Presentation is loading. Please wait.

Presentation is loading. Please wait.

Attribute-Based Access Control Models and Beyond

Published byTheresa Singleton Modified over 9 years ago

Similar presentations

Presentation on theme: "Attribute-Based Access Control Models and Beyond"— Presentation transcript:

1 Attribute-Based Access Control Models and Beyond
Prof. Ravi Sandhu Executive Director, Institute for Cyber Security Lutcher Brown Endowed Chair in Cyber Security University of Texas at San Antonio AsiaCCS Keynote Talk Singapore April 16, 2015 © Ravi Sandhu World-Leading Research with Real-World Impact!

2 Access Control Discretionary Access Control (DAC), 1970
Mandatory Access Control (MAC), 1970 Role Based Access Control (RBAC), 1995 Attribute Based Access Control (ABAC), ???? © Ravi Sandhu World-Leading Research with Real-World Impact! 2

3 PEI Models Idealized Enforceable (Approximate) Codeable
© Ravi Sandhu World-Leading Research with Real-World Impact! 3

4 Access Control Discretionary Access Control (DAC), 1970
Mandatory Access Control (MAC), 1970 Role Based Access Control (RBAC), 1995 Attribute Based Access Control (ABAC), ???? © Ravi Sandhu World-Leading Research with Real-World Impact! 4

5 Access Control Fixed policy Discretionary Access Control (DAC), 1970
Mandatory Access Control (MAC), 1970 Role Based Access Control (RBAC), 1995 Attribute Based Access Control (ABAC), ???? Flexible policy © Ravi Sandhu World-Leading Research with Real-World Impact! 5

6 Access Control Enterprise Oriented
Discretionary Access Control (DAC), 1970 Mandatory Access Control (MAC), 1970 Role Based Access Control (RBAC), 1995 Attribute Based Access Control (ABAC), ???? Beyond Enterprise © Ravi Sandhu World-Leading Research with Real-World Impact! 6

7 Access Control Administration Driven
Discretionary Access Control (DAC), 1970 Mandatory Access Control (MAC), 1970 Role Based Access Control (RBAC), 1995 Attribute Based Access Control (ABAC), ???? Automated Adaptive © Ravi Sandhu World-Leading Research with Real-World Impact! 7

8 RBAC96 Model Constraints
© Ravi Sandhu World-Leading Research with Real-World Impact! 8

9 Fundamental Theorem of RBAC
RBAC can be configured to do MAC RBAC can be configured to do DAC RBAC is policy neutral RBAC is neither MAC nor DAC! © Ravi Sandhu World-Leading Research with Real-World Impact! 9

10 RBAC Shortcomings Constraints Hard Enough Impossible
© Ravi Sandhu World-Leading Research with Real-World Impact! 10

11 The RBAC Story NIST-ANSI Standard Adopted NIST-ANSI Standard Proposed
model Ludwig Fuchs, Gunther Pernul and Ravi Sandhu, Roles in Information Security-A Survey and Classification of the Research Area, Computers & Security, Volume 30, Number 8, Nov. 2011, pages © Ravi Sandhu World-Leading Research with Real-World Impact! 11

12 ABAC Status 1990? 2015 ABAC still in pre/early phase Standard Adopted
Proposed Standard RBAC96 paper 1990? 2015 ABAC still in pre/early phase © Ravi Sandhu World-Leading Research with Real-World Impact! 12

13 ABAC is not New User (Identity) Attributes Public-keys +
Secured secrets © Ravi Sandhu World-Leading Research with Real-World Impact!

14 Identity Certificates
ABAC is not New User (Identity) X.500 Directory X.509 Identity Certificates Attributes Public-keys + Secured secrets Pre Internet, early 1990s © Ravi Sandhu World-Leading Research with Real-World Impact!

15 Identity Certificates
ABAC is not New User (Identity) X.509 Attribute Certificates X.509 Identity Certificates Attributes Public-keys + Secured secrets Post Internet, late 1990s © Ravi Sandhu World-Leading Research with Real-World Impact!

16 ABAC is not New SPKI Certificates Post Internet, late 1990s
User (Identity) Attributes Public-keys + Secured secrets SPKI Certificates Post Internet, late 1990s © Ravi Sandhu World-Leading Research with Real-World Impact!

17 ABAC is not New Anonymous Credentials Mature Internet, 2000s
User (Identity) Attributes Public-keys + Secured secrets Anonymous Credentials Mature Internet, 2000s © Ravi Sandhu World-Leading Research with Real-World Impact!

18 Authorization Decision
ABAC is not New Attributes Authorization Decision Action User Subject Object Context Policy Yes/No XACML Mature Internet, 2000s © Ravi Sandhu World-Leading Research with Real-World Impact!

19 ABAC is not New Usage Control Models, early 2000s
unified model integrating authorization obligation conditions and incorporating continuity of decisions mutability of attributes Usage Control Models, early 2000s © Ravi Sandhu World-Leading Research with Real-World Impact!

20 ABAC Status 1990? 2015 ABAC still in pre/early phase Standard Adopted
Proposed Standard RBAC96 paper 1990? 2015 ABAC still in pre/early phase © Ravi Sandhu World-Leading Research with Real-World Impact! 20

21 Access Control Discretionary Access Control (DAC), 1970
Mandatory Access Control (MAC), 1970 Role Based Access Control (RBAC), 1995 Attribute Based Access Control (ABAC), ???? © Ravi Sandhu World-Leading Research with Real-World Impact! 21

22 Can be configured to do simple forms of DAC, MAC, RBAC
ABACα Model Structure Policy Configuration Points Can be configured to do simple forms of DAC, MAC, RBAC © Ravi Sandhu World-Leading Research with Real-World Impact! 22

23 RBAC Extensions 1,4 1, 2, 4, 5 1, 4, 5 4, 5 1, 2, 3, 4, 5 Give examples about what is excluded 4 1, 4, 5 1. Context Attributes 2. Subject attribute constraints policy are different at creation and modification time. 4. Policy Language 5. Meta-Attributes 3. Subject attributes constrained by attributes of subjects created by the same user. World-Leading Research with Real-World Impact! 23

24 Can be configured to do many
ABACβ Model Show abac-alpha Then for each type of extension, highlight the extensions to ABAC 23 and 24 integrated Can be configured to do many RBAC extensions 24

25 SOME RESEARCH CHALLENGES
© Ravi Sandhu World-Leading Research with Real-World Impact!

26 Ultimate Unified Model
Attributes Security Access Control Trust Risk Relationships Provenance © Ravi Sandhu World-Leading Research with Real-World Impact!

27 Expressive Power Idealized Enforceable (Approximate) Codeable
© Ravi Sandhu World-Leading Research with Real-World Impact! 27

28 Safety Analysis Idealized Enforceable (Approximate) Codeable
© Ravi Sandhu World-Leading Research with Real-World Impact! 28

29 Attribute and Policy Engineering
Show abac-alpha Then for each type of extension, highlight the extensions to ABAC 23 and 24 integrated 29

30 Application Domains Cloud computing Internet of Things ……….
© Ravi Sandhu World-Leading Research with Real-World Impact! 30

31 Access Control Discretionary Access Control (DAC), 1970
Mandatory Access Control (MAC), 1970 Role Based Access Control (RBAC), 1995 Attribute Based Access Control (ABAC), ???? © Ravi Sandhu World-Leading Research with Real-World Impact! 31

Download ppt "Attribute-Based Access Control Models and Beyond"

Similar presentations

INSTITUTE FOR CYBER SECURITY 1 Trusted Computing Models Prof. Ravi Sandhu Executive Director and Endowed Chair Institute for Cyber Security University.

INSTITUTE FOR CYBER SECURITY 1 Trusted Computing Models Prof. Ravi Sandhu Executive Director and Endowed Chair Institute for Cyber Security University.
INSTITUTE FOR CYBER SECURITY 1 The ASCAA * Principles Applied to Usage Control Prof. Ravi Sandhu Executive Director and Endowed Chair Institute for Cyber.

INSTITUTE FOR CYBER SECURITY 1 The ASCAA * Principles Applied to Usage Control Prof. Ravi Sandhu Executive Director and Endowed Chair Institute for Cyber.
INSTITUTE FOR CYBER SECURITY 1 Application-Centric Security: How to Get There Prof. Ravi Sandhu Executive Director and Endowed Chair Institute for Cyber.

INSTITUTE FOR CYBER SECURITY 1 Application-Centric Security: How to Get There Prof. Ravi Sandhu Executive Director and Endowed Chair Institute for Cyber.
INSTITUTE FOR CYBER SECURITY April 20081 Access Control and Semantic Web Technologies Ravi Sandhu Executive Director and Endowed Chair Institute for Cyber.

INSTITUTE FOR CYBER SECURITY April Access Control and Semantic Web Technologies Ravi Sandhu Executive Director and Endowed Chair Institute for Cyber.
INSTITUTE FOR CYBER SECURITY 1 The PEI Framework for Application-Centric Security Prof. Ravi Sandhu Executive Director and Endowed Chair Institute for.

INSTITUTE FOR CYBER SECURITY 1 The PEI Framework for Application-Centric Security Prof. Ravi Sandhu Executive Director and Endowed Chair Institute for.
Institute for Cyber Security ASCAA Principles for Next-Generation Role-Based Access Control Ravi Sandhu Executive Director and Endowed Chair Institute.

Institute for Cyber Security ASCAA Principles for Next-Generation Role-Based Access Control Ravi Sandhu Executive Director and Endowed Chair Institute.
1 Access Control Models Prof. Ravi Sandhu Executive Director and Endowed Chair January 25, 2013 & February 1, 2013

1 Access Control Models Prof. Ravi Sandhu Executive Director and Endowed Chair January 25, 2013 & February 1, 2013
1 Grand Challenges in Data Usage Control Prof. Ravi Sandhu Executive Director and Endowed Chair

1 Grand Challenges in Data Usage Control Prof. Ravi Sandhu Executive Director and Endowed Chair
1 The Future of Access Control: Attributes, Automation and Adaptation Prof. Ravi Sandhu Executive Director and Endowed Chair S&P Symposium IIT Kanpur March.

1 The Future of Access Control: Attributes, Automation and Adaptation Prof. Ravi Sandhu Executive Director and Endowed Chair S&P Symposium IIT Kanpur March.
1 The Science, Engineering, and Business of Cyber Security Prof. Ravi Sandhu Executive Director, Institute for Cyber Security Lutcher Brown Endowed Chair.

1 The Science, Engineering, and Business of Cyber Security Prof. Ravi Sandhu Executive Director, Institute for Cyber Security Lutcher Brown Endowed Chair.
Future of Access Control: Attributes, Automation, Adaptation

Future of Access Control: Attributes, Automation, Adaptation
1 A Unified Attribute-Based Access Control Model Covering DAC, MAC and RBAC Prof. Ravi Sandhu Executive Director and Endowed Chair DBSEC July 11, 2012.

1 A Unified Attribute-Based Access Control Model Covering DAC, MAC and RBAC Prof. Ravi Sandhu Executive Director and Endowed Chair DBSEC July 11, 2012.
1 Security and Trust Convergence: Attributes, Relations and Provenance Prof. Ravi Sandhu Executive Director, Institute for Cyber Security Lutcher Brown.

1 Security and Trust Convergence: Attributes, Relations and Provenance Prof. Ravi Sandhu Executive Director, Institute for Cyber Security Lutcher Brown.
1 Plenary Panel on Cloud Security and Privacy: What is new and What needs to be done? Ravi Sandhu Executive Director and Endowed Professor December 2010.

1 Plenary Panel on Cloud Security and Privacy: What is new and What needs to be done? Ravi Sandhu Executive Director and Endowed Professor December 2010.
1 Attribute-Based Access Control Models and Beyond Prof. Ravi Sandhu Executive Director, Institute for Cyber Security Lutcher Brown Endowed Chair in Cyber.

1 Attribute-Based Access Control Models and Beyond Prof. Ravi Sandhu Executive Director, Institute for Cyber Security Lutcher Brown Endowed Chair in Cyber.
1 Privacy and Access Control: How are These Two Concepts Related? Prof. Ravi Sandhu Executive Director and Endowed Chair SACMAT Panel June 3, 2015

1 Privacy and Access Control: How are These Two Concepts Related? Prof. Ravi Sandhu Executive Director and Endowed Chair SACMAT Panel June 3, 2015
11 World-Leading Research with Real-World Impact! Role and Attribute Based Collaborative Administration of Intra-Tenant Cloud IaaS (Invited Paper) Xin.

11 World-Leading Research with Real-World Impact! Role and Attribute Based Collaborative Administration of Intra-Tenant Cloud IaaS (Invited Paper) Xin.
INSTITUTE FOR CYBER SECURITY 1 Cyber Security: Past, Present and Future Prof. Ravi Sandhu Executive Director and Endowed Chair Institute for Cyber Security.

INSTITUTE FOR CYBER SECURITY 1 Cyber Security: Past, Present and Future Prof. Ravi Sandhu Executive Director and Endowed Chair Institute for Cyber Security.
1 Institute for Cyber Security Prof. Ravi Sandhu Executive Director and Endowed Chair February 4, 2015

1 Institute for Cyber Security Prof. Ravi Sandhu Executive Director and Endowed Chair February 4, 2015
1 The Science, Engineering, and Business of Cyber Security Prof. Ravi Sandhu Executive Director, Institute for Cyber Security Lutcher Brown Endowed Chair.

1 The Science, Engineering, and Business of Cyber Security Prof. Ravi Sandhu Executive Director, Institute for Cyber Security Lutcher Brown Endowed Chair.

Similar presentations

Ads by Google