Evolutionary Inference of Attribute-Based Access Control Policies

Abstract

Abstract. The interest in attribute-based access control policies is increasingly growing due to their ability to accommodate the complex security requirements of modern computer systems. With this novel paradigm, access control policies consist of attribute expressions which implicitly describe the properties of subjects and protection objects and which must be satisfied for a request to be allowed. Since specifying a policy in this framework may be very complex, approaches for policy mining, i.e., for inferring a specification automatically from examples in the form of logs of authorized and denied requests, have been recently proposed. In this work, we propose a multi-objective evolutionary approach for solving the policy mining task. We designed and implemented a problem representation suitable for evolutionary computation, along with several search-optimizing features which have proven to be highly useful in this context: a strategy for learning a policy by learning single rules, each one focused on a subset of requests; a custom initialization of the population; a scheme for diversity promotion and for early termination. We show that our approach deals successfully with case studies of realistic complexity.

Efficient and Extensible Policy Mining for Relationship-Based Access Control

“…Each evolutionary search starts with an initial population containing candidate rules created from a seed SRA-tuple along with numerous random variants of those rules together with some completely random candidate rules, evolves the population by repeatedly applying genetic operators (mutations and crossover), and then adds the highest quality rule in the population to the candidate policy. Rule quality is measured using the same fitness function f as [16] (our definition is slightly simplified but equivalent): f (ρ) = ⟨FAR(ρ), FRR(ρ), ID(ρ), WSC(ρ)⟩, where the false acceptance rate is FAR(ρ) = | [[ρ]] \ uncovAU |, the false rejection rate is FRR(ρ) = |uncovAU \ [[ρ]] |, uncovAU is the subset of AU not covered by the current candidate policy, and ID(ρ) equals 2 if the subject condition and resource condition both contain an atomic condition with path "id", equals 1 if exactly one of them does, and equals 0 if neither of them does. The fitness ordering is lexicographic order on these tuples, where smaller is better.…”

“…Policy mining algorithms promise to drastically reduce this cost, by automatically produce a "first draft" of a high-level policy from existing lower-level data. There is a substantial amount of research on role mining, surveyed in [8,17], and a small but growing literature on ABAC policy mining [7,14,16,18,22,23], surveyed in [8].…”

Efficient Bottom-Up Mining of Attribute Based Access Control Policies

“…[22] provides a comprehensive literature survey on this topic. There has also been work on mining ABAC policies [4], [23], [24], [25]. Specifically, Xu et al [4] proposed an approach (Xu-Stoller) for ABAC policy mining, that we have directly compared to.…”

“…The work by Medvet et al [23] uses the same ABAC language and case studies as in Xu-Stoller and employs an evolutionary and separate and conquer approach, where at every iteration, a new rule is generated and the set of access requests is reduced to a smaller size. This has the same efficiency as that of Xu-Stoller.…”

Introducing Dynamic Identity and Access Management in Organizations

“…Attribute management [6,8,16,20,35,37,52] in general deals with requirements related to the attributes used within ABAC policies, ranging from the aggregation of attributes up to their ongoing maintenance. Policy management [4,15,20,22,24,30,37] deals with the development and continuous improvement of access policies.…”