Formal Analysis of ReBAC Policy Mining Feasibility

Chakraborty, Shuvra; Sandhu, Ravi

doi:10.1145/3422337.3447828

Cited by 4 publications

(8 citation statements)

References 15 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…-In [3], feasibility of ReBAC policy mining has been investigated for the first time, assuming user to user relations are given by a static relationship graph.…”

Section: Related Workmentioning

confidence: 99%

“…Although both ReBAC and ABAC are powerful, flexible and comparable [1] in expressing authorization policies, relying solely on one is often insufficient. An example case will be used in order to compare ABAC policy presented in [4] and ReBAC policy in [3] with the proposed AReBAC policy in Def. 4.…”

Section: Alicementioning

confidence: 99%

“…According to the used policy specification language, AReBAC is more expressive than ABAC [4] and ReBAC [3]. Additionally, it can be clearly observed that, if entity ids are allowed, AReBAC policy will never fail (such as [2]).…”

Section: Alicementioning

confidence: 99%

“…Given an ARREP instance, it returns either feasible status and Rule op , or infeasible status, incomplete Rule op and failed authorizations. Given any graph, the task finding all possible simple paths from a source vertex to a target vertex is well known, hence, details of function FindAllSimplePath() in Algorithm 1 are not provided (it can be adapted from [3]). The overall complexity of computing all possible paths from a vertex to another in ARG is O(|E|!)…”

Section: Arrep Solution Algorithmmentioning

confidence: 99%

“…as it considers only simple paths. The correctness proof of Algorithm 1 is similar to the feasibility detection algorithm in [3], and is therefore omitted. Although overall complexity of feasibility detection algorithm in [3] and Algorithm 1 are same, however, the latter may have more or less computation time.…”

Section: Arrep Solution Algorithmmentioning

confidence: 99%

See 4 more Smart Citations

On Feasibility of Attribute-Aware Relationship-Based Access Control Policy Mining

Chakraborty¹,

Sandhu²

2021

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

This paper studies whether exact conversion to an AReBAC (Attribute-aware Relationship-Based Access Control) system is possible from an Enumerated Authorization System (EAS), given supporting attribute and relationship data. The Attribute-aware ReBAC Ruleset Existence Problem (ARREP) is defined formally and solved algorithmically, along with complexity analysis. Approaches to resolve infeasibility using exact solutions are discussed.

show abstract

“…-In [3], feasibility of ReBAC policy mining has been investigated for the first time, assuming user to user relations are given by a static relationship graph.…”

Section: Related Workmentioning

confidence: 99%

Section: Alicementioning

confidence: 99%

Section: Alicementioning

confidence: 99%

Section: Arrep Solution Algorithmmentioning

confidence: 99%

Section: Arrep Solution Algorithmmentioning

confidence: 99%

See 3 more Smart Citations

On Feasibility of Attribute-Aware Relationship-Based Access Control Policy Mining

Chakraborty¹,

Sandhu²

2021

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

show abstract

Learning Relationship-Based Access Control Policies from Black-Box Systems

Iyer

Masoumzadeh

2022

ACM Trans. Priv. Secur.

View full text Add to dashboard Cite

Access control policies are crucial in securing data in information systems. Unfortunately, often times, such policies are poorly documented, and gaps between their specification and implementation prevent the system users, and even its developers, from understanding the overall enforced policy of a system. To tackle this problem, we propose the first of its kind systematic approach for learning the enforced authorizations from a target system by interacting with and observing it as a black box. The black-box view of the target system provides the advantage of learning its overall access control policy without dealing with its internal design complexities. Furthermore, compared to the previous literature on policy mining and policy inference, we avoid exhaustive exploration of the authorization space by minimizing our observations. We focus on learning relationship-based access control (ReBAC) policy, and show how we can construct a deterministic finite automaton (DFA) to formally characterize such an enforced policy. We theoretically analyze our proposed learning approach by studying its termination, correctness, and complexity. Furthermore, we conduct extensive experimental analysis based on realistic application scenarios to establish its cost, quality of learning, and scalability in practice.

show abstract

Effective Evaluation of Relationship-Based Access Control Policy Mining

Iyer

Masoumzadeh

2022

Proceedings of the 27th ACM on Symposium on Access Control Models and Technologies

View full text Add to dashboard Cite

Formal Analysis of ReBAC Policy Mining Feasibility

Cited by 4 publications

References 15 publications

On Feasibility of Attribute-Aware Relationship-Based Access Control Policy Mining

On Feasibility of Attribute-Aware Relationship-Based Access Control Policy Mining

Learning Relationship-Based Access Control Policies from Black-Box Systems

Effective Evaluation of Relationship-Based Access Control Policy Mining

Contact Info

Product

Resources

About