Semantically Correct Policy Mining and Enforcement for Attribute based Access Control

Area of Science:

• Computer Science
• Information Security
• Access Control Systems

Background:

• Attribute-Based Access Control (ABAC) offers dynamic, flexible, portable, and scalable security.
• Current ABAC models assume hierarchical inheritance where access to a general object implies access to its subtypes.
• This assumption can lead to security vulnerabilities when specific data is more sensitive than general data.

Purpose of the Study:

• To challenge the conventional understanding of ABAC semantics.
• To differentiate between two distinct ABAC semantics based on object attribute interpretation.
• To identify and address potential security misconfigurations arising from these semantics.

Main Methods:

• Conceptual analysis of ABAC semantics.
• Development of concrete examples illustrating the two identified semantics.
• Empirical and anecdotal evidence of security risks associated with current ABAC implementations.
• Proposal of modifications to existing ABAC algorithms for enhanced security.

Main Results:

• Identified two distinct ABAC semantics based on object attribute interpretation.
• Demonstrated that the conventional understanding of hierarchical inheritance can be inappropriate and lead to security breaches.
• Empirically and anecdotally validated the risks of misinterpreting ABAC semantics.
• Proposed modifications to existing algorithms to prevent misconfigurations and ensure security.

Conclusions:

• The standard interpretation of ABAC semantics is not universally applicable.
• Ignoring the nuances of object attribute semantics can lead to significant security flaws.
• Modified ABAC algorithms are necessary to ensure robust security and prevent misconfigurations in diverse scenarios.