Using Expert Systems to Statically Detect "Dynamic" Conflicts in XACML

Stepien, Bernard; Felty, Amy P.

doi:10.1109/ares.2016.22

Cited by 3 publications

(3 citation statements)

References 16 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Policy conflicting affect the systems' security as malicious users can easily exploit the vulnerability to access the system. In literature, many studies have addressed the problem of policy conflicting [9], [10], [11], [12], [13], [14]. These solutions include: using expert system [10], modifying (edit, insert, revoke) policy/rule at the collision area [9], [14], using algebraic solutions [11], using Bayesian Network [12], [13].…”

Section: B Policy Conflict Resolutionmentioning

confidence: 99%

“…In literature, many studies have addressed the problem of policy conflicting [9], [10], [11], [12], [13], [14]. These solutions include: using expert system [10], modifying (edit, insert, revoke) policy/rule at the collision area [9], [14], using algebraic solutions [11], using Bayesian Network [12], [13]. Furthermore, XACML 3.0-based approaches rely on the combining algorithm between policies and rules as in [15], [16], [17], [18], [19].…”

Section: B Policy Conflict Resolutionmentioning

confidence: 99%

See 1 more Smart Citation

Towards a Fine-Grained Access Control Mechanism for Privacy Protection and Policy Conflict Resolution

Son¹,

Chen²

2019

ijacsa

View full text Add to dashboard Cite

Access control is a security technique that specifies access rights to resources in a computing environment. As information systems nowadays become more complex, it plays an important role in authenticating and authorizing users and preventing an attacker from targeting sensitive information. However, no proper consideration has been fully investigated so far in privacy protection. While many studies have acknowledged this issue, recent studies have not provided a fine-grained access control system for data privacy protection. As the data set becomes larger, we have to confront more privacy challenges. For example, the access control mechanism must be able to guarantee fine-grained access control, privacy protection, conflicts and redundancies between rules of the same policy or between different policies. In this paper, we propose a comprehensive framework for enforcing attribute-based security policies stored in the JSON document together with the feature of data privacy protection and incorporates a policy structure based on the prioritization of functions to resolve conflicts at a fine-grained level called "Privacy aware access control model for policy conflict resolution". We also use Polish notation for modeling conditional expressions which are the combination of subject, action, resource, and environment attributes so that privacy policies are flexible, dynamic and fine-grained. Experiments are carried out to two aspects (i) illustrate the relationship between the processing time for access decision and the complexity of policies; (ii) illustrate the relationship between the processing time for the traditional approach (single policy, multi-policy without priority) and our approach (multi-policy with priority). Experimental results show that the evaluation performance satisfies the privacy requirements defined by the user.

show abstract

Section: B Policy Conflict Resolutionmentioning

confidence: 99%

Section: B Policy Conflict Resolutionmentioning

confidence: 99%

Towards a Fine-Grained Access Control Mechanism for Privacy Protection and Policy Conflict Resolution

Son¹,

Chen²

2019

ijacsa

View full text Add to dashboard Cite

show abstract

“…On the other hand, [8,37] consider representing XACML policies as decision trees to detect and resolve conflicts and redundancies. Another representation of XACML policies was proposed by [19]. it represents the XACML using Prolog which uses constraint logic programming techniques (CLP), which are welladapted to hierarchical XACML policy logic and avoid pair-wise comparisons altogether by taking advantage of Prolog's built-in powerful indexing system.…”

Section: Related Work and Contributionsmentioning

confidence: 99%

Formal Approach to Detect and Resolve Anomalies while Clustering ABAC Policies

Hadj¹,

Khoumsi²,

Benkaouz³

et al. 2018

ICST Transactions on Security and Safety

View full text Add to dashboard Cite

In big data environments with big number of users and high volume of data, we need to manage the corresponding huge number of security policies. Using Attribute-Based Access Control (ABAC) model to ensure access control might become complex and hard to manage. Moreover, ABAC policies may be aggregated from multiple parties. Therefore, they may contain several anomalies such as conflicts and redundancies, resulting in safety and availability problems. Several policy analysis and design methods have been proposed. However, most of these methods do not preserve the original policy semantics. In this paper, we present an ABAC anomaly detection and resolution method based on the access domain concept, while preserving the policy semantics. To make the suggested method scalable for large policies, we decompose the policy into clusters of rules, then the method is applied to each cluster. We prove correctness of the method and evaluate its computational complexity. Experimental results are given and discussed.

show abstract

A Survey on Empirical Security Analysis of Access-control Systems: A Real-world Perspective

Parkinson

Khan

2022

ACM Comput. Surv.

View full text Add to dashboard Cite

There any many different access-control systems, yet a commonality is that they provide flexible mechanisms to enforce different access levels. Their importance in organisations to adequately restrict resources, coupled with their use in a dynamic environment, mandates the need to routinely perform policy analysis. The aim of performing analysis is often to identify potential problematic permissions, which have the potential to be exploited and could result in data theft and unintended modification. There is a vast body of published literature on analysing access-control systems, yet as performing analysis has a strong end-user motivation and is grounded in security challenges faced in real-world systems, it is important to understand how research is developing, what are the common themes of interest, and to identify key challenges that should be addressed in future work. To the best of the authors’ knowledge, no survey has been performed to gain an understanding of empirical access-control analysis, focussing on how techniques are evaluated and how they align to the needs of real-world analysis tasks. This article provides a systematic literature review, identifying and summarising key works. Key findings are identified and discussed as areas of future work.

show abstract

Using Expert Systems to Statically Detect "Dynamic" Conflicts in XACML

Cited by 3 publications

References 16 publications

Towards a Fine-Grained Access Control Mechanism for Privacy Protection and Policy Conflict Resolution

Towards a Fine-Grained Access Control Mechanism for Privacy Protection and Policy Conflict Resolution

Formal Approach to Detect and Resolve Anomalies while Clustering ABAC Policies

A Survey on Empirical Security Analysis of Access-control Systems: A Real-world Perspective

Contact Info

Product

Resources

About