Presentation is loading. Please wait.

Presentation is loading. Please wait.

Institute for Cyber Security

Published byMitchell Randall Modified over 6 years ago

Similar presentations

Presentation on theme: "Institute for Cyber Security"— Presentation transcript:

1 Institute for Cyber Security
Attribute-Based Access Control: Insights and Challenges Prof. Ravi Sandhu Executive Director and Endowed Chair DBSec Philadelphia July 19, 2017 © Ravi Sandhu World-Leading Research with Real-World Impact!

2 Access Control Evolution
Discretionary Access Control (DAC), 1970 Mandatory Access Control (MAC), 1970 Role Based Access Control (RBAC), 1995 Attribute Based Access Control (ABAC), ???? © Ravi Sandhu World-Leading Research with Real-World Impact! 2

3 Access Control Evolution
Discretionary Access Control (DAC), 1970 Mandatory Access Control (MAC), 1970 Role Based Access Control (RBAC), 1995 Attribute Based Access Control (ABAC), ???? Born 1990s © Ravi Sandhu World-Leading Research with Real-World Impact! 3

4 Access Control Evolution
Discretionary Access Control (DAC), 1970 Mandatory Access Control (MAC), 1970 Relationship Based Access Control (ReBAC) ???? Role Based Access Control (RBAC), 1995 Provenance Based Access Control (PBAC) ???? Born mid 2000s Born late 2000s Attribute Based Access Control (ABAC), ???? Born 1990s © Ravi Sandhu World-Leading Research with Real-World Impact! 4

5 ABAC = Final Word? NO!! Never!! Is ABAC the right word for the moment?
Certainly a strong candidate Already too late? ReBAC (relationship-based access control) not ABAC Big Data, Analytics and AI will take care of everything What is lacking in ABAC? Usage Control (UCON) concepts of attribute mutability, enforcement and obligation continuity, and post-obligations Task-Based Access Control Risk-Based Access Control Policy-Based Access Control ……………. © Ravi Sandhu World-Leading Research with Real-World Impact! 5

6 The ABAC Challenge ABAC is orders of magnitude more complex than anything that has been an Access Control winner so far (DAC, MAC, RBAC) We need the complexity, but need to manage it If Google can index the web, we can do ABAC!! Cloud-enabled IoT may be the killer app © Ravi Sandhu World-Leading Research with Real-World Impact! 6

7 ABAC Research Agenda 7. ABAC Design, Engineering and Applications
3. Administrative ABAC Models 4. Extended ABAC Models 5. ABAC Policy Architectures and Languages 6. ABAC Enforcement Architectures 2. Core ABAC Models 1. Foundational Principles and Theory Based on RBAC experience © Ravi Sandhu World-Leading Research with Real-World Impact! 7

8 ABAC Research Agenda 2. Core ABAC Models
7. ABAC Design, Engineering and Applications 3. Administrative ABAC Models 4. Extended ABAC Models 5. ABAC Policy Architectures and Languages 6. ABAC Enforcement Architectures 2. Core ABAC Models 1. Foundational Principles and Theory © Ravi Sandhu World-Leading Research with Real-World Impact! 8

9 2. Core ABAC Models: UCON Usage Control Models, early 2000s
unified model integrating authorization obligation conditions and incorporating continuity of decisions mutability of attributes Usage Control Models, early 2000s Park, Sandhu, Pretschner © Ravi Sandhu World-Leading Research with Real-World Impact! 9

10 Can be configured to do simple forms of DAC, MAC, RBAC
2. Core ABAC Models: ABACα Policy Configuration Points Can be configured to do simple forms of DAC, MAC, RBAC Jin, Krishnan, Sandhu 2012 © Ravi Sandhu World-Leading Research with Real-World Impact! 10

11 Can further be configured to do many
2. Core ABAC Models: ABACβ Can further be configured to do many RBAC extensions Jin, Krishnan, Sandhu 2014 © Ravi Sandhu World-Leading Research with Real-World Impact! 11

12 2. Core ABAC Models: HGABAC
U: User UG: User-Group S: Subject UA: User Attributes O: Object OG: Object-Group OA: Object Attributes OP: Operations Hierarchical Group and Attribute Based Access Control (HGABAC) Introduces the notion of User and Object Groups Core advantage is simplified administration of attributes User and Objects are assigned set of attributes in one go as compared to single assignment at a time. Servos and Osborn, 2015 © Ravi Sandhu World-Leading Research with Real-World Impact!

13 ABAC Research Agenda 7. ABAC Design, Engineering and Applications
3. Administrative ABAC Models 4. Extended ABAC Models 5. ABAC Policy Architectures and Languages 6. ABAC Enforcement Architectures 2. Core ABAC Models 1. Foundational Principles and Theory © Ravi Sandhu World-Leading Research with Real-World Impact! 13

14 3. Administrative ABAC Models: GURA and GURAG
Jin, Krishnan, Sandhu, 2012 Gupta, Sandhu, 2016 © Ravi Sandhu World-Leading Research with Real-World Impact! 14

15 ABAC Research Agenda 7. ABAC Design, Engineering and Applications
3. Administrative ABAC Models 4. Extended ABAC Models 5. ABAC Policy Architectures and Languages 6. ABAC Enforcement Architectures 2. Core ABAC Models 1. Foundational Principles and Theory © Ravi Sandhu World-Leading Research with Real-World Impact! 15

16 4. Extended ABAC Models: ReBAC versus ABAC
ReBAC Framework Ahmed and Sandhu, 2017 © Ravi Sandhu World-Leading Research with Real-World Impact! 16

17 4. Extended ABAC Models: ReBAC versus ABAC
ABAC Framework © Ravi Sandhu World-Leading Research with Real-World Impact! 17

18 4. Extended ABAC Models: ReBAC versus ABAC
Equivalence of ReBAC and ABAC Structural Variants © Ravi Sandhu World-Leading Research with Real-World Impact! 18

19 4. Extended ABAC Models: ReBAC versus ABAC
Non-Equivalence of ReBAC and ABAC Variants © Ravi Sandhu World-Leading Research with Real-World Impact! 19

20 1. Foundational Principles and Theory
ABAC Research Agenda 7. ABAC Design, Engineering and Applications 3. Administrative ABAC Models 4. Extended ABAC Models 5. ABAC Policy Architectures and Languages 6. ABAC Enforcement Architectures 2. Core ABAC Models 1. Foundational Principles and Theory © Ravi Sandhu World-Leading Research with Real-World Impact! 20

21 1. Foundations: Safety A single infinite attribute with no creation leads to undecidable safety. Rajkumar 2012 Pre_UCON with finite attributes and unbounded creation has decidable safety. Rajkumar, Sandhu 2016 ABACα has decidable safety. Ahmed, Sandhu 2017 GURA has decidable safety/reachability. Jin, Krishnan, Sandhu 2017 © Ravi Sandhu World-Leading Research with Real-World Impact! 21

22 Architectures and Languages
ABAC Research Agenda 7. ABAC Design, Engineering and Applications 3. Administrative ABAC Models 4. Extended ABAC Models 5. ABAC Policy Architectures and Languages 6. ABAC Enforcement Architectures 2. Core ABAC Models 1. Foundational Principles and Theory © Ravi Sandhu World-Leading Research with Real-World Impact! 22

23 5. Policy Architecture: Centralized ABACα style
Policy Configuration Points © Ravi Sandhu World-Leading Research with Real-World Impact! 23

24 5. Policy Architecture: Diffused AWS style
© Ravi Sandhu World-Leading Research with Real-World Impact! 24

25 6. ABAC Enforcement Architectures
ABAC Research Agenda 7. ABAC Design, Engineering and Applications 3. Administrative ABAC Models 4. Extended ABAC Models 5. ABAC Policy Architectures and Languages 6. ABAC Enforcement Architectures 2. Core ABAC Models 1. Foundational Principles and Theory © Ravi Sandhu World-Leading Research with Real-World Impact! 25

26 6. ABAC Enforcement Architecture: Federated ABAC
Fisher 2015 NCCOE, NIST, Building Block © Ravi Sandhu World-Leading Research with Real-World Impact! 26

27 7. ABAC Design, Engineering and Applications
ABAC Research Agenda 7. ABAC Design, Engineering and Applications 3. Administrative ABAC Models 4. Extended ABAC Models 5. ABAC Policy Architectures and Languages 6. ABAC Enforcement Architectures 2. Core ABAC Models 1. Foundational Principles and Theory © Ravi Sandhu World-Leading Research with Real-World Impact! 27

28 7. ABAC Applications: Cloud IaaS
Cloud Computing IaaS Single tenant Multi tenant Multi cloud Jin, Tang, Dang, Bijon, Pustchi, Zhang, Biswas, Ahmed, Cheng, Patwa, Krishnan, Sandhu 2012 onwards © Ravi Sandhu World-Leading Research with Real-World Impact! 28

29 7. ABAC Applications: Cloud Enabled IoT
Alsheri, Bhatt, Patwa, Benson, Sandhu 2016 onwards © Ravi Sandhu World-Leading Research with Real-World Impact! 29

30 ABAC Research Agenda 7. ABAC Design, Engineering and Applications
3. Administrative ABAC Models 4. Extended ABAC Models 5. ABAC Policy Architectures and Languages 6. ABAC Enforcement Architectures 2. Core ABAC Models 1. Foundational Principles and Theory © Ravi Sandhu World-Leading Research with Real-World Impact! 30

Download ppt "Institute for Cyber Security"

Similar presentations

INSTITUTE FOR CYBER SECURITY 1 Trusted Computing Models Prof. Ravi Sandhu Executive Director and Endowed Chair Institute for Cyber Security University.

INSTITUTE FOR CYBER SECURITY 1 Trusted Computing Models Prof. Ravi Sandhu Executive Director and Endowed Chair Institute for Cyber Security University.
INSTITUTE FOR CYBER SECURITY 1 The ASCAA * Principles Applied to Usage Control Prof. Ravi Sandhu Executive Director and Endowed Chair Institute for Cyber.

INSTITUTE FOR CYBER SECURITY 1 The ASCAA * Principles Applied to Usage Control Prof. Ravi Sandhu Executive Director and Endowed Chair Institute for Cyber.
INSTITUTE FOR CYBER SECURITY 1 Application-Centric Security: How to Get There Prof. Ravi Sandhu Executive Director and Endowed Chair Institute for Cyber.

INSTITUTE FOR CYBER SECURITY 1 Application-Centric Security: How to Get There Prof. Ravi Sandhu Executive Director and Endowed Chair Institute for Cyber.
INSTITUTE FOR CYBER SECURITY April 20081 Access Control and Semantic Web Technologies Ravi Sandhu Executive Director and Endowed Chair Institute for Cyber.

INSTITUTE FOR CYBER SECURITY April Access Control and Semantic Web Technologies Ravi Sandhu Executive Director and Endowed Chair Institute for Cyber.
1 PANEL Solving the Access Control Puzzle: Finding the Pieces and Putting Them Together Ravi Sandhu Executive Director Endowed Professor June 2010

1 PANEL Solving the Access Control Puzzle: Finding the Pieces and Putting Them Together Ravi Sandhu Executive Director Endowed Professor June 2010
Institute for Cyber Security

Institute for Cyber Security
Institute for Cyber Security ASCAA Principles for Next-Generation Role-Based Access Control Ravi Sandhu Executive Director and Endowed Chair Institute.

Institute for Cyber Security ASCAA Principles for Next-Generation Role-Based Access Control Ravi Sandhu Executive Director and Endowed Chair Institute.
Institute for Cyber Security

Institute for Cyber Security
1 Access Control Models Prof. Ravi Sandhu Executive Director and Endowed Chair January 25, 2013 & February 1, 2013

1 Access Control Models Prof. Ravi Sandhu Executive Director and Endowed Chair January 25, 2013 & February 1, 2013
1 The Future of Access Control: Attributes, Automation and Adaptation Prof. Ravi Sandhu Executive Director and Endowed Chair S&P Symposium IIT Kanpur March.

1 The Future of Access Control: Attributes, Automation and Adaptation Prof. Ravi Sandhu Executive Director and Endowed Chair S&P Symposium IIT Kanpur March.
Future of Access Control: Attributes, Automation, Adaptation

Future of Access Control: Attributes, Automation, Adaptation
1 A Unified Attribute-Based Access Control Model Covering DAC, MAC and RBAC Prof. Ravi Sandhu Executive Director and Endowed Chair DBSEC July 11, 2012.

1 A Unified Attribute-Based Access Control Model Covering DAC, MAC and RBAC Prof. Ravi Sandhu Executive Director and Endowed Chair DBSEC July 11, 2012.
1 Security and Trust Convergence: Attributes, Relations and Provenance Prof. Ravi Sandhu Executive Director, Institute for Cyber Security Lutcher Brown.

1 Security and Trust Convergence: Attributes, Relations and Provenance Prof. Ravi Sandhu Executive Director, Institute for Cyber Security Lutcher Brown.
Attribute-Based Access Control Models and Beyond

Attribute-Based Access Control Models and Beyond
1 Attribute-Based Access Control Models and Beyond Prof. Ravi Sandhu Executive Director, Institute for Cyber Security Lutcher Brown Endowed Chair in Cyber.

1 Attribute-Based Access Control Models and Beyond Prof. Ravi Sandhu Executive Director, Institute for Cyber Security Lutcher Brown Endowed Chair in Cyber.
11 World-Leading Research with Real-World Impact! Role and Attribute Based Collaborative Administration of Intra-Tenant Cloud IaaS (Invited Paper) Xin.

11 World-Leading Research with Real-World Impact! Role and Attribute Based Collaborative Administration of Intra-Tenant Cloud IaaS (Invited Paper) Xin.
1 A Role Based Administration Model For Attribute Xin Jin, Ram Krishnan, Ravi Sandhu SRAS, Sep 19, 2012 World-Leading Research with Real-World Impact!

1 A Role Based Administration Model For Attribute Xin Jin, Ram Krishnan, Ravi Sandhu SRAS, Sep 19, 2012 World-Leading Research with Real-World Impact!
1 Institute for Cyber Security Prof. Ravi Sandhu Executive Director and Endowed Chair February 4, 2015

1 Institute for Cyber Security Prof. Ravi Sandhu Executive Director and Endowed Chair February 4, 2015
1 The Science, Engineering, and Business of Cyber Security Prof. Ravi Sandhu Executive Director, Institute for Cyber Security Lutcher Brown Endowed Chair.

1 The Science, Engineering, and Business of Cyber Security Prof. Ravi Sandhu Executive Director, Institute for Cyber Security Lutcher Brown Endowed Chair.
1 Grand Challenges in Authorization Systems Prof. Ravi Sandhu Executive Director and Endowed Chair November 14, 2011

1 Grand Challenges in Authorization Systems Prof. Ravi Sandhu Executive Director and Endowed Chair November 14, 2011

Similar presentations

Ads by Google