Semantic Attribute-Based Access Control An overview of the existing - PowerPoint PPT Presentation

Semantic Attribute-Based Access Control An overview of the existing approaches Hamed Arshad Department of Informatics University of Oslo March 2018 Hamed Arshad (UiO) SABAC March 2018 1 / 25

Table of Contents Introduction 1 Attribute-Based Access Control (ABAC) 2 Semantic-Based Access Control (SBAC) 3 Semantic Attribute-Based Access Control (SABAC) 4 Hamed Arshad (UiO) SABAC March 2018 2 / 25

Introduction Access control : restricting access for computer resources, especially in multi-user and data sharing settings Hamed Arshad (UiO) SABAC March 2018 4 / 25

Introduction Access control : restricting access for computer resources, especially in multi-user and data sharing settings Authentication vs Access control Hamed Arshad (UiO) SABAC March 2018 4 / 25

Introduction Access control : restricting access for computer resources, especially in multi-user and data sharing settings Authentication vs Access control Authentication : Who goes there? Hamed Arshad (UiO) SABAC March 2018 4 / 25

Introduction Access control : restricting access for computer resources, especially in multi-user and data sharing settings Authentication vs Access control Authentication : Who goes there? Restrictions on who (or what) can access the system Hamed Arshad (UiO) SABAC March 2018 4 / 25

Introduction Access control : restricting access for computer resources, especially in multi-user and data sharing settings Authentication vs Access control Authentication : Who goes there? Restrictions on who (or what) can access the system Access control : Are you allowed to do that? Hamed Arshad (UiO) SABAC March 2018 4 / 25

Introduction Access control : restricting access for computer resources, especially in multi-user and data sharing settings Authentication vs Access control Authentication : Who goes there? Restrictions on who (or what) can access the system Access control : Are you allowed to do that? Restrictions on actions of authenticated users Hamed Arshad (UiO) SABAC March 2018 4 / 25

Introduction Access control : restricting access for computer resources, especially in multi-user and data sharing settings Authentication vs Access control Authentication : Who goes there? Restrictions on who (or what) can access the system Access control : Are you allowed to do that? Restrictions on actions of authenticated users Access control enforced by Hamed Arshad (UiO) SABAC March 2018 4 / 25

Introduction Access control : restricting access for computer resources, especially in multi-user and data sharing settings Authentication vs Access control Authentication : Who goes there? Restrictions on who (or what) can access the system Access control : Are you allowed to do that? Restrictions on actions of authenticated users Access control enforced by Access Control Lists Capabilities ... Hamed Arshad (UiO) SABAC March 2018 4 / 25

Attribute-Based Access Control (ABAC) ABAC a successor of RBAC Hamed Arshad (UiO) SABAC March 2018 6 / 25

Attribute-Based Access Control (ABAC) ABAC a successor of RBAC control based on the entities attributes Hamed Arshad (UiO) SABAC March 2018 6 / 25

Attribute-Based Access Control (ABAC) ABAC a successor of RBAC control based on the entities attributes A set of attributes in ABAC Hamed Arshad (UiO) SABAC March 2018 6 / 25

Attribute-Based Access Control (ABAC) ABAC a successor of RBAC control based on the entities attributes A set of attributes in ABAC the same as a role in RBAC Hamed Arshad (UiO) SABAC March 2018 6 / 25

Attribute-Based Access Control (ABAC) ABAC a successor of RBAC control based on the entities attributes A set of attributes in ABAC the same as a role in RBAC The XACML standard Hamed Arshad (UiO) SABAC March 2018 6 / 25

Attribute-Based Access Control (ABAC) ABAC a successor of RBAC control based on the entities attributes A set of attributes in ABAC the same as a role in RBAC The XACML standard a policy language, which is sufficiently fine-grained and declarative Hamed Arshad (UiO) SABAC March 2018 6 / 25

Attribute-Based Access Control (ABAC) ABAC a successor of RBAC control based on the entities attributes A set of attributes in ABAC the same as a role in RBAC The XACML standard a policy language, which is sufficiently fine-grained and declarative as well as an architecture for ABAC Hamed Arshad (UiO) SABAC March 2018 6 / 25

Attribute-Based Access Control (ABAC) Hamed Arshad (UiO) SABAC March 2018 7 / 25

Attribute-Based Access Control (ABAC) Hamed Arshad (UiO) SABAC March 2018 8 / 25

Attribute-Based Access Control (ABAC) ABAC is supposed to be a proper solution in open and distributed systems Hamed Arshad (UiO) SABAC March 2018 9 / 25

Attribute-Based Access Control (ABAC) ABAC is supposed to be a proper solution in open and distributed systems Heterogeneous systems = mismatch between attributes Hamed Arshad (UiO) SABAC March 2018 9 / 25

Attribute-Based Access Control (ABAC) ABAC is supposed to be a proper solution in open and distributed systems Heterogeneous systems = mismatch between attributes Example An e-healthcare system may represent adult patients with an attribute “Adult” Hamed Arshad (UiO) SABAC March 2018 9 / 25

Attribute-Based Access Control (ABAC) ABAC is supposed to be a proper solution in open and distributed systems Heterogeneous systems = mismatch between attributes Example An e-healthcare system may represent adult patients with an attribute “Adult” Patients may try to prove using “hasDriverLicense” or “age” Hamed Arshad (UiO) SABAC March 2018 9 / 25

Attribute-Based Access Control (ABAC) ABAC is supposed to be a proper solution in open and distributed systems Heterogeneous systems = mismatch between attributes Example An e-healthcare system may represent adult patients with an attribute “Adult” Patients may try to prove using “hasDriverLicense” or “age” Considering all the possible synonyms (semantically) of each attribute Hamed Arshad (UiO) SABAC March 2018 9 / 25

Attribute-Based Access Control (ABAC) ABAC is supposed to be a proper solution in open and distributed systems Heterogeneous systems = mismatch between attributes Example An e-healthcare system may represent adult patients with an attribute “Adult” Patients may try to prove using “hasDriverLicense” or “age” Considering all the possible synonyms (semantically) of each attribute defining several policies or one general policy Hamed Arshad (UiO) SABAC March 2018 9 / 25

Attribute-Based Access Control (ABAC) ABAC is supposed to be a proper solution in open and distributed systems Heterogeneous systems = mismatch between attributes Example An e-healthcare system may represent adult patients with an attribute “Adult” Patients may try to prove using “hasDriverLicense” or “age” Considering all the possible synonyms (semantically) of each attribute defining several policies or one general policy A change in the policy Hamed Arshad (UiO) SABAC March 2018 9 / 25

Attribute-Based Access Control (ABAC) ABAC is supposed to be a proper solution in open and distributed systems Heterogeneous systems = mismatch between attributes Example An e-healthcare system may represent adult patients with an attribute “Adult” Patients may try to prove using “hasDriverLicense” or “age” Considering all the possible synonyms (semantically) of each attribute defining several policies or one general policy A change in the policy a large number of manual work Hamed Arshad (UiO) SABAC March 2018 9 / 25

Attribute-Based Access Control (ABAC) ABAC is supposed to be a proper solution in open and distributed systems Heterogeneous systems = mismatch between attributes Example An e-healthcare system may represent adult patients with an attribute “Adult” Patients may try to prove using “hasDriverLicense” or “age” Considering all the possible synonyms (semantically) of each attribute defining several policies or one general policy A change in the policy a large number of manual work ABAC needs to be extended Hamed Arshad (UiO) SABAC March 2018 9 / 25

Semantic Attribute-Based Access Control An overview of the existing - PowerPoint PPT Presentation

Semantic Attribute-Based Access Control An overview of the existing approaches Hamed Arshad Department of Informatics University of Oslo March 2018 Hamed Arshad (UiO) SABAC March 2018 1 / 25 Table of Contents Introduction 1

Strategies for Incorporating Delegation into Attribute-Based Access Control (ABAC) Sylvia L.

Development and deployment of integrated attribute based access control for collaboration

HGABAC: Towards a Formal Model of Hierarchical Attribute-Based Access Control Sylvia L. Osborn

Incorporating Off-Line Attribute Delegation into Hierarchical Group and Attribute-Based Access

Current Research and Open Problems in Attribute-Based Access Control Daniel Servos

Attribute-based Access Control Architectures with the eIDAS Protocols 21. SSR 2016 Frank

Semantic security framework and context- aware role-based access control ontology for Smart

PERMIS Role-Based Access Control Example System Presenter: Haiyan Cheng CS 6204, Spring 2005 1

Why attribute-based signatures? The kind of authentication required in an attribute-based system

Attribute Grammars Wilhelm/Seidl/Hack: Compiler Design, Syntactic and Semantic Analysis

Working Set- -Based Access Control for Based Access Control for Working Set Network File

Access Control Access Control 1 Access Control Access control : ensures that all direct

Enumerated Authorization Policy Prosunjit Biswas, Ravi Sandhu and Ram Krishnan University of

Access Control Enforcement Access Control Enforcement for Conversation- -based based for

Access Control and Protection Overview Access control: What and Why Abstract Models of

Attribute Dependencies Wilhelm/Seidl/Hack: Compiler Design, Syntactic and Semantic Analysis

Role-based access control Role-based access control 1 RBAC: Motivations Complexity of

Outline Unix-style access control, contd CSci 5271 Multilevel and mandatory access control

Overview Access control lists Capability lists Locks and keys Rings-based

Access Control Jackson Argo Rackspace MO After-hours April 28, 2016 What is Access Control?

Semantic Analysis with Attribute Grammars Part 1 Y.N. Srikant Department of Computer Science and

Semantic Analysis with Attribute Grammars Part 5 Y.N. Srikant Department of Computer Science and

Role-Based Access Control Corban Rivera CS 6204, Spring 2005 1 Trusted Computer System

Common Access to EU Information based on semantic technology Audience: W3C Workshop: The