Attribute-based Access Control Policies Research Articles

Combo-Chain: Towards a hierarchical attribute-based access control system for IoT with smart contract and sharding technique

The Internet of Things (IoT) provides a collaborative environment among different entities (i.e., users, IoT devices, sensors, applications, etc.) to access resources. Despite the benefits that IoT technology brings to individuals, society, and industry, this technology faces a critical challenge in controlling access to various resources in IoT environments. To address this challenge, we propose Combo-Chain, an blockchain-based access control system deeply rooted in the concepts of the attribute-based access control (ABAC) model, smart contracts, and sharding. Combo-Chain introduces the concept of hierarchy for both subject attributes and object attributes to enhance flexibility and dynamicity when specifying ABAC policies, simplifying policy and attribute management. It not only manages access policies but also attributes by deploying a set of smart contracts. Furthermore, Combo-Chain utilizes sharding technique to distribute the overhead associated with storing and managing both access policies and attributes. Sharding also helps Combo-Chain to distribute the computational overhead when evaluating access requests among two groups of nodes, addressing the issues of low scalability and poor performance often associated with blockchain technology. Combo-Chain is implemented on a private Ethereum platform, and the experimental results demonstrate the superiority of Combo-Chain compared to existing blockchain-based access control systems.

ABAC Policy Mining through Affiliation Networks and Biclique Analysis

Policy mining is an automated procedure for generating access rules by means of mining patterns from single permissions, which are typically registered in access logs. Attribute-based access control (ABAC) is a model which allows security administrators to create a set of rules, known as the access control policy, to restrict access in information systems by means of logical expressions defined through the attribute–values of three types of entities: users, resources, and environmental conditions. The application of policy mining in large-scale systems oriented towards ABAC is a must because it is not workable to create rules by hand when the system requires the management of thousands of users and resources. In the literature on ABAC policy mining, current solutions follow a frequency-based strategy to extract rules; the problem with that approach is that selecting a high-frequency support leaves many resources without rules (especially those with few requesters), and a low support leads to the rule explosion of unreliable rules. Another challenge is the difficulty of collecting a set of test examples for correctness evaluation, since the classes of user–resource pairs available in logs are imbalanced. Moreover, alternative evaluation criteria for correctness, such as peculiarity and diversity, have not been explored for ABAC policy mining. To address these challenges, we propose the modeling of access logs as affiliation networks for applying network and biclique analysis techniques (1) to extract ABAC rules supported by graph patterns without a frequency threshold, (2) to generate synthetic examples for correctness evaluation, and (3) to create alternative evaluation measures to correctness. We discovered that the rules extracted through our strategy can cover more resources than the frequency-based strategy and perform this without rule explosion; moreover, our synthetics are useful for increasing the certainty level of correctness results. Finally, our alternative measures offer a wider evaluation profile for policy mining.

Microsoft Purview: A System for Central Governance of Data

Modern data estates are spread across data located on premises, on the edge and in one or more public clouds, spread across various sources like multiple relational databases, file and storage systems, and no-SQL systems, both operational and analytic; this phenomenon is referred to as data sprawl. Data administrators who wish to enforce compliance across the entire organization have to inventory their data, identify what parts of it are sensitive, and govern the sensitive data appropriately --- across the entirety of their sprawling data estate. Today, governance of data is completely siloed; each of the data subsystems has its own (and varied) governance features. Policies applied to sensitive data are applied piece-meal by iterating over all the data sources in a custom language specific to each source. This makes data governance cumbersome, error-prone (because a given policy must be manually enforced across different subsystems, inconsistencies can easily arise), and expensive. This paper presents Microsoft Purview , a service for unified governance of the entire data estate of an organization from a single central pane of glass. The Purview service consists of three parts: (1) a Data Map or metadata catalog that is populated by automated scanning of data sources in the organization, (2) a system to store and manage sensitivity classification of data, and (3) a policy system that enables data security officers to author and implement policies that span the entire organization, e.g., a policy that says, "Non-full-time employees should be denied access to data classified as PII (Personally Identifiable Information.") Purview transforms data governance across a complex data estate by offering the ability to govern centrally and automating data discovery, classification and policy enforcement. While other commercial catalog systems also build a global catalog, Purview is unique in its support for policies. It is also distinguished by covering both structured and unstructured data, thanks to its deep integration with Office 365 and its governance framework; indeed, "Microsoft Purview" represents a new unified offering that combines Office 365 governance and what was formerly a service for governing structured data called "Azure Purview". By integrating with Office 365's Rights Management Service, Purview offers central governance over structured data stored in databases and stores, reports in systems such as Power BI, as well as document data stored in Office 365. The Purview vision is to make the metadata in the Data Map increasingly richer through further automation and curation support and to use this 360 degree view of the data estate to support a wide range of governance policies, ranging from access control to lifecycle management (e.g., retention, deletion, restricting data movement). This paper covers the design and implementation challenges in building the Purview service for Attribute-Based Access Control (ABAC) policies, focusing specifically on a detailed description of its integration with Azure SQL Database. We illustrate the power of unifying Office 365 governance with structured data governance through Purview policies that enforce consistent access control even as data flows between Office 365 and structured data engines like Azure SQL Database. We also describe the results of our empirical evaluation of the performance overheads imposed by Purview.

A Framework for Attribute-Based Access Control in Processing Big Data with Multiple Sensitivities

There is an increasing demand for processing large volumes of unstructured data for a wide variety of applications. However, protection measures for these big data sets are still in their infancy, which could lead to significant security and privacy issues. Attribute-based access control (ABAC) provides a dynamic and flexible solution that is effective for mediating access. We analyzed and implemented a prototype application of ABAC to large dataset processing in Amazon Web Services, using open-source versions of Apache Hadoop, Ranger, and Atlas. The Hadoop ecosystem is one of the most popular frameworks for large dataset processing and storage and is adopted by major cloud service providers. We conducted a rigorous analysis of cybersecurity in implementing ABAC policies in Hadoop, including developing a synthetic dataset of information at multiple sensitivity levels that realistically represents healthcare and connected social media data. We then developed Apache Spark programs that extract, connect, and transform data in a manner representative of a realistic use case. Our result is a framework for securing big data. Applying this framework ensures that serious cybersecurity concerns are addressed. We provide details of our analysis and experimentation code in a GitHub repository for further research by the community.

Ether-IoT: A Realtime Lightweight and Scalable Blockchain-Enabled Cache Algorithm for IoT Access Control

Several unique characteristics of Internet of Things (IoT) devices, such as distributed deployment and limited storage, make it challenging for standard centralized access control systems to enable access control in today’s large-scale IoT ecosystem. To solve these challenges, this study presents an IoT access control system called Ether-IoT based on the Ethereum Blockchain (BC) infrastructure with Attribute-Based Access Control (ABAC). Access Contract (AC), Cache Contract (CC), Device Contract (DC), and Policy Contract (PC) are the four central smart contracts (SCs) that are included in the proposed system. CC offers a way to save user characteristics in a local cache system to avoid delays during transactions between BC and IoT devices. AC is the fundamental program users typically need to run to build an access control technique. DC offers a means for storing the resource data created by devices and a method for querying that data. PC offers administrative settings to handle ABAC policies on users’ behalf. Ether-IoT, combined with ABAC and the BC, enables IoT access control management that is decentralized, fine-grained and dynamically scalable. This research gives a real-world case study to illustrate the suggested framework’s implementation. In the end, a simulation experiment is performed to evaluate the system’s performance. To ensure data integrity in dispersed systems, the results show that Ether-IoT can sustain high throughput in contexts with a large number of requests.

Attribute-Based Access Control Policy Generation Approach from Access Logs Based on the CatBoost

Attribute-Based Access Control Policy Generation Approach from Access Logs Based on the CatBoost

A Parallel Secure Flow Control Framework for Private Data Sharing in Mobile Edge Cloud

Nowadays, the rapid development of edge computing is accelerating the data sharing between cloud computing platforms and mobile users. These data often contain sensitive information, which faces severe leakage risks not only from the semi-trusted cloud servers but also from the malicious senders in the organizations. Fortunately, access control encryption (ACE) has been utilized to secure the data with access control policies, in which a sanitizer (e.g., the edge node) is employed to check all the communications between the sender and receiver, and drop illegal ciphertexts according to the access control policy. However, previous schemes have some limitations in mobile edge cloud, e.g., the sender's attributes are not strictly authenticated in the attribute-based access control policy, or the sanitization time is the bottleneck of fast data sharing. To this end, we introduce PSFlow, a parallel secure flow control framework for private data sharing in mobile edge cloud. First, we propose an attribute-based outsourced ACE (AOACE) scheme, which achieves secure fine-grained data read and write control, and reduces the computational cost of the sender and receiver with outsourced computations in edge nodes. Then, we propose a concrete construction of PSFlow from AOACE, and accelerate the sanitization process with parallel computing. Specifically, PSFlow parallelizes the sanitization operations with a multi-server model in each edge node, and optimizes the sanitization efficiency in each edge server by constructing a shared pool from the attribute universe. The experimental results show that PSFlow is more efficient and practical than previous schemes in mobile edge cloud.

A New Attribute-Based Access Control Model for RDBMS

Abstract One of the challenges in Attribute-Based Access Control (ABAC) implementation is acquiring sufficient metadata against entities and attributes. Intelligent mining and extracting ABAC policies and attributes make ABAC implementation more feasible and cost-effective. This research paper focuses on attribute extraction from an existing enterprise relational database management system – RDBMS. The proposed approach tends to first classify entities according to some aspects of RDBMS systems. By reverse engineering, some metadata elements and ranking values are calculated for each part. Then entities and attributes are assigned a final rank that helps to decide what attribute subset is a candidate to be an optimal input for ABAC implementation. The proposed approach has been tested and implemented against an existing enterprise RDBMS, and the results are then evaluated. The approach enables the choice to trade-off between accuracy and overhead. The results score an accuracy of up to 80% with no overhead or 88% of accuracy with 65% overhead.

A Blockchain-Based and SGX-Enabled Access Control Framework for IoT

With the rapid development of physical networks, tens of billions of Internet of Things (IoT) devices have been deployed worldwide. Access control is essential in the IoT system, which manages user access to vital IoT data. However, access control for the IoT is mainly based on centralized trusted servers, which face problems such as a single point of failure and data leakage. To tackle these challenges, we propose an access control framework for the IoT by combining blockchain and Intel software guard extension (SGX) technology. A blockchain validates both IoT devices and edge servers added to the network. The access control contract is deployed on the blockchain, which can manage attribute-based access control policies in a fine-grained manner and make access control decisions flexibly. SGX technology is introduced into the edge computing server to realize the confidentiality of data processing. Finally, we implemented the prototype of the framework on Quorum and conducted extensive experiments and theoretical analyses on the performance of the blockchain. The results of the experimental tests and theoretical analyses show that our framework has more advantages in computing costs and on-chain storage costs.

Contemporaneous Update and Enforcement of ABAC Policies.

Access control policies are dynamic in nature, and therefore require frequent updates to synchronize with the latest organizational security requirements. As these updates are handled, it is important that all user access requests be answered contemporaneously and correctly without any interruption or delay. In this paper, considering the context of Attribute Based Access Control (ABAC), we propose an approach that is capable of immediately materializing any update to the policy and ensuring that it is taken into account for any subsequent access requests. One possibility is to update the policy based on the incoming changes through ABAC policy mining techniques. However, it turns out that no existing mining approach can offer correct enforcement of policies when access requests are entertained during the updates. We provide a formal proof for this surprising result and then propose an approach called δwOP that does not suffer from this problem. Essentially, δwOP keeps track of the needed information from updates and uses this in conjunction with the existing ABAC policy rules to make access decisions. We present the complexity analysis as well as a comprehensive experimental evaluation to demonstrate the efficacy of the proposed approach for different types of changes.

Policychain: A Decentralized Authorization Service With Script-Driven Policy on Blockchain for Internet of Things

Decentralization mechanism provides manufacturers and distributors with greater customization and flexibility they need through IoT-based Industrial Collaboration Systems (IoT-ICS), but it has brought forward security concerns about the shared data-processing tasks and IoT-based access to services and resources. To address them, we propose a practical blockchain solution to achieve decentralized policy management and evaluation on Attribute-based Access Control (ABAC). By offloading the responsibility of ABAC policy administration and decision-making to blockchain nodes, a blockchain-based access control framework, called Policychain, is presented to ensure policy with high availability, autonomy, and traceability. To deliver a solid design, we first present a transaction-oriented policy expression scheme with a well-defined syntax and semantics. The scheme can translate ABAC policies into the blockchain transactions with JavaScript Object Notation (JSON) syntax and Script-based logical expression. We further realize a script-driven policy evaluation by extending blockchain inherent scripting instructions to support attribute acquisition of ABAC entities. Furthermore, we propose a policy lifecycle management scheme from policy creation, renovation, to revocation, in which policies are verified by three validation principles at the transaction level. Finally, we provide sophisticated analysis and experiments to show that our framework is secure and practical for decentralized policy management on ABAC in IoT-ICS.

PAMMELA: Policy Administration Methodology using Machine Learning.

In recent years, Attribute-Based Access Control (ABAC) has become quite popular and effective for enforcing access control in dynamic and collaborative environments. Implementation of ABAC requires the creation of a set of attribute-based rules which cumulatively form a policy. Designing an ABAC policy ab initio demands a substantial amount of effort from the system administrator. Moreover, organizational changes may necessitate the inclusion of new rules in an already deployed policy. In such a case, re-mining the entire ABAC policy requires a considerable amount of time and administrative effort. Instead, it is better to incrementally augment the policy. In this paper, we propose PAMMELA, a Policy Administration Methodology using Machine Learning to assist system administrators in creating new ABAC policies as well as augmenting existing policies. PAMMELA can generate a new policy for an organization by learning the rules of a policy currently enforced in a similar organization. For policy augmentation, new rules are inferred based on the knowledge gathered from the existing rules. A detailed experimental evaluation shows that the proposed approach is both efficient and effective.

Securing utility computing using enhanced elliptic curve cryptography and attribute-based access control policy

Securing utility computing using enhanced elliptic curve cryptography and attribute-based access control policy

Securing utility computing using enhanced elliptic curve cryptography and attribute-based access control policy

Securing utility computing using enhanced elliptic curve cryptography and attribute-based access control policy

Towards Blockchain-Based Secure Storage and Trusted Data Sharing Scheme for IoT Environment

Nowadays, cloud-based storage systems play a vital role in IoT data storage, processing, and sharing. Despite its contribution, the current cloud-based architecture may cause severe data leakage or jeopardize user privacy. Meanwhile, the cloud-based architecture heavily relies on a trusted third-party auditor (TPA) and runs in a centralized control manner. However, the TPA may not be a completely trustworthy entity, and a single point of failure might cause the centralized system to collapse. Fortunately, with the advent of blockchain technology, the decentralized storage model has gained popularity. A decentralized storage system successfully eradicates the rule of TPA, solves the problem of a single point of failure, and has many advantages over a centralized control architecture, such as low storage prices and high throughput. This study offers a blockchain-based decentralized distributed storage and sharing scheme that provides end-to-end encryption and fine-grained access control. In our proposed IoTChain model, fine-grained permission is based on attribute-based access control (A-BAC) policy by employing the Ethereum blockchain as an auditable access control layer. Smart contracts are tailored for the IoTChain model, which combines the Ethereum blockchain and the interplanetary file system (IPFS). We used an advanced encryption standard (AES) for encryption and the elliptic curve Diffie-Hellman key exchange protocol for secret key sharing between data owners and users. Also, the proof-of-work (PoW) consensus mechanism is replaced with a proof-of-authority (PoA) to minimize system transaction cost and boost system throughput. Additionally, our solution has been tested on the Ethereum official test network Rinkeby, and the results demonstrate that our approach is realistic and economical on the IoT data.

An efficient fine-grained data access control system with a bounded service number

In a data access control system oriented toward the cloud storage environment, a data owner defines attribute-based access control policies for data files to realize fine-grained data sharing. However, the existing schemes have defects in user execution efficiency and user privacy protection, and they do not consider the problems of user revocation and attribute updates. To this end, we propose a ciphertext policy attribute-based encryption method with verifiable outsourced decryption; this requires a user to complete decryption with the help of a server, but the results of the outsourced decryption can be verified independently. With this new encryption scheme and the technique of k-times anonymous authentication, a new fine-grained data access control system was constructed; this system allows a server to provide users with outsourced decryption services, and users’ computation cost is independent of the size of the underlying access control policy. Moreover, the number of outsourced decryption requests is limited. In addition, the new system supports user revocation and attribute updates and it is provably secure under formal proofs. An efficiency analysis shows that it can be compared with other similar systems in terms of performance, despite the addition of several practical properties.

The security function dynamic calling scheme for software-defined security

With the rapid development of cloud computing, various network attack methods are becoming more advanced, and the attack speed is getting faster. Traditional security protection solutions can no longer adapt to new network attacks, bringing significant challenges to security protection in virtualized network environments such as cloud computing. Based on these problems, this paper proposes a dynamic calling mechanism of security functions for software-defined security based on software-defined network technology. This mechanism defined the strategies of dynamically scheduling of virtual security service nodes in the virtualized network environment. The strategies describe the network’s data flow and virtual security devices by extending the attribute-based access control policy model. It can dynamically construct the mapping relationship between network flow and virtual security devices according to users’ security requirements, thus forming a personalized security service chain for specific network flows. This mechanism can protect the “north-south” network flow at the IoT edge agent according to the user security business requirements.

SealedGRID: Secure and Interoperable Platform for Smart GRID Applications.

Recent advancements in information and communication technologies (ICT) have improved the power grid, leading to what is known as the smart grid, which, as part of a critical economic and social infrastructure, is vulnerable to security threats from the use of ICT and new emerging vulnerabilities and privacy issues. Access control is a fundamental element of a security infrastructure, and security is based on the principles of less privilege, zero-trust, and segregation of duties. This work addresses how access control can be applied without disrupting the power grid’s functioning while also properly maintaining the security, scalability, and interoperability of the smart grid. The authentication in the platform presumes digital certificates using a web of trust. This paper presents the findings of the SealedGRID project, and the steps taken for implementing Attribute-based access control policies specifically customized to the smart grid. The outcome is to develop a novel, hierarchical architecture composed of different licensing entities that manages access to resources within the network infrastructure. They are based on well-drawn policy rules and the security side of these resources is placed through a context awareness module. Together with this technology, the IoT is used with Big Data (facilitating easy handling of large databases). Another goal of this paper is to present implementation and evaluations details of a secure and scalable security platform for the smart grid.

Incremental Maintenance of ABAC Policies.

Discovery of Attribute Based Access Control policies through mining has been studied extensively in the literature. However, current solutions assume that the rules are to be mined from a static data set of access permissions and that this process only needs to be done once. However, in real life, access policies are dynamic in nature and may change based on the situation. Simply utilizing the current approaches would necessitate that the mining algorithm be re-executed for every update in the permissions or user/object attributes, which would be significantly inefficient. In this paper, we propose to incrementally maintain ABAC policies by only updating the rules that may be affected due to any change in the underlying access permissions or attributes. A comprehensive experimental evaluation demonstrates that the proposed incremental approach is significantly more efficient than the conventional ABAC mining.

An Automatic Attribute-Based Access Control Policy Extraction From Access Logs

With the rapid advances in computing and information technologies, traditional access control models have become inadequate in terms of capturing fine-grained, and expressive security requirements of newly emerging applications. An attribute-based access control (ABAC) model provides a more flexible approach to addressing the authorization needs of complex and dynamic systems. While organizations are interested in employing newer authorization models, migrating to such models pose as a significant challenge. Many large-scale businesses need to grant authorizations to their user populations that are potentially distributed across disparate and heterogeneous computing environments. Each of these computing environments may have its own access control model. The manual development of a single policy framework for an entire organization is tedious, costly, and error-prone. In this article, we present a methodology for automatically learning ABAC policy rules from access logs of a system to simplify the policy development process. The proposed approach employs an unsupervised learning-based algorithm for detecting patterns in access logs and extracting ABAC authorization rules from these patterns. In addition, we present two policy improvement algorithms, including rule pruning and policy refinement algorithms to generate a higher quality mined policy. Finally, we implement a prototype of the proposed approach to demonstrate its feasibility.