Temporal Based Access Control Research Articles

Automated Analysis of Access Control Policies Based on Model Checking

Access control is becoming increasingly important for today’s ubiquitous systems which provide mechanism to prevent sensitive resources against unauthorized users. In access control models, the administration of access control policies is a task of paramount importance for distributed systems. A crucial analysis problem is to foresee if a set of administrators can give a user an unauthorized access permission. In this paper, we consider the analysis problem in the context of the administrative role-based access control (ARBAC) and its extension, the administrative temporal role-based access control (ATRBAC). More details, we present how to design analysis techniques, namely asasp2.1 and asaspTIME2.0 for ARBAC and ATRBAC, respectively, which are based on the ideas of a framework to analyze infinite state-transition systems. Moreover, we describe how we design heuristics to enable the analysis techniques to scale up to handle large and complex authorization policies. An extensive experimentation shows that the proposed techniques are scalability and the heuristics play a key role in the success of the analysis tools over well-known analysis techniques.

Deploying ABAC policies using RBAC Systems.

The flexibility, portability and identity-less access control features of Attribute Based Access Control(ABAC) make it an attractive choice to be employed in many application domains. However, commercially viable methods for implementation of ABAC do not exist while a vast majority of organizations use Role Based Access Control (RBAC) or their temporal extensions, such as Temporal Role Based Access Control (TRBAC). In this paper, we present a solution for organizations having a RBAC/TRBAC that can deploy an ABAC policy. Essentially, we propose a method for the translation of an ABAC policy (including time constraints) into a form that can be adopted by an RBAC/TRBAC system. We experimentally demonstrate that time taken to evaluate an access request in RBAC and TRBAC systems is significantly less than that of the corresponding ABAC system. Since the cost of security management is more expensive under RBAC when compared to ABAC, we present an analysis of the different management costs and present mitigation approaches by considering various administrative operations.

Using Hierarchical Timed Coloured Petri Nets in the formal study of TRBAC security policies

Role-Based Access Control (RBAC) is one of the most used models in designing and implementation of security policies, in large networking systems. Basic RBAC model does not consider temporal aspects which are so important in such policies. Temporal RBAC (TRBAC) is proposed to deal with these temporal aspects. Despite the elegance of these models, designing a security policy remains a challenge. Designers must ensure the consistency and the correctness of the policy. The use of formal methods provides techniques for proving that the designed policy is consistent. In this paper, we present a formal modelling/analysis approach of TRBAC policies. This approach uses Hierarchical Timed Coloured Petri Nets (HTCPN) formalism to model the TRBAC policy, and the CPN-tool to analyse the generated models. The timed aspect, in HTCPN, facilitates the consideration of temporal constraints introduced in TRBAC. The hierarchical aspect of HTCPN makes the model “manageable”, in spite of the complexity of TRBAC policy specification. The analysis phase allows the verification of many important properties about the TRBAC security policy.

Enhancing user access information with spatial data

Enforcing proper access control is essential for ensuring the security of sensitive resources in an organization. Access control models like the Role-Based Access Control (RBAC) model, its various temporal, spatial as well as spatial and temporal extensions have been proposed for achieving this objective. Though several algorithms have been presented by researchers for implementing RBAC and temporal RBAC, to the best of our knowledge, no attempts have been made so far for deploying a spatial or spatio-temporal RBAC model in terms of either creating suitable datasets or algorithms. For doing this, we require user-permission assignment information containing location constraints that need to be subjected to role mining approaches to derive the spatially constrained roles. In this paper, we focus on bridging this gap by presenting a suitable representation for spatially constrained access information. We name it as Spatial User-Permission Assignment (SUPA) matrix. We also propose an approach for generating SUPAs which can serve as inputs for the spatially constrained role creation procedures. We name our proposed method as Spatial Access Dataset Enumeration (SPADE). SPADE can be easily utilized to generate datasets of varied sizes which can be used for the performance evaluation of different role creation algorithms. As experimental results, we report the structure of sample SUPAs generated using SPADE.

Cree: a Performant Tool for Safety Analysis of Administrative Temporal Role-Based Access Control (ATRBAC) Policies

Access control deals with the roles and privileges to which a user is authorized, and is an important aspect of the security of a system. As enterprise access control systems need to scale to several users, roles and privileges, it is common for access control models to support delegation: a trusted security administrator is able to give semi-trusted users the ability to change portions of the authorization state. With delegation comes the danger that semi-trusted users, perhaps in collusion, may effect a state that violates enterprise policy, which in turn results in the problem called safety analysis, which is regarded as a fundamental and technically challenging problem in access control. Safety analysis is used by a trusted security administrator to answer “what if” questions before she grants privileges to a semi-trusted user. Safety analysis has been studied for various access control schemes in the literature; we address safety analysis in the context of Administrative Temporal Role-Based Access Control (ATRBAC), an administrative model for TRBAC, which is an extension to the traditional RBAC. ATRBAC has new features, which introduce new technical challenges for safety analysis: (i) a time-dimension: two new components in each administrative rule that specify in which time periods an administrative action may be effected, and a user is authorized to a role, and, (ii) two new kinds of rules for whether a role is enabled for administrative action. We propose a software tool, which we call Cree, for safety analysis of ATRBAC policies. In Cree we reduce ATRBAC-Safety to model checking and use an off-the-shelf model checker, NuSMV. The foundation for Cree is the observation from our prior work that ATRBAC safety is PSPACE . Along with an efficient reduction to model checking, we include in Cree four techniques to further improve performance: Polynomial Time Solving when possible, Forward and Backwards Pruning, Abstraction Refinement, and Bound Estimation. These are inspired by prior work, but our algorithms are different in that they address the new challenges that ATRBAC introduces. We discuss our design of Cree, and the results of a thorough empirical assessment across our approach, and five other prior tools for ATRBAC safety. Our results suggest that there are input classes for which Cree outperforms existing tools, and for the remainder, Cree’s performance is no worse. We have made Cree available as open-source for public download.

Automated and efficient analysis of administrative temporal RBAC policies with role hierarchies

Automated and efficient analysis of administrative temporal RBAC policies with role hierarchies

Mining hierarchical temporal roles with multiple metrics

Temporal role-based access control (TRBAC) extends role-based access control to limit the times at which roles are enabled. This paper presents a new algorithm for mining high-quality TRBAC policies from timed ACLs (i.e., ACLs with time limits in the entries) and optionally user attribute information. Such algorithms have potential to significantly reduce the cost of migration from timed ACLs to TRBAC. The algorithm is parameterized by the policy quality metric. We consider multiple quality metrics, including number of roles, weighted structural complexity (a generalization of policy size), and (when user attribute information is available) interpretability, i.e., how well role membership can be characterized in terms of user attributes. Ours is the first TRBAC policy mining algorithm that produces hierarchical policies, and the first that optimizes weighted structural complexity or interpretability. In experiments with datasets based on real-world ACL policies, our algorithm is more effective than previous algorithms at their goal of minimizing the number of roles.

Migrating from RBAC to temporal RBAC

The last two decades have witnessed an emergence of role-based access control (RBAC) as the de facto standard for access control. However, for organisations already having a deployed RBAC system, in many cases it may become necessary to associate a temporal dimension with the existing access control policies due to changing organisational requirements. In such cases, migration from RBAC to a temporal extension of RBAC becomes essential. Temporal RBAC (TRBAC) is one such RBAC extension. The process of creating a set of roles for implementing a TRBAC system is known as temporal role mining. Existing temporal role mining approaches typically assume that TRBAC is being deployed from scratch and do not consider it as a migration from an existing RBAC policy. In this study, the authors propose two temporal role mining approaches that enable migration from RBAC to TRBAC. These approaches make use of conventional (non-temporal) role mining algorithms. Apart from aiding the migration process, deriving the roles in this manner allows the flexibility of minimising any desired role mining metric. They experimentally evaluate the performance of both of the proposed approaches and show that they are both efficient and effective.

Mining temporal roles using many-valued concepts

Many of today's access control policies are associated with temporal restrictions. Under temporal role-based access control (TRBAC), roles have an associated temporal component, which allows them to better encapsulate such temporal access control policies. However, given their complexity, TRBAC systems can only be well managed if the set of roles is correctly defined. The process of deriving an optimal set of such roles is known as temporal role mining. In this paper, we formally define the temporal role mining problem (TRMP) in the form of a matrix decomposition problem, by introducing a new operator that multiplies a set with a Boolean value and redefining existing matrix multiplication operations in terms of it. We also define a new metric for temporal role mining, called cumulative overhead of temporal roles and permissions (CO-TRAP), which takes into consideration the administrative effort required for managing the resulting TRBAC system. Since TRMP as well as minimization of CO-TRAP are NP-complete problems, we propose two greedy algorithms based on many-valued concepts. Experimental evaluation on a number of real-world datasets shows that the proposed approach is both efficient and effective.

Safeness Discussions on TRBAC and GTRBAC Model and an Improved Temporal Role-Based Access Control Model

Bertino et al. propose a temporal Role-based Access Control (TRBAC) model, and Joshi et al. propose a Generalized TRBAC (GTRBAC) model based on TRBAC. Some periodic constraints and duration constraints are introduced to express the corresponding time-based access control policy semantics and enhance the expressiveness of the temporal RBAC model. We have analyzed the TRBAC and GTRBAC models and pointed out that the sufficient conditions for guaranteeing the safeness of the GTRBAC model was not comprehensive, so we have analyzed the reasons and designed a process rule to solve the safety problem. In this paper, an improved process rule is designed to solve the safety problem. In addition, a fault about translating a dependent trigger of TRBAC into an Oracle trigger is analyzed. In order to ensure the temporal RBAC model better, an Improved Generalized Temporal Role-based Access Control (IGTRBAC) based on the TRBAC and GTRBAC models is put forward. The two proposed restrictions in the IGTRBAC model are used to resolve the security problems caused by the dependent trigger and the cardinality constraint on role activation. At last, case study shows that the IGTRBAC model is safe.

Security analysis for temporal role based access control

Providing restrictive and secure access to resources is a challenging and socially important problem. Among the many formal security models, Role Based Access Control (RBAC) has become the norm in many of today's organizations for enforcing security. For every model, it is necessary to analyze and prove that the corresponding system is secure. Such analysis helps understand the implications of security policies and helps organizations gain confidence on the control they have on resources while providing access, and devise and maintain policies.In this paper, we consider security analysis for the Temporal RBAC (TRBAC), one of the extensions of RBAC. The TRBAC considered in this paper allows temporal restrictions on roles themselves, user-permission assignments (UA), permission-role assignments (PA), as well as role hierarchies (RH). Towards this end, we first propose a suitable administrative model that governs changes to temporal policies. Then we propose our security analysis strategy, that essentially decomposes the temporal security analysis problem into smaller and more manageable RBAC security analysis sub-problems for which the existing RBAC security analysis tools can be employed. We then evaluate them from a practical perspective by evaluating their performance using simulated data sets.

Security analysis of temporal RBAC under an administrative model

Security analysis of access control models is critical to confirm whether they ensure certain security properties. Administrative models specify the rules for state transition for any given access control model. While security analysis of role-based access control (RBAC) systems has been done using administrative models, work on security analysis of its temporal, spatial and spatio-temporal extensions has so far not considered the presence of any corresponding administrative model. In this paper, we present a methodology for performing security analysis of temporal RBAC (TRBAC) where state changes occur using the relations defined in a recently proposed administrative model named as AMTRAC (Administrative Model for Temporal Role-based Access Control). We initially define a number of security properties for TRBAC. These properties along with a representation of the TRBAC system and the administrative relations in AMTRAC are then formally specified using Alloy, a first order logic based language. Subsequently, validity of the specified properties is analyzed using the Alloy analyzer. We study the impact of the number of roles, users and temporal elements of TRBAC as well as various relations defined in AMTRAC on the time taken for security analysis.

AMTRAC: An administrative model for temporal role-based access control

Over the years, Role Based Access Control (RBAC) has received significant attention in system security and administration. The Temporal Role Based Access Control (TRBAC) model is an extension of RBAC that allows one to specify periodic enabling and disabling of roles in a role enabling base (REB). While decentralized administration and delegation of administrative responsibilities in large RBAC systems is managed using an administrative role based access control model like ARBAC97, no administrative model for TRBAC has yet been proposed. In this paper, we introduce such a model and name it AMTRAC (Administrative Model for Temporal Role based Access Control). AMTRAC defines a broad range of relations that control user-role assignment, role-permission assignment, role–role assignment and role enabling base assignment. Since the first three are similar to those in ARBAC97, the role enabling base assignment component has been discussed in detail in this paper. The different ways by which role enabling conditions of regular roles can be modified are first explained. We then show how to specify which of the administrative roles are authorized to modify the role enabling conditions of any regular role. An exhaustive set of commands for authorization enforcement along with their pre and postconditions is also presented. Together, this would facilitate practical deployment and security analysis of TRBAC systems.

Security analysis of GTRBAC and its variants using model checking

Security analysis is a formal verification technique to ascertain certain desirable guarantees on the access control policy specification. Given a set of access control policies, a general safety requirement in such a system is to determine whether a desirable property is satisfied in all the reachable states. Such an analysis calls for the use of formal verification techniques. While formal analysis on traditional Role Based Access Control (RBAC) has been done to some extent, recent extensions to RBAC lack such an analysis. In this paper, we consider the temporal RBAC extensions and propose a formal technique using timed automata to perform security analysis by analyzing both safety and liveness properties. Using safety properties one ensures that something bad never happens while liveness properties show that some good state is also achieved. GTRBAC is a well accepted generalized temporal RBAC model which can handle a wide range of temporal constraints while specifying different access control policies. Analysis of such a model involves a process of mapping a GTRBAC based system into a state transition system. Different reduction rules are proposed to simplify the modeling process depending upon the constraints supported by the system. The effect of different constraints on the modeling process is also studied.

Conformance Testing of Temporal Role-Based Access Control Systems

We propose an approach for conformance testing of implementations required to enforce access control policies specified using the Temporal Role-Based Access Control (TRBAC) model. The proposed approach uses Timed Input-Output Automata (TIOA) to model the behavior specified by a TRBAC policy. The TIOA model is transformed to a deterministic se-FSA model that captures any temporal constraint by using two special events Set and Exp. The modified W-method and integer-programming-based approach are used to construct a conformance test suite from the transformed model. The conformance test suite so generated provides complete fault coverage with respect to the proposed fault model for TRBAC specifications.

Formal foundations for hybrid hierarchies in GTRBAC

A role hierarchy defines permission acquisition and role-activation semantics through role--role relationships. It can be utilized for efficiently and effectively structuring functional roles of an organization having related access-control needs. The focus of this paper is the analysis of hybrid role hierarchies in the context of the generalized temporal role-based access control (GTRBAC) model that allows specification of a comprehensive set of temporal constraints on role, user-role, and role-permission assignments. We introduce the notion of uniquely activable set (UAS) associated with a role hierarchy that indicates the access capabilities of a user resulting from his membership to a role in the hierarchy. Identifying such a role set is essential, while making an authorization decision about whether or not a user should be allowed to activate a particular combination of roles in a single session. We formally show how UAS can be determined for a hybrid hierarchy. Furthermore, within a hybrid hierarchy, various hierarchical relations may be derived between an arbitrary pair of roles. We present a set of inference rules that can be used to generate all the possible derived relations that can be inferred from a specified set of hierarchical relations and show that it is sound and complete . We also present an analysis of hierarchy transformations with respect to role addition, deletion, and partitioning, and show how various cases of these transformations allow the original permission acquisition and role-activation semantics to be managed. The formal results presented here provide a basis for developing efficient security administration and management tools.

Application of temporal and spatial role based access control in 802.11 wireless networks

In this study, we have investigated the security aspects of wireless local area networks and discussed the weaknesses associated with various conventional 802.11 security protocols such as WEP and 802.1X. We propose an architecture to control access to 802.11 wireless networks, based on roles, location and time information, using the tested wired network components such as VPNs and Firewalls. The presented architecture, in which temporal and spatial RBAC is implemented, reduces the security risks in enterprise level deployment of wireless LANs.

An Analysis of Expressiveness and Design Issues for the Generalized Temporal Role-Based Access Control Model

The generalized temporal role-based access control (GTRBAC) model provides a comprehensive set of temporal constraint expressions which can facilitate the specification of fine-grained time-based access control policies. However, the issue of the expressiveness and usability of this model has not been previously investigated. In this paper, we present an analysis of the expressiveness of the constructs provided by this model and illustrate that its constraints-set is not minimal. We show that there is a subset of GTRBAC constraints that is sufficient to express all the access constraints that can be expressed using the full set. We also illustrate that a nonminimal GTRBAC constraint set can provide better flexibility and lower complexity of constraint representation. Based on our analysis, a set of design guidelines for the development of GTRBAC-based security administration is presented.

A generalized temporal role-based access control model

Role-based access control (RBAC) models have generated a great interest in the security community as a powerful and generalized approach to security management. In many practical scenarios, users may be restricted to assume roles only at predefined time periods. Furthermore, roles may only be invoked on prespecified intervals of time depending upon when certain actions are permitted. To capture such dynamic aspects of a role, a temporal RBAC (TRBAC) model has been recently proposed. However, the TRBAC model addresses the role enabling constraints only. In This work, we propose a generalized temporal role-based access control (GTRBAC) model capable of expressing a wider range of temporal constraints. In particular, the model allows expressing periodic as well as duration constraints on roles, user-role assignments, and role-permission assignments. In an interval, activation of a role can further be restricted as a result of numerous activation constraints including cardinality constraints and maximum active duration constraints. The GTRBAC model extends the syntactic structure of the TRBAC model and its event and trigger expressions subsume those of TRBAC. Furthermore, GTRBAC allows expressing role hierarchies and separation of duty (SoD) constraints for specifying fine-grained temporal semantics.

Data hiding and security for XML database: A TRBAC-based approach

In order to cope with varying protection granularity levels of XML (eXtensible Markup Language) documents, we propose a TXAC (Two-level XML Access Control) framework, in which an extended TRBAC (Temporal Role-Based Access Control) approach is proposed to deal with the dynamic XML data. With different system components, TXAC algorithm evaluates access requests efficiently by appropriate access control policy in dynamic web environment. The method is a flexible and powerful security system offering a multi-level access control solution.