PolyOrBAC: A security framework for Critical Infrastructures

Abstract

Due to physical and logical vulnerabilities, a critical infrastructure (CI) can encounter failures of various degrees of severity, and since there are many interdependencies between CIs, simple failures can have dramatic consequences on the users. In this paper, we mainly focus on malicious threats that might affect the information and communciation system that controls the Critical Infrastructure, i.e., the Critical Information Infrastructure (CII). To address the security challenges that are specific of CIIs, we propose a collaborative access control framework called PolyOrBAC. This approach offers each organization taking part in the CII the capacity of collaborating with the other ones, while maintaining a control on its resources and on its internal security policy. The interactions between organizations participating in the CII are implemented through web services (WS), and for each WS a contract is signed between the service-provider organization and the service-user organization. The contract describes the WS functions and parameters, the liability of each party and the security rules controlling the interactions. At runtime, the compliance of all interactions with these security rules is checked. Every deviation from the signed contracts triggers an alarm, the concerned parties are notified and audits can be used as evidence for sanctioning the party responsible for the deviation. Our approach is illustrated by a practical scenario, based on real emergency actions in an electric power grid infrastructure, and a simulation test bed has been implemented to animate this scenario and experiment its security issues.

Dynamic Access Control Policy based on Blockchain and Machine Learning for the Internet of Things

“…However, one of the big drawbacks of this model, especially when talking about IoT environments, is that it is based on a totally centralized architecture and does not provide or support the distribution, collaboration and interoperability requirements. That said, several works have done in order to extend OrBAC to overcome these limitation: PolyOrBAC [27] deals with this problem by using the OrBAC model to manage the internal policies of each organization, but to ensure the collaboration aspect between organizations, web services technology was. Nevertheless, such technologies that PolyOrBAC uses (e.g.…”

New mechanism for Cloud Computing Storage Security

“…Other solutions can be integrated to increase the security level discussed in [58]. One consists of establishing a collaborative access control framework called PolyOrBAC.…”

Dynamic deployment of context-aware access control policies for constrained security devices

“…The main concepts introduced by OrBAC are the following: (1) activity, regrouping actions having common properties; (2) view, several objects having the same properties on which the same rules are applied; and (3) context, a concept dening the circumstances in which some security rules can be applied. The context allows the denition of specic security requirements directly at the OrBAC level.…”

“…The concept of organization in OrBAC provides means to better analyze interoperability and specication of hierarchies which, in turn, leads to a exible specication of collaborative work and information ow between dierent organizations (e.g., companies and institutions). The OrBAC formalism and the expressiveness of general-purpose ontologies can be combined in order of guaranteeing organization interoperability and collaboration [11,2]. Negative authorizations are also allowed in OrBAC, in order to specify complex policies.…”