costliest tasks in migrating to RBAC. In this paper, we propose a top-down role engineering approach and take the first steps towards using natural language processing techniques to extract policies from unrestricted natural language documents. Most organizations have high-level requirement specifications that include a set of access control policies which describes allowable operations for the system. However, it is very time consuming, labor-intensive, and errorprone to manually sift through these natural language documents to identify and extract access control policies. Our goal is to automate this process to reduce manual efforts and human errors. We apply natural language processing techniques, more specifically semantic role labeling to automatically extract access control policies from unrestricted natural language documents, define roles, and build an RBAC model. Our preliminary results are promising and by applying semantic role labeling to automatically identify predicate-argument structure, and a set of predefined rules on the extracted arguments, we were able correctly identify access control policies with a precision of 75%, recall of 88%, and F1 score of 80%.

Automated extraction of attributes from natural language attribute-based access control (ABAC) Policies

“…1. Several studies have researched challenges and opportunities faced by natural language processing (NLP) applications in the automation of the second phase of the cycle, named "gather authorization requirements" (Xiao et al 2012;Slankas and Williams 2013;Slankas et al 2014;Narouei and Takabi 2015a). Our work complements these prior efforts to aid security architects in the process of deriving required attributes from natural language authorization requirements, which is the third phase of the lifecycle.…”

“…This boost of recall, however, comes at the cost of precision. While we are aware that the lack of benchmark dataset makes the comparison task non-trivial, the reported results suggest that a combination of policy extraction approaches by Slankas et al (2014) and Narouei and Takabi (2015a) can potentially balance both precision and recall values. Further, Narouei et al (2018) investigated the idea of improving SRL performance using domain adaptation techniques.…”

“…The necessity to automate this manual process has motivated several studies in developing automated tools to derive elements of access control rules directly from natural language policies (Xiao et al 2012;Slankas and Williams 2013;Slankas et al 2014;Narouei and Takabi 2015a). Prior research efforts have mostly been restricted to two areas: (1) automatic identification of the access control policy sentences from natural language artifacts, and (2) automatic extraction of the subject, object and action triples from these sentences.…”

Access Control Role Evolution Mechanism for Open Computing Environment

“…The algorithm described the relationship among roles by attribute information. Narouei et al [32] proposed a novel top-down role engineering approach that used natural language processing techniques to extract roles from documents. Kumar et al [33] proposed a constrained role mining scheme (CRM).…”

Identification of Access Control Policy Sentences from Natural Language Policy Documents

“…In our previous work, we proposed semantic role labeling (SRL) to automatically extract ACP elements from unrestricted natural language documents, define roles, and build an RBAC model [20]. We did not attempt to identify ACP sentences, but instead used the already extracted sentences by [25] and left implementing the ACP sentence identification step for future work.…”