generalized attribute centric access control

Generalized Attribute Centric Access Control

Arjumand Fatima, December 12, 2014

Thesis Proposal Defense

02/04/15Department of Computing, School of Electrical Engineering and Computer Sciences, NUST -

Islamabad2

Supervisor:

Dr. Abdul Ghafoor

GEC:

Dr. M. Awais ShibliMr. Faisal KhanMs. Hirra Anwar

Arjumand Fatima

Thesis Proposal DefenseSEECS-NUST Islamabad

Generalized Attribute Centric Access Control

Department of Computing, School of Electrical Engineering and Computer Sciences, NUST -

Islamabad

Problem Statement Introduction Literature Review Proposed Solution Abstract Architecture Impact Applications References

3

Agenda


Islamabad

Achieving completely mediated access control using existing models is a challenge in dynamic environments, where ensuring privacy and anonymity is essential, and fine-grained, flexible and multi-factor authorization is required.

4

Problem Statement


Islamabad

Controlling access to sensitive resources

Access is controlled based on different factors such as identity, role and attributes

5

Introduction


Islamabad

Evolution of Access Control Role-Based Access Control (RBAC) Limitations of Traditional Access Control Models Addressing the Limitations of Traditional Access Control

Models• Extended Role Based Access Control Models• Attribute Based Access Control (ABAC) Model

Extended RBAC Models and their limitations Attribute Based Access Control (ABAC) Model The Conventional Debate: RBAC vs ABAC

6

Literature Review

1996 20011992 2007 2009 - 2014

PreRBAC

Early RBAC

StandardRBAC

Pre ABAC

Extended RBAC

Early ABAC

RBACvs ABAC

Role Centric Attribute CentriC

MAC

DAC

Evolution of Access Control


Islamabad

8

Role Based Access Control

OPS OBS

PRMS

ROLESUSERS

SSD

DSDSESSIONS

(UA)User

Assignment

(PA)Permission

Assignment

(RH)Role Hierarchy

Session rolesUser SessionOBS = ObjectsOPS = OperationsPRMS = PermissionsSSD= Separation of DutyDSD = Dynamic Separation of Duty


Islamabad

Limitations of RBAC

Role Engineering Role Activation Role Engineering


Islamabad

11

Challenges in Traditional Access Control

Access Control ModelsU

ser

Cen

tric

Rigid

Stati

c One Time

Identity Based

Coarse

Grained

Context Insensitive

Single Factor


Islamabad

Context Sensitivity

02/04/15 13Department of Computing, School of Electrical Engineering and Computer Sciences, NUST -

Islamabad

Context Sensitive Access Control

Context Based Access Control Context Aware Access Control

Inherently context sensitive Attribute Based Access Control (ABAC) Model

Extensions built on top of a context insensitive model Extended Role Based Access Control (RBAC) Models


Islamabad

Extended RBAC Models

Team Based Environmental Roles

Time Based Location Based


Islamabad

Limitations of Extended RBAC Models

Role Centric Too Complex Too Specific


Islamabad

16

Challenges in Traditional Access Control

Access Control Models

Rigid One Time

Identity Based

Coarse

Grained

Single Factor


Islamabad

Attribute Based Access Control (ABAC)

Subject Attributes

Res

ourc

e A

ttri

bute

s

Environment

Attributes

Controls access based on the attributes of Subject, Resource as well as Environment. This provides a greater flexibility for making access control decisions as compared to traditional methods which were mostly subject-centric and did not consider resource or environment as the primary factor.


Islamabad

The Conventional Debate

RBAC Model

ABAC Model


Islamabad

The Conventional Debate

ABAC RBAC

• Newer• Simpler to implement• Attribute-Centric• Dynamically changing environments• Attribute Engineering• Difficult to audit permissions

• Outdated• Expensive to implement• Role-Centric• Static environments• Role Engineering• Simplified auditing of resources


Islamabad

Adding Attributes To Role Based Access Control

Option User ID Role Attribute Model

0 0 0 0 Undefined

1 0 0 1 ABAC-basic

2 0 1 0 Undefined

3 0 1 1 ABAC-RBAC hybrid

4 1 0 0 ACL

5 1 0 1 ABAC-ID

6 1 1 0 RBAC-basic

7 1 1 1 RBAC-A dynamic roles

8 1 1 1 RBAC-A role centric

9 1 1 1 RBAC-A attribute centric

• Assigning permissions to roles

• Adding further constraints based on attributes

• Still role centric


Islamabad

Need Analysis Existing Work on Attribute Centric Solution Common Misconceptions Our Contribution

Core Components Access Control Mechanism Family of Access Control Models

Potential Impact Validity of Proposed Solution

21

Proposed Solution


Islamabad

Attribute Centric Access Control (AC)2

Role-Less Environments Anonymous Users

Flexible

On-Going Control

Fine GrainedMulti-Factor


Islamabad

Existing Work on Attribute Centric Solutions

Attribute Based Access Control (ABAC) Model Already exists but still in nascent state


Islamabad

Existing Work on Attribute Centric Solutions

Lack of Standard Before 2014 Details Still Missing


Islamabad

Common Misconceptions

ABAC

Myth

RBAC

Attribute

Role

Reality


Islamabad

Common Misconceptions

Myth Reality

• Auditing permissions is easy in RBAC• Reviewing permissions is difficult in ABAC

• User-Role review is easy• Permission-Role review is challenging• We need to divide permission

auditing into smaller tasks for ABAC as well

• ABAC Model offers fine-grained access control

• ABAC Model offers multi-factor access control


Islamabad

Achieving completely mediated access control using existing models is a challenge in dynamic environments, where ensuring privacy and anonymity is essential, and fine-grained, flexible and multi-factor authorization is required.

27

Problem Statement


Islamabad

Generalized Attribute Centric Access Control Subject Object Environment Operation Rules Permissions

28

Our Contribution

Inherently context sensitive attributes

<Action, User, Object, Environment> Ɛ Rule

<Rule(s)> Ɛ Permission

Where Rule= {Allow, Do not Allow}


Islamabad

29

Our Contribution

UserResource

Access Request

PDPPolicy Repository

Find applicable policy

PAP

Store policies

PIP

Retrieve attributes

Environment attribute authority

Resource attribute authoritySubject

attribute authority

Access Response

Allow or deny accessPEP

Access Request


Islamabad

Our Contribution

Context Attribute Authority

Context Provider

Sensors

Context Provider Context Provider

Sensors Sensors


Islamabad

31

Our Contribution

Attribute Centric Access Control

Constrained (AC)2

Fine Grained(AC)2

Core (AC)2

Towards A Family of Access Control Models


Islamabad

32

Potential Impact

Interoperability Across Access Control Solutions Compliance and Assurance


Islamabad

33

Validity

NIST ABAC Workshop,July 2013

Guide to Attribute Based Access Control (ABAC) Definition and Considerations,January 2014

SACMAT 2015Call for PapersTreating ABAC

as a single model would

be a mistake.

Towards an ABAC Family of Models


Islamabad

34

Potential Applications

Small Teams with Overlapping Responsibilities (SMEs / SMBs)


Islamabad

35


Bring Your Own Device (BYOD) Security

Authorization Challenges


Islamabad

36


Smart Classrooms (BYOD)


Islamabad

37


Restrictive Use of Corporate Devices For Personal Use


Islamabad

38

Timeline

Literature Review

TH-1 Form Submission

Problem Identification

Proposal Defense

TH-2 Form Submission (15. 12. 2014)

Implementation (31. 3. 2015)Testing and Evaluation (30. 4.2015)

Research Paper Writing(10.5.2015)

In-house Defense (15.5.2015)

Final Defense (15.6.2015)


Islamabad

1. Park, Jaehong, and Ravi Sandhu. "Towards usage control models: beyond traditional access control." Proceedings of the seventh ACM symposium on Access control models and technologies. ACM, 2002.

2. Sandhu, Ravi S., and Pierangela Samarati. "Access control: principle and practice." Communications Magazine, IEEE 32.9 (1994): 40-48.

3. Hwang, JeeHyun, Vincent Hu, and Tao Xie. "Paradigm in Verification of Access Control." Software Security and Reliability Companion (SERE-C), 2012 IEEE Sixth International Conference on. IEEE, 2012.

4. Hu, Vincent C., et al. "Guide to attribute based access control (ABAC) definition and considerations (draft)." NIST Special Publication 800 (2013): 162.

5. Sandhu, Ravi S. "Lattice-based access control models." Computer 26.11 (1993): 9-19.

6. Fuchs, Ludwig, Günther Pernul, and Ravi Sandhu. "Roles in information security–a survey and classification of the research area." computers & security 30.8 (2011): 748-769.

3. Jin, Xin, Ram Krishnan, and Ravi Sandhu. "A unified attribute-based access control model covering DAC, MAC and RBAC." Data and applications security and privacy XXVI. Springer Berlin Heidelberg, 2012. 41-55.

4. Giuri, Luigi, and Pietro Iglio. "Role templates for content-based access control." Proceedings of the second ACM workshop on Role-based access control. ACM, 1997.

5. Al-Kahtani, Mohammad A., and Ravi Sandhu. "Induced role hierarchies with attribute-based RBAC." Proceedings of the eighth ACM symposium on Access control models and technologies. ACM, 2003.

6. Ferraiolo, David F., et al. "Proposed NIST standard for role-based access control." ACM Transactions on Information and System Security (TISSEC) 4.3 (2001): 224-274.

39

References


Islamabad

11. INCITS, ANSI. "INCITS 359-2004. Role-Based Access Control." American Nat’l Standard for Information Technology (2004).

12. Sandhu, Ravi, David Ferraiolo, and Richard Kuhn. "The NIST model for role-based access control: towards a unified standard." ACM workshop on Role-based access control. Vol. 2000. 2000.

12. Fuchs, Ludwig, and Günther Pernul. "HyDRo–Hybrid Development of Roles." Information Systems Security. Springer Berlin Heidelberg, 2008. 287-302.

13. Wang, Lingyu, Duminda Wijesekera, and Sushil Jajodia. "A logic-based framework for attribute based access control." Proceedings of the 2004 ACM workshop on Formal methods in security engineering. ACM, 2004.

14. Lang, Bo, et al. "A flexible attribute based access control method for grid computing." Journal of Grid Computing 7.2 (2009): 169-180.

15. Covington, Michael J., et al. "Securing context-aware applications using environment roles." Proceedings of the sixth ACM symposium on Access control models and technologies. ACM, 2001.

16. Hansen, Frode, and Vladimir Oleshchuk. "SRBAC: A spatial role-based access control model for mobile systems." Proceedings of the 7th Nordic Workshop on Secure IT Systems (NORDSEC’03). 2003.

17. Yuan, Eric, and Jin Tong. "Attributed based access control (ABAC) for web services." Web Services, 2005. ICWS 2005. Proceedings. 2005 IEEE International Conference on. IEEE, 2005.

18. Wang, Qihua, et al. "On the correctness criteria of fine-grained access control in relational databases." Proceedings of the 33rd international conference on Very large data bases. VLDB Endowment, 2007.

19. Fischer, Jeffrey, et al. "Fine-grained access control with object-sensitive roles." ECOOP 2009–Object-Oriented Programming. Springer Berlin Heidelberg, 2009. 173-194.

40

References


Islamabad

20. Fischer, Jeffrey, et al. "Fine-grained access control with object-sensitive roles." ECOOP 2009–Object-Oriented Programming. Springer Berlin Heidelberg, 2009. 173-194.

21. Tolone, William, et al. "Access control in collaborative systems." ACM Computing Surveys (CSUR) 37.1 (2005): 29-41.

22. Goyal, Vipul, et al. "Attribute-based encryption for fine-grained access control of encrypted data." Proceedings of the 13th ACM conference on Computer and communications security. ACM, 2006.

23. Al-Muhtadi, Jalal, et al. "Cerberus: a context-aware security scheme for smart spaces." Pervasive Computing and Communications, 2003.(PerCom 2003). Proceedings of the First IEEE International Conference on. IEEE, 2003.

24. Hulsebosch, R. J., et al. "Context sensitive access control." Proceedings of the tenth ACM symposium on Access control models and technologies. ACM, 2005.

25. http://www.oxforddictionaries.com/definition/english/context?searchDictCode=all

26. di Vimercati, S. De Capitani, Sara Foresti, and Pierangela Samarati. "Recent advances in access control." Handbook of Database Security. Springer US, 2008. 1-26.

27. di Vimercati, Sabrina De Capitani, Pierangela Samarati, and Sushil Jajodia. "Policies, models, and languages for access control." Databases in Networked Information Systems. Springer Berlin Heidelberg, 2005. 225-237.

28. Park, Jaehong, and Ravi Sandhu. "The UCON ABC usage control model." ACM Transactions on Information and System Security (TISSEC) 7.1 (2004): 128-174.

29. Coyne, Ed, and Timothy R. Weil. "ABAC and RBAC: Scalable, Flexible, and Auditable Access Management." IT Professional 15.3 (2013): 0014-16.

41

References


Islamabad

Questions ?


Islamabad

Thank You

generalized attribute centric access control

Technology

access control modelsattribute

mediated access control

computer sciences

nust islamabadlimitations

nust islamabadachieving

nust islamabadevolution

agendadepartment of

rbac vs abac