Semantically Correct Policy Mining and Enforcement for Attribute based Access Control.

In this disseration we propose semi-automated top-down policy engineering approaches for attribute-based access control (ABAC) development. Further, we propose a hybrid ABAC policy engineering approach to combine the benefits and address the shortcomings of both top-down and bottom-up approaches. In particular, we propose three frameworks: (i) ABAC attributes extraction, (ii) ABAC constraints extraction, and (iii) hybrid ABAC policy engineering. Attributes extraction framework comprises of five modules that operate together to extract attributes values from natural language access control policies (NLACPs); map the extracted values to attribute keys; and assign each key-value pair to an appropriate entity. For ABAC constraints extraction framework, we design a two-phase process to extract ABAC constraints from NLACPs. The process begins with the identification phase which focuses on identifying the right boundary of constraint expressions. Next is the normalization phase, that aims at extracting the actual elements that pose a constraint. On the other hand, our hybrid ABAC policy engineering framework consists of 5 modules. This framework combines top-down and bottom-up policy engineering techniques to overcome the shortcomings of both approaches and to generate policies that are more intuitive and relevant to actual organization policies. With this, we believe that our work takes essential steps towards a semi-automated ABAC policy development experience.

We describe a method that centrally manages Attribute-Based Access Control (ABAC) policies and locally computes and enforces decisions regarding those policies for protection of resource repositories in host systems using their native Access Control List (ACL) mechanisms. The method is founded on the expression of an ABAC policy that conforms to the access control rules of an enterprise and leverages the ABAC policy expression by introducing representations of local host repositories into the ABAC policy expression as objects or object attributes. Repositories may be comprised of individual files, directories, or other resources that require protection. The method further maintains a correspondence between the ABAC representations and repositories in local host systems. The method also leverages an ability to conduct policy analytics in such a way as to formulate ACLs for those representations in accordance with the ABAC policy and create ACLs on repositories using the ACLs of their corresponding representations. As the ABAC policy configuration changes, the method updates the ACLs on affected representations and automatically updates corresponding ACLs on local repositories. Operationally, users attempt to access resources in local host systems, and the ABAC policy is enforced in those systems in terms of their native ACLs.

Access control policies are crucial for establishing a secure access control system and are fundamentally based on access control models such as attribute-based access control (ABAC). Moreover, the execution of business process instances is generally recorded within an event log. It is essential to ensure conformance with ABAC policies for the event log at the time of post-execution. To conduct conformance testing of ABAC policies in business process event logs, formalizing these ABAC policies is necessary. However, the formalization is typically carried out manually, which leads to inefficiencies, low maintainability, a high likelihood of errors, and difficulty in detecting the errors. Also, there has been a notable lack of an access control metamodel to support the formalization and conformance testing of ABAC policies, as well as insufficient attention to constructing ABAC policies from existing process logs. This paper presents a model-driven workflow for significantly automating the formalization and conformance testing of ABAC policies in process logs. By leveraging a novel ABAC metamodel and its reusable patterns, the approach addresses the aforementioned issues, demonstrating effectiveness through experiments on a real-world process log.

Access control policies are dynamic in nature, and therefore require frequent updates to synchronize with the latest organizational security requirements. As these updates are handled, it is important that all user access requests be answered contemporaneously and correctly without any interruption or delay. In this paper, considering the context of Attribute Based Access Control (ABAC), we propose an approach that is capable of immediately materializing any update to the policy and ensuring that it is taken into account for any subsequent access requests. One possibility is to update the policy based on the incoming changes through ABAC policy mining techniques. However, it turns out that no existing mining approach can offer correct enforcement of policies when access requests are entertained during the updates. We provide a formal proof for this surprising result and then propose an approach called δwOP that does not suffer from this problem. Essentially, δwOP keeps track of the needed information from updates and uses this in conjunction with the existing ABAC policy rules to make access decisions. We present the complexity analysis as well as a comprehensive experimental evaluation to demonstrate the efficacy of the proposed approach for different types of changes.

Attribute Based Access Control (ABAC) models are designed with the intention to overcome the shortcomings of classical access control models (DAC, MAC and RBAC) and unifying their advantages. In ABAC, the access control is provided based on generic attributes of entities. Many organizational security policies condition access decisions on attributes. OWL can be used to formally define and process security policies that can be captured using ABAC models. We have defined models, domains, data and security policies in OWL and used a reasoner to decide what is permitted. In this paper we present a way to represent the ABACa model using Web Ontology Language (OWL). The enforcement of policies is done using the EYE reasoner that infers the logical relationship and deduce the access grant for each requested action.

A Virtual Organization (VO) consists of some real organizations with common interests, which aims to provide inter organizational associations to reach some common goals by sharing their resources with each other. Providing security mechanisms, and especially a suitable access control mechanism, which enforces the defined security policy is a necessary requirement in VOs. Since VO is a complex environment with the huge number of users and resources, traditional access control models cannot satisfy VOs security requirements. Most of the current proposals are basically based on the attributes of users and resources. In this paper, we suggest using a combination of the semantic based access control (SBAC) model, and the attribute based access control (ABAC) model with the shared ontology of subjects' attributes in VOs. In this model, each participating organization makes its access control decisions according to an enhanced model of the ABAC model. However, access decision in the VO is made in more abstract level through an enhanced model of theSBACmodel. Using the ontology of users and resources in this model facilitates access control in large scale VOs with numerous organizations. By the combination ofSBACand ABAC, we attain their benefits and eliminate their shortcomings. In order to show the applicability of the proposed model, an access control system, based on the proposed model, has been implemented in Java using available APIs, including Sun's XACML API, Jena, Pellet, and Protege.

The enforcement of fine-grained access control policies in constrained dynamic networks can become a challenging task. The inherit constraints present in those networks, which result from the limitations of the edge devices in terms of power, computational capacity and storage, require an effective and efficient access control mechanism to be in place to provide suitable monitoring and control of actions and regulate the access over the resources. In this article, we present RESPOnSE, a framework for the specification and enforcement of security policies within such environments, where the computational burden is transferred to high-tier nodes, while low-tier nodes apply risk-aware policy enforcement. RESPOnSE builds on a combination of two widely used access control models, Attribute-Based Access Control and Role-Based Access Control, exploiting the benefits each one provides. Moreover, the proposed mechanism is founded on a compensatory multicriteria decision-making algorithm, based on the calculation of the Euclidean distance between the run-time values of the attributes present in the security policy and their ideal values, as those are specified within the established policy rules.

In the modern computing era, access to resources is often restricted through contextual information and the attributes of users, objects and various other entities. Attribute-Based Access Control (ABAC) can capture those requirements as a policy, but it is not yet adopted like Role Based Access Control (RBAC) due to lack of a comprehensive administrative model. In the last few years, several efforts have been made to combine ABAC with RBAC, but they are limited to specification and enforcement only. Recently, we have presented a unified framework along with a role based administrative model that enables specification, enforcement and maintenance of unified access control policies, such as ABAC, RBAC and Meta-Policy Based Access Control (MPBAC). This paper describes role-based administrative model components and then present a methodology which uses a fixed-point based approach for verifying the security properties (like safety and liveness) of those policies in the presence of the administrative model. We also analyse the impact of ABAC, RBAC, MPBAC and administrative model components on the time taken for security analysis. Experimental results demonstrate that the proposed approach is scalable as well as effective.

Healthcare systems are increasingly vulnerable to security threats due to their reliance on digital platforms. Traditional access control models like Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC) have limitations in mitigating evolving risks in these systems. Despite their unique features, these models face limitations in mitigating evolving risks in healthcare systems. Traditional models are primarily oriented towards allocating permissions according to predetermined roles or policies, which results in challenges in effectively adapting to the dynamic complexities of modern healthcare ecosystems. Therefore, this paper proposes a novel risk-aware RBAC and ABAC access control model to enhance the flexibility, adaptability and security issues associated with healthcare systems. The proposed model integrates RBAC for role-based categorization, ABAC for fine-grained control based on user attributes and environmental factors, and Risk-Based Access Control (RiBAC) for dynamic risk assessment. The proposed model dynamically adjusts access permissions based on risk values, ensuring accurate and adaptable access control decisions. The experimental results demonstrate the feasibility and effectiveness of the proposed model in granting access to authorized users while denying access to unauthorized users. Through a series of 43 experiments that simulate various scenarios of access control operations in the healthcare system, the proposed model demonstrates significant improvement in the accuracy, precision, and recall of access control decisions compared to traditional models. The proposed model’s ability to dynamically assess risk and adjust access permissions based on contextual factors significantly enhances its ability to mitigate threats and protect sensitive medical data.

The rapid growth of Internet of Things (IoT)-enabled smart home environments has amplified the need for robust, scalable, and context-aware access control mechanisms. Traditional Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC) models offer distinct advantages such as hierarchical simplicity and contextual granularity, respectively, yet exhibit critical limitations when deployed in isolation. To address these constraints, this study proposes and implements a discrete, hybrid RBAC–ABAC access control framework, engineered as a smart contract on the Binance Smart Chain (BSC), to ensure a secure, decentralized model for managing access to IoT resources. The framework leverages blockchain’s inherent strengths cryptographic integrity, immutable message digests, and tamper-resistant audit trails to reinforce data confidentiality and policy enforcement. Validated on a real-world testbed comprising ESP32-based IoT devices, a Raspberry Pi gateway, and a blockchain backend, the proposed system demonstrates enhanced resilience and trust. Quantitative evaluations benchmark the hybrid model against standalone RBAC and ABAC mechanisms across key metrics, including gas consumption, access latency, access decision accuracy, and scalability. The results indicate the hybrid model achieves superior accuracy (97.2%) and scalability (supporting 50 concurrent users and 30 devices), with moderate gas usage (15,000 gwei) and acceptable latency (1.8 seconds). Furthermore, the use of laser-secure transaction protocols and cryptographic primitives within the smart contract enhances the protection of access rights and resource interactions. This hybrid smart contract architecture not only bridges the gap between theoretical access control models and practical blockchain deployments but also sets a foundation for adaptive, secure, and decentralized policy enforcement in next-generation smart homes, particularly in resource-constrained environments.

[formula omitted]: A blockchain-based secure access control management for the Internet of Things

Role based access control (RBAC) is well known due to its high security and ease in management for permissions. But it also has some deficiencies like role structure complexity and having no dynamic behavior. Attribute based access control (ABAC) is a dynamic access control model that provides ease of role structuring. Analyzing roles and permissions after implementing access control model and its management is not easy in ABAC. In this paper, an access control model is developed that accumulates the strengths of RBAC and ABAC and also remove some of the deficiencies of above stated models. The proposed model implements and exploits the attributes of objects, permissions, roles, and users as foundation. Moreover the proposed model employs the role structuring ability of ABAC and tight security behavior of RBAC. We also implemented the proposed model and discussed with respect to a case study.

Providing the right information to the right person at the right time is critical, especially for emergency response and law enforcement operations. Accomplishing this across sovereign organizations while keeping resources secure is a formidable task. What is needed is an access control solution that can break down information silos by securely enabling information sharing with non-provisioned users in a dynamic environment. Multiple government agencies, including the Department of Homeland Security (DHS) Science and Technology Directorate (S&T) are currently developing Attribute-Based Access Control (ABAC) solutions to do just that. ABAC supports cross-organizational information sharing by facilitating policy-based resource access control. The critical components of an ABAC solution are the governing organizational policies, attribute syntax and semantics, and authoritative sources. The policies define the business objectives and the authoritative sources provide critical attribute attestation, but syntactic and semantic agreement between the information exchange endpoints is the linchpin of attribute sharing. The Organization for the Advancement of Structured Information Standards (OASIS) Security Assertion Markup Language (SAML) standard provides federation partners with a viable attribute sharing syntax, but establishing semantic agreement is an impediment to ABAC efforts. This critical issue can be successfully addressed with conceptual modeling. S&T is sponsoring the following research and development effort to provide a concept model of the User Identity, Credential, and Access Management decision space for secure information sharing.

In big data environments with big number of users and high volume of data, we need to manage the corresponding huge number of security policies. Using Attribute-Based Access Control (ABAC) model to ensure access control might become complex and hard to manage. Moreover, ABAC policies may be aggregat

While the DoD has a strong identity and credential management foundation, much work remains to achieve the DoD access control vision of providing dynamic access control with appropriate granularity. Ongoing access control investments are transitioning from administrators manually provisioning of user accounts to Attribute-Based Access Control (ABAC) capabilities. While this offers significant operational benefits over manual provisioning, ABAC capabilities must evolve. A limiting factor of the ABAC method is its reliance on the availability of authoritative attributes, and the need for access control policies that focus on specific access requests and still result in desired enterprise-wide operations. In today's DoD mission and business environments, there is a compelling need to provide authorized users, both anticipated and unanticipated, access to sensitive and classified enterprise information and the resources they need, when and where they need it, while preventing disclosure or exploitation by malicious insiders and other adversaries access to the same information. To meet this challenge, a DoD-wide Dynamic Access Management capability is needed by combining ABAC with risk management to achieve Risk Adaptive Access Control (RAdAC).