Formal Approach to Detect and Resolve Anomalies while Clustering ABAC Policies

With the increasingly strict requirement for computer system security, access control models have become more complex. Existing models, such as discretionary access control (DAC) model, mandatory access control (MAC) model, role based access control (RBAC) model, and attribute based access control (ABAC) model, all have advantages and disadvantages regarding practicability and security. In addition, there is an inherent security risk in these access control models. The models merely control the access permission, but ignore the verification for the identity credibility of the entities involved in the access. With the proposal of trusted computing and the application of trusted platform, it is possible to implement, on stand-alone computers, the verification of identity credibility for the entities involved in the access. In this paper, we analyze the authorization and access decision policy of the RBAC model and the ABAC model. The characteristics of the trusted computing, which can ensure the identity credibility of the entities involved in the access, is also considered. Based on the above analysis, we establish a trusted computing based enhanced access control (TCBEAC) model, which can be deployed on stand-alone computers for common users.

A Virtual Organization (VO) consists of some real organizations with common interests, which aims to provide inter organizational associations to reach some common goals by sharing their resources with each other. Providing security mechanisms, and especially a suitable access control mechanism, which enforces the defined security policy is a necessary requirement in VOs. Since VO is a complex environment with the huge number of users and resources, traditional access control models cannot satisfy VOs security requirements. Most of the current proposals are basically based on the attributes of users and resources. In this paper, we suggest using a combination of the semantic based access control (SBAC) model, and the attribute based access control (ABAC) model with the shared ontology of subjects' attributes in VOs. In this model, each participating organization makes its access control decisions according to an enhanced model of the ABAC model. However, access decision in the VO is made in more abstract level through an enhanced model of theSBACmodel. Using the ontology of users and resources in this model facilitates access control in large scale VOs with numerous organizations. By the combination ofSBACand ABAC, we attain their benefits and eliminate their shortcomings. In order to show the applicability of the proposed model, an access control system, based on the proposed model, has been implemented in Java using available APIs, including Sun's XACML API, Jena, Pellet, and Protege.

Chapter 23 - Policies, Access Control, and Formal Methods

In this disseration we propose semi-automated top-down policy engineering approaches for attribute-based access control (ABAC) development. Further, we propose a hybrid ABAC policy engineering approach to combine the benefits and address the shortcomings of both top-down and bottom-up approaches. In particular, we propose three frameworks: (i) ABAC attributes extraction, (ii) ABAC constraints extraction, and (iii) hybrid ABAC policy engineering. Attributes extraction framework comprises of five modules that operate together to extract attributes values from natural language access control policies (NLACPs); map the extracted values to attribute keys; and assign each key-value pair to an appropriate entity. For ABAC constraints extraction framework, we design a two-phase process to extract ABAC constraints from NLACPs. The process begins with the identification phase which focuses on identifying the right boundary of constraint expressions. Next is the normalization phase, that aims at extracting the actual elements that pose a constraint. On the other hand, our hybrid ABAC policy engineering framework consists of 5 modules. This framework combines top-down and bottom-up policy engineering techniques to overcome the shortcomings of both approaches and to generate policies that are more intuitive and relevant to actual organization policies. With this, we believe that our work takes essential steps towards a semi-automated ABAC policy development experience.

Access control policies are crucial for establishing a secure access control system and are fundamentally based on access control models such as attribute-based access control (ABAC). Moreover, the execution of business process instances is generally recorded within an event log. It is essential to ensure conformance with ABAC policies for the event log at the time of post-execution. To conduct conformance testing of ABAC policies in business process event logs, formalizing these ABAC policies is necessary. However, the formalization is typically carried out manually, which leads to inefficiencies, low maintainability, a high likelihood of errors, and difficulty in detecting the errors. Also, there has been a notable lack of an access control metamodel to support the formalization and conformance testing of ABAC policies, as well as insufficient attention to constructing ABAC policies from existing process logs. This paper presents a model-driven workflow for significantly automating the formalization and conformance testing of ABAC policies in process logs. By leveraging a novel ABAC metamodel and its reusable patterns, the approach addresses the aforementioned issues, demonstrating effectiveness through experiments on a real-world process log.

Smart homes are interconnected homes in which a wide variety of digital devices with limited resources communicate with multiple users and among themselves using multiple protocols. The deployment of resource-limited devices and the use of a wide range of technologies expand the attack surface and position the smart home as a target for many potential security threats. Access control is among the top security challenges in smart home IoT. Several access control models have been developed or adapted for IoT in general, with a few specifically designed for the smart home IoT domain. Most of these models are built on the role-based access control (RBAC) model or the attribute-based access control (ABAC) model. However, recently some researchers demonstrated that the need arises for a hybrid model combining ABAC and RBAC, thereby incorporating the benefits of both models to better meet IoT access control challenges in general and smart homes requirements in particular. In this paper, we used two approaches to develop two different hybrid models for smart home IoT. We followed a role-centric approach and an attribute-centric approach to develop HyBAC <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$_{RC}$</tex-math></inline-formula> and HyBAC <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$_{AC}$</tex-math></inline-formula> , respectively. We formally define these models and illustrate their features through a use case scenario demonstration. We further provide a proof-of-concept implementation for each model in Amazon Web Services (AWS) IoT platform. Finally, we conduct a theoretical comparison between the two models proposed in this paper in addition to the EGRBAC model (RBAC model for smart home IoT) and HABAC model (ABAC model for smart home IoT), which were previously developed to meet smart homes' challenges.

We describe a method that centrally manages Attribute-Based Access Control (ABAC) policies and locally computes and enforces decisions regarding those policies for protection of resource repositories in host systems using their native Access Control List (ACL) mechanisms. The method is founded on the expression of an ABAC policy that conforms to the access control rules of an enterprise and leverages the ABAC policy expression by introducing representations of local host repositories into the ABAC policy expression as objects or object attributes. Repositories may be comprised of individual files, directories, or other resources that require protection. The method further maintains a correspondence between the ABAC representations and repositories in local host systems. The method also leverages an ability to conduct policy analytics in such a way as to formulate ACLs for those representations in accordance with the ABAC policy and create ACLs on repositories using the ACLs of their corresponding representations. As the ABAC policy configuration changes, the method updates the ACLs on affected representations and automatically updates corresponding ACLs on local repositories. Operationally, users attempt to access resources in local host systems, and the ABAC policy is enforced in those systems in terms of their native ACLs.

The area of smart homes is one of the most popular for deploying smart connected devices. One of the most vulnerable aspects of smart homes is access control. Recent advances in IoT have led to several access control models being developed or adapted to IoT from other domains, with few specifically designed to meet the challenges of smart homes. Most of these models use role-based access control (RBAC) or attribute-based access control (ABAC) models. As of now, it is not clear what the advantages and disadvantages of ABAC over RBAC are in general, and in the context of smart-home IoT in particular. In this paper, we introduce HABACα, an attribute-based access control model for smart-home IoT. We formally define HABACα and demonstrate its features through two use-case scenarios and a proof-of-concept implementation. Furthermore, we present an analysis of HABACα as compared to the previously published EGRBAC (extended generalized role-based access control) model for smart-home IoT by first describing approaches for constructing HABACα specification from EGRBAC and vice versa in order to compare the theoretical expressiveness power of these models, and second, analyzing HABACα and EGRBAC models against standard criteria for access control models. Our findings suggest that a hybrid model that combines both HABACα and EGRBAC capabilities may be the most suitable for smart-home IoT, and probably more generally.

The rapid growth of Internet of Things (IoT)-enabled smart home environments has amplified the need for robust, scalable, and context-aware access control mechanisms. Traditional Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC) models offer distinct advantages such as hierarchical simplicity and contextual granularity, respectively, yet exhibit critical limitations when deployed in isolation. To address these constraints, this study proposes and implements a discrete, hybrid RBAC–ABAC access control framework, engineered as a smart contract on the Binance Smart Chain (BSC), to ensure a secure, decentralized model for managing access to IoT resources. The framework leverages blockchain’s inherent strengths cryptographic integrity, immutable message digests, and tamper-resistant audit trails to reinforce data confidentiality and policy enforcement. Validated on a real-world testbed comprising ESP32-based IoT devices, a Raspberry Pi gateway, and a blockchain backend, the proposed system demonstrates enhanced resilience and trust. Quantitative evaluations benchmark the hybrid model against standalone RBAC and ABAC mechanisms across key metrics, including gas consumption, access latency, access decision accuracy, and scalability. The results indicate the hybrid model achieves superior accuracy (97.2%) and scalability (supporting 50 concurrent users and 30 devices), with moderate gas usage (15,000 gwei) and acceptable latency (1.8 seconds). Furthermore, the use of laser-secure transaction protocols and cryptographic primitives within the smart contract enhances the protection of access rights and resource interactions. This hybrid smart contract architecture not only bridges the gap between theoretical access control models and practical blockchain deployments but also sets a foundation for adaptive, secure, and decentralized policy enforcement in next-generation smart homes, particularly in resource-constrained environments.

Attribute Based Access Control (ABAC) models are designed with the intention to overcome the shortcomings of classical access control models (DAC, MAC and RBAC) and unifying their advantages. In ABAC, the access control is provided based on generic attributes of entities. Many organizational security policies condition access decisions on attributes. OWL can be used to formally define and process security policies that can be captured using ABAC models. We have defined models, domains, data and security policies in OWL and used a reasoner to decide what is permitted. In this paper we present a way to represent the ABACa model using Web Ontology Language (OWL). The enforcement of policies is done using the EYE reasoner that infers the logical relationship and deduce the access grant for each requested action.

In recent years, attribute-based access control (ABAC) models have been widely used in big data and cloud computing. However, with the growing importance of data content, using data content to assist authorization for access controls has become more common. In this paper, we propose a dynamic content-driven attribute-based access control model (CABAC) for large-scale unstructured data. CABAC is a fine-grained access control model that use two-layer authorization to balance efficiency and accuracy. The first-layer authorization uses attributes to grant users basic authority and the second-layer authorization uses data content to grant broader authority over “related” data. Experimental results show that CABAC has acceptable efficiency and it can expand the authority of users without reducing security.

Role-Based Access Control (RBAC) is the most commonly used model on web applications. The advantages of RBAC are the ease of understanding, applying and managing privileges. The static RBAC model cannot alter access permission in real-time without human involvement and therefore the model suffers from increasing false negative (and/or false positive) outcomes. Hence, the Attribute-Based Access Control (ABAC) model has been proposed to introduce dynamicity and minimize human involvement in order to enhance security. WordPress is a very popular Role-Based content management system. To our best knowledge, no solution to merge from RBAC to ABAC model for WordPress applications has been found. Our contribution is a WordPress plug-in that we have developed to build ABAC upon the existing RBAC setups. In this journey, we have investigated various scenarios by studying different application categories to come up with an enhanced automatic model that adds real-time grant and revoke feature to WordPress.

Access control policies are dynamic in nature, and therefore require frequent updates to synchronize with the latest organizational security requirements. As these updates are handled, it is important that all user access requests be answered contemporaneously and correctly without any interruption or delay. In this paper, considering the context of Attribute Based Access Control (ABAC), we propose an approach that is capable of immediately materializing any update to the policy and ensuring that it is taken into account for any subsequent access requests. One possibility is to update the policy based on the incoming changes through ABAC policy mining techniques. However, it turns out that no existing mining approach can offer correct enforcement of policies when access requests are entertained during the updates. We provide a formal proof for this surprising result and then propose an approach called δwOP that does not suffer from this problem. Essentially, δwOP keeps track of the needed information from updates and uses this in conjunction with the existing ABAC policy rules to make access decisions. We present the complexity analysis as well as a comprehensive experimental evaluation to demonstrate the efficacy of the proposed approach for different types of changes.

Due to the rapid development of large scale and big data systems, attribute-based access control (ABAC) model has inaugurated a new wave in the research field of access control. In this paper, we propose a novel and comprehensive mechanism for enforcing attribute-based security policies stored in JSON documents. We build a lightweight grammar for conditional expressions that are the combination of subject, resource, and environment attributes so that the policies are flexible, dynamic and fine grained. Besides, we also present an extension from the ABAC model for privacy protection with the approach of purpose usage. The notion of purpose is associated with levels of data disclosure and constraints to support more fine-grained privacy policies. A prototype built for the proposed model using Java and MongoDB has also presented in the paper. The experiment is carried out to illustrate the relationship between the processing time for access decision and the complexity of policies.

As network speed and storage capacities are rising faster and higher, the remote storage and ‘cloud’ concept is gaining momentum and is becoming increasingly popular with personal users as well as business users. At the same time, privacy awareness and business confidentially are important factors in every cloud and data sharing decision. For these and other reasons, the concept of access control models was developed in order to present complete solutions for privacy and confidentiality control in modern systems. Various access controls methodologies have been suggested in the literature, each simplifying and providing flexibility to previous methods. In this paper we will focus on two main methods which are Role Based Access Control (RBAC) and Attribute Based Access Control (ABAC). We will discuss the benefits and drawbacks of each of them, and therefore the need for a novel approach that combines the benefits of these two techniques. We are proposing a different hybrid model and justify how our suggested model and present why we think our suggested model (Policy RC-ABAC) will be more beneficiary in relation to a specific set of needs focusing on flexibility and auditability.