Relationship-based Access Control Research Articles

Enhanced Adaptable and Distributed Access Control Decision Making Model Based on Machine Learning for Policy Conflict Resolution in BYOD Environment

Organisations are adopting new IT strategies such as “Bring Your Own Device” (BYOD) and remote working. These trends are highly beneficial both for enterprise owners and employees in terms of increased productivity and reduced costs. However, security issues such as unauthorised access as well as privacy concerns pose significant obstacles. These can be overcome by adopting access control techniques and a dynamic security and privacy policy that governs these issues where they arise. Policy decision points in traditional access control systems, such as role-based access control (RBAC), attribute-based access control (ABAC), or relationship-based access control (ReBAC), may be limited because the status of access control can vary in response to minor changes in user and resource properties. As a result, system administrators rely on a solution for constructing complex rules with many conditions and permissions for decision control. This results in access control issues, including policy conflicts, decision-making bottlenecks, delayed access response times and mediocre performance. This paper proposes a policy decision-making and access control-based supervised learning algorithm. The algorithm enhances policy decision points (PDPs). This is achieved by transforming the PDP’s problem into a binary classification for security access control that either grants or denies access requests. Also, a vector decision classifier based on the supervised machine learning algorithm is developed to generate an accurate, effective, distributed and dynamic policy decision point (PDP). Performance was evaluated using the Kaggle-Amazon access control policy dataset, which compared the effectiveness of the proposed mechanism to previous research benchmarks in terms of performance, time and flexibility. The proposed solution obtains a high level of privacy for access control policies because the PDP does not communicate directly with the policy administration point (PAP). In conclusion, PDP-based ML generates accurate decisions and can simultaneously fulfill multiple massive policies and huge access requests with 95% Accuracy in a short response time of around 0.15 s without policy conflicts. Access control security is improved by making it dynamic, adaptable, flexible and distributed.

Learning Relationship-Based Access Control Policies from Black-Box Systems

Access control policies are crucial in securing data in information systems. Unfortunately, often times, such policies are poorly documented, and gaps between their specification and implementation prevent the system users, and even its developers, from understanding the overall enforced policy of a system. To tackle this problem, we propose the first of its kind systematic approach for learning the enforced authorizations from a target system by interacting with and observing it as a black box. The black-box view of the target system provides the advantage of learning its overall access control policy without dealing with its internal design complexities. Furthermore, compared to the previous literature on policy mining and policy inference, we avoid exhaustive exploration of the authorization space by minimizing our observations. We focus on learning relationship-based access control (ReBAC) policy, and show how we can construct a deterministic finite automaton (DFA) to formally characterize such an enforced policy. We theoretically analyze our proposed learning approach by studying its termination, correctness, and complexity. Furthermore, we conduct extensive experimental analysis based on realistic application scenarios to establish its cost, quality of learning, and scalability in practice.

Toward Automated Cyber Defense with Secure Sharing of Structured Cyber Threat Intelligence

Cyber Threat sharing helps with defending against cyber attacks in a timely manner. Many frameworks have been proposed for CTI sharing such as Structured Threat Information Expression (STIX) and Trusted Automated Exchange of Intelligence Information (TAXII). However, CTI sharing in a controlled and automated manner is critical. In this paper, we demonstrate Relationship Based Access Control (ReBAC) as an appropriate model for CTI sharing. We also develop an approach for automated threat detection, generation and sharing of structured CTI and taking course of actions to mitigate cyber threats. Finally, we implement an Automated Cyber Defense System in a cloud based environment.

Efficient Authorization of Graph-database Queries in an Attribute-supporting ReBAC Model

Neo4j is a popular graph database that offers two versions: an enterprise edition and a community edition . The enterprise edition offers customizable Role-based Access Control features through custom developed procedures , while the community edition does not offer any access control support. Being a graph database, Neo4j appears to be a natural application for Relationship-Based Access Control (ReBAC), an access control paradigm where authorization decisions are based on relationships between subjects and resources in the system (i.e., an authorization graph). In this article, we present AReBAC, an attribute-supporting ReBAC model for Neo4j that provides finer-grained access control by operating over resources instead of procedures. AReBAC employs Nano-Cypher, a declarative policy language based on Neo4j’s Cypher query language, the result of which allows us to weave database queries with access control policies and evaluate both simultaneously. Evaluating the combined query and policy produces a result that (i) matches the search criteria, and (ii) the requesting subject is authorized to access. AReBAC is accompanied by the algorithms and their implementation required for the realization of the presented ideas, including GP-Eval, a query evaluation algorithm. We also introduce Live-End Backjumping (LBJ), a backtracking scheme that provides a significant performance boost over conflict-directed backjumping for evaluating queries. As demonstrated in our previous work, the original version of GP-Eval already performs significantly faster than the Neo4j’s Cypher evaluation engine. The optimized version of GP-Eval , which employs LBJ, further improves the performance significantly, thereby demonstrating the capabilities of the technique.

Greedy and evolutionary algorithms for mining relationship-based access control policies

Relationship-based access control (ReBAC) provides a high level of expressiveness and flexibility that promotes security and information sharing. We formulate ReBAC as an object-oriented extension of attribute-based access control (ABAC) in which relationships are expressed using fields that refer to other objects, and path expressions are used to follow chains of relationships between objects. ReBAC policy mining algorithms have potential to significantly reduce the cost of migration from legacy access control systems to ReBAC, by partially automating the development of a ReBAC policy from an existing access control policy and attribute data. This paper presents two algorithms for mining ReBAC policies from access control lists (ACLs) and attribute data represented as an object model: a greedy algorithm guided by heuristics, and a grammar-based evolutionary algorithm. An evaluation of the algorithms on four sample policies and two large case studies demonstrates their effectiveness.

Relationship‐based access control: More than a social network access control model

In a computer system, access control refers to the mechanisms the system use to decide whether to grant or reject access to its resources. Access control decisions in social media services, such as Facebook, Twitter, Research Gate, or LinkedIn, are determined in large part by policies that can be described in terms of the relationships among the individuals potentially affected by the decision. The premise behind a larger interest in Relationship‐based Access Control (ReBAC) is that besides social media services, social and other forms of relationships can be an effective abstraction for describing and implementing access control policies. The aim of this paper is to present an overview of ReBAC from the point of view of the types of policies that have motivated the access control research community to develop different ReBAC systems. We also review and reflect on what it would take to implement and administer an ReBAC system.This article is categorized under: Fundamental Concepts of Data and Knowledge > Information Repositories Fundamental Concepts of Data and Knowledge > Data Concepts Application Areas > Society and Culture

The Location Privacy Preserving of Social Network Based on RCCAM Access Control

ABSTRACTLocation-based services in social networks provide much convenience for people but bring much risk of location privacy disclosure. Aiming at this problem, a location privacy preservation algorithm based on RCCAM access control model is proposed to assign the accessing users of the access permission and the visibility level of location information through the combination of conflict resolution strategy, permission allocation strategy and location generalization strategy. RCCAM is a relationship-based multi-users cooperation access control model, which takes the same shared contents that may involves the privacy profits of multi-users into consideration. The core of the algorithm is the value of open tendency which depends on the location sensitivity and the intimacy between the users. The conflict resolution strategy adopts the value of open tendency to vote for concessions. The permission allocation strategy and location generalization strategy to obtain the specific access permission and the location visibility level for accessing users according to the value of open tendency. The algorithm can achieve fine-grained control of location publishing of the shared content which involves stakeholder's privacy profit and maintain the sharing will of promulgator as possible.

Resource Sharing and Allocation in Cloud Via Social Networks

Social network plays a major role in communication and interaction of the people. Nowadays, cloud computing is the emerging technology in the field of Information Technology. The allocation and sharing of resources can be possible in an innovative way, by combining the social networks processes and cloud computing concepts. In the social network cloud, based on the friend’s relationship strength the resources can be provided from one friend to another. Based on the clustering techniques the similar type of friends will be grouped and the resources will be allocated. The resource providers recommend the virtualized containers on their devices itself. For efficient allocation of resources the effective allocation algorithms are used. Based on the type of relationship they had, the relationship based access control mechanisms are provided.

Resource Sharing and Allocation in Cloud Via Social Networks

Social network plays a major role in communication and interaction of the people. Nowadays, cloud computing is the emerging technology in the field of Information Technology. The allocation and sharing of resources can be possible in an innovative way, by combining the social networks processes and cloud computing concepts. In the social network cloud, based on the friend’s relationship strength the resources can be provided from one friend to another. Based on the clustering techniques the similar type of friends will be grouped and the resources will be allocated. The resource providers recommend the virtualized containers on their devices itself. For efficient allocation of resources the effective allocation algorithms are used. Based on the type of relationship they had, the relationship based access control mechanisms are provided.

HAC: Hybrid Access Control for Online Social Networks

The rapid development of communication and network technologies including mobile networks and GPS presents new characteristics of OSNs. These new characteristics pose extra requirements on the access control schemes of OSNs, which cannot be satisfied by relationship-based access control currently. In this paper, we propose a hybrid access control model (HAC) which leverages attributes and relationships to control access to resources. A new policy specification language is developed to define policies considering the relationships and attributes of users. A path checking algorithm is proposed to figure out whether paths between two users can fit in with the hybrid policy. We develop a prototype system and demonstrate the feasibility of the proposed model.

An Access Control Model for Online Social Networks Using User-to-User Relationships

Users and resources in online social networks (OSNs) are interconnected via various types of relationships. In particular, user-to-user relationships form the basis of the OSN structure, and play a significant role in specifying and enforcing access control. Individual users and the OSN provider should be enabled to specify which access can be granted in terms of existing relationships. In this paper, we propose a novel user-to-user relationship-based access control (UURAC) model for OSN systems that utilizes regular expression notation for such policy specification. Access control policies on users and resources are composed in terms of requested action, multiple relationship types, the starting point of the evaluation, and the number of hops on the path. We present two path checking algorithms to determine whether the required relationship path between users for a given access request exists. We validate the feasibility of our approach by implementing a prototype system and evaluating the performance of these two algorithms.

RoBAC—A New Way of Access Control for Cloud

Access control has made a long way from 1960s. With the advent changes of technologies pertaining to location transparency in storage of data, there arises different access control scenarios. Cloud storage, the predominant storage that is being in use currently, also paves way to various access control problems. Though there are various access control mechanisms such as RBAC, ABAC, they are designed on the user’s perspective such as the role held by the user or other attributes assigned to the user. A new access control mechanism called object relationship based access control (RoBAC) has been developed based on the relations held among the users. The policy decision of access control is based on the relationship among the classes followed in the Java programming. Results have shown that this model best suits various scenarios in the cloud environment, and it also shows that the time for making decision either to allow or to deny is reduced compared to the existing system.

A new access control scheme for Facebook-style social networks

The popularity of online social networks (OSNs) makes the protection of users’ private information an important but scientifically challenging problem. In the literature, relationship-based access control schemes have been proposed to address this problem. However, with the dynamic developments of OSNs, we identify new access control requirements which cannot be fully captured by the current schemes. In this paper, we focus on public information in OSNs and treat it as a new dimension which users can use to regulate access to their resources. We define a new OSN model containing users and their relationships as well as public information. Based on this model, we introduce a variant of hybrid logic for formulating access control policies. We exploit a type of category information and relationship hierarchy to further extend our logic for its usage in practice. In the end, we propose a few solutions to address the problem of information reliability in OSNs, and formally model collaborative access control in our access control scheme.

Context-Aware Role Based Access Control Using User Relationship

We suggest relationship-based access control model that considers the relationship among users in an organization and surrounding user identification as context information. We assume mobile office environment as our domain this paper. In mobile office, employees who use mobile device such as smartphone and tablet PC have relation with other employees for cooperative work to perform organization's task. But existing access control model do not consider relationship among employees as context information in mobile office. Proposed access control model consider relations among surrounding users for access control in mobile office systems.

Preventing Social Engineering and Espionage in Collaborative Knowledge Management Systems (KMSs)

Insider attack and espionage on computer-based information is a major problem for business organizations and governments. Knowledge Management Systems (KMSs) are not exempt from this threat. Prior research presented the Congenial Access Control Model (CAC), a relationship-based access control model, as a better access control method for KMS because it reduces the adverse effect of stringent security measures on the usability of KMSs. However, the CAC model, like other models, e.g., Role Based Access Control (RBAC), Time-Based Access Control (TBAC), and History Based Access Control (HBAC), does not provide adequate protection against privilege abuse by authorized users that can lead to industrial espionage. In this paper, the authors provide an Espionage Prevention Model (EP) that uses Semantic web-based annotations on knowledge assets to store relevant information and compares it to the Friend-Of-A-Friend (FOAF) data of the potential recipient of the resource. It can serve as an additional layer to previous access control models, preferably the Congenial Access Control (CAC) model.