Abductive Analysis of Administrative Policies in Rule-Based Access Control

Abstract

In large organizations, access control policies are managed by multiple users (administrators). An administrative policy specifies how each user in an enterprise may change the policy. Fully understanding the consequences of an administrative policy in an enterprise system can be difficult, because of the scale and complexity of the access control policy and the administrative policy, and because sequences of changes by different users may interact in unexpected ways. Administrative policy analysis helps by answering questions such as user-permission reachability, which asks whether specified users can together change the policy in a way that achieves a specified goal, namely, granting a specified permission to a specified user. This paper presents a rule-based access control policy language, a rule-based administrative policy model that controls addition and removal of facts and rules, and an abductive analysis algorithm for user-permission reachability. Abductive analysis means that the algorithm can analyze policy rules even if the facts initially in the policy (e.g., information about users) are unavailable. The algorithm does this by computing minimal sets of facts that, if present in the initial policy, imply reachability of the goal.

An Administrative Model for Relationship-Based Access Control

“…A third direction for future work is to develop policy analysis algorithms, to help policy developers understand the full implications of proposed administrative policies. We plan to explore an abductive policy analysis for RPPM 2 along the lines of Gupta, Stoller, and Xu's abductive policy analysis for ACAR [9,10].…”

“…It is based partly on the sample policy in [9,10]. The permissible relationship graph appears in Figure 1.…”

“…Gupta, Stoller, and Xu define an ABAC model with a comprehensive administrative model [9,10]. Specifically, they define a policy language with Datalog-like authorization rules, and an administrative model based on operations that add and remove facts and rules in the policy.…”

Development of Patient Status-Based Dynamic Access System for Medical Information Systems

“…There are many studies that have applied the situation-based access control, rule/role-based access control, and situation recognition-based access control as representative security technologies of medical information systems [8][9][10].…”

Managing access control policy from end user perspective in collaborative environment

“…Administrators are responsible for providing administrative services such as system maintenance and user support. Permissions to specific data are performed by granular control of adminstrators' rights [5]. Figure 1 shows a common framework of access control policy adapted by most applications [3].…”