Security Analysis of Unified Access Control Policies
- 36 Downloads
In the modern computing era, access to resources is often restricted through contextual information and the attributes of users, objects and various other entities. Attribute-Based Access Control (ABAC) can capture those requirements as a policy, but it is not yet adopted like Role Based Access Control (RBAC) due to lack of a comprehensive administrative model. In the last few years, several efforts have been made to combine ABAC with RBAC, but they are limited to specification and enforcement only. Recently, we have presented a unified framework along with a role based administrative model that enables specification, enforcement and maintenance of unified access control policies, such as ABAC, RBAC and Meta-Policy Based Access Control (MPBAC). This paper describes role-based administrative model components and then present a methodology which uses a fixed-point based approach for verifying the security properties (like safety and liveness) of those policies in the presence of the administrative model. We also analyse the impact of ABAC, RBAC, MPBAC and administrative model components on the time taken for security analysis. Experimental results demonstrate that the proposed approach is scalable as well as effective.
KeywordsSecurity analysis Fixed-point analysis Attribute Based Access Control Role Based Access Control Meta-Policy Based Access Control
Research reported in this publication was supported by the National Institutes of Health under award R01GM118574 and by the National Science Foundation under awards CNS-1564034, CNS-1624503, and CNS-1747728. The content is solely the responsibility of the authors and does not necessarily represent the official views of the agencies funding the research.
- 2.Singh, M.P., Sural, S., Atluri, V., Vaidya, J., Yakub, U.: Managing multi-dimensional multi-granular security policies using data warehousing. In: Qiu, M., Xu, S., Yung, M., Zhang, H. (eds.) NSS 2015. LNCS, vol. 9408, pp. 221–235. Springer, Cham (2015). https://doi.org/10.1007/978-3-319-25645-0_15CrossRefGoogle Scholar
- 3.Hu, V.C., et al.: Guide to Attribute Based Access Control (ABAC) Definition and Considerations. NIST Special Publication (2014)Google Scholar
- 5.Aich, S., Mondal, S., Sural, S., Majumdar, A.K.: Role based access control with spatiotemporal context for mobile applications. In: Gavrilova, M.L., Tan, C.J.K., Moreno, E.D. (eds.) Transactions on Computational Science IV. LNCS, vol. 5430, pp. 177–199. Springer, Heidelberg (2009). https://doi.org/10.1007/978-3-642-01004-0_10CrossRefGoogle Scholar
- 8.Mondal, S., Sural, S., Atluri, V.: Towards formal security analysis of GTRBAC using timed automata. In: Proceedings of the 14th ACM Symposium on Access Control Models and Technologies, pp. 33–42 (2009)Google Scholar
- 11.Jin, X., Krishnan, R., Sandhu, R.: Reachability analysis for role based administration of attributes. In: Proceedings of the 2013 ACM Workshop on Digital Identity Management, pp. 73–84 (2013)Google Scholar
- 13.Mondal, S., Sural, S.: Security analysis of temporal-RBAC using timed automata. In: Proceedings of the 4th International Conference on Information Assurance and Security, pp. 37–40 (2008)Google Scholar
- 15.Ferraiolo, D., Atluri, V.: A meta model for access control: why is it needed and is it even possible to achieve? In: Proceedings of the 13th ACM Symposium on Access Control Models and Technologies, pp. 153–154 (2008)Google Scholar
- 16.Jha, S., Sural, S., Vaidya, J., Atluri, V.: Temporal RBAC security analysis using logic programming in the presence of administrative policies. In: Prakash, A., Shyamasundar, R. (eds.) ICISS 2014. LNCS, vol. 8880, pp. 129–148. Springer, Cham (2014). https://doi.org/10.1007/978-3-319-13841-1_8CrossRefGoogle Scholar
- 17.Jha, S., Sural, S., Atluri, V., Vaidya, J.: An administrative model for collaborative management of ABAC systems and its security analysis. In: Proceedings of the 2016 IEEE 2nd International Conference on Collaboration and Internet Computing, pp. 64–73 (2016)Google Scholar
- 18.Uzun, E., Atluri, V., Sural, S., Madhusudan, P.: Analyzing temporal role-based access control models. In: Proceedings of the 12th ACM Symposium on Access Control Models and Technologies, pp. 177–186 (2012)Google Scholar