Semantic Attribute-Based Access Control An overview of the existing - - PowerPoint PPT Presentation

semantic attribute based access control
SMART_READER_LITE
LIVE PREVIEW

Semantic Attribute-Based Access Control An overview of the existing - - PowerPoint PPT Presentation

Semantic Attribute-Based Access Control An overview of the existing approaches Hamed Arshad Department of Informatics University of Oslo March 2018 Hamed Arshad (UiO) SABAC March 2018 1 / 25 Table of Contents Introduction 1


slide-1
SLIDE 1

Semantic Attribute-Based Access Control

An overview of the existing approaches Hamed Arshad

Department of Informatics University of Oslo

March 2018

Hamed Arshad (UiO) SABAC March 2018 1 / 25

slide-2
SLIDE 2

Table of Contents

1

Introduction

2

Attribute-Based Access Control (ABAC)

3

Semantic-Based Access Control (SBAC)

4

Semantic Attribute-Based Access Control (SABAC)

Hamed Arshad (UiO) SABAC March 2018 2 / 25

slide-3
SLIDE 3

Table of Contents

1

Introduction

2

Attribute-Based Access Control (ABAC)

3

Semantic-Based Access Control (SBAC)

4

Semantic Attribute-Based Access Control (SABAC)

Hamed Arshad (UiO) SABAC March 2018 3 / 25

slide-4
SLIDE 4

Introduction

Access control: restricting access for computer resources, especially in multi-user and data sharing settings

Hamed Arshad (UiO) SABAC March 2018 4 / 25

slide-5
SLIDE 5

Introduction

Access control: restricting access for computer resources, especially in multi-user and data sharing settings Authentication vs Access control

Hamed Arshad (UiO) SABAC March 2018 4 / 25

slide-6
SLIDE 6

Introduction

Access control: restricting access for computer resources, especially in multi-user and data sharing settings Authentication vs Access control Authentication: Who goes there?

Hamed Arshad (UiO) SABAC March 2018 4 / 25

slide-7
SLIDE 7

Introduction

Access control: restricting access for computer resources, especially in multi-user and data sharing settings Authentication vs Access control Authentication: Who goes there?

Restrictions on who (or what) can access the system

Hamed Arshad (UiO) SABAC March 2018 4 / 25

slide-8
SLIDE 8

Introduction

Access control: restricting access for computer resources, especially in multi-user and data sharing settings Authentication vs Access control Authentication: Who goes there?

Restrictions on who (or what) can access the system

Access control: Are you allowed to do that?

Hamed Arshad (UiO) SABAC March 2018 4 / 25

slide-9
SLIDE 9

Introduction

Access control: restricting access for computer resources, especially in multi-user and data sharing settings Authentication vs Access control Authentication: Who goes there?

Restrictions on who (or what) can access the system

Access control: Are you allowed to do that?

Restrictions on actions of authenticated users

Hamed Arshad (UiO) SABAC March 2018 4 / 25

slide-10
SLIDE 10

Introduction

Access control: restricting access for computer resources, especially in multi-user and data sharing settings Authentication vs Access control Authentication: Who goes there?

Restrictions on who (or what) can access the system

Access control: Are you allowed to do that?

Restrictions on actions of authenticated users

Access control enforced by

Hamed Arshad (UiO) SABAC March 2018 4 / 25

slide-11
SLIDE 11

Introduction

Access control: restricting access for computer resources, especially in multi-user and data sharing settings Authentication vs Access control Authentication: Who goes there?

Restrictions on who (or what) can access the system

Access control: Are you allowed to do that?

Restrictions on actions of authenticated users

Access control enforced by

Access Control Lists Capabilities ...

Hamed Arshad (UiO) SABAC March 2018 4 / 25

slide-12
SLIDE 12

Table of Contents

1

Introduction

2

Attribute-Based Access Control (ABAC)

3

Semantic-Based Access Control (SBAC)

4

Semantic Attribute-Based Access Control (SABAC)

Hamed Arshad (UiO) SABAC March 2018 5 / 25

slide-13
SLIDE 13

Attribute-Based Access Control (ABAC)

ABAC a successor of RBAC

Hamed Arshad (UiO) SABAC March 2018 6 / 25

slide-14
SLIDE 14

Attribute-Based Access Control (ABAC)

ABAC a successor of RBAC

control based on the entities attributes

Hamed Arshad (UiO) SABAC March 2018 6 / 25

slide-15
SLIDE 15

Attribute-Based Access Control (ABAC)

ABAC a successor of RBAC

control based on the entities attributes

A set of attributes in ABAC

Hamed Arshad (UiO) SABAC March 2018 6 / 25

slide-16
SLIDE 16

Attribute-Based Access Control (ABAC)

ABAC a successor of RBAC

control based on the entities attributes

A set of attributes in ABAC

the same as a role in RBAC

Hamed Arshad (UiO) SABAC March 2018 6 / 25

slide-17
SLIDE 17

Attribute-Based Access Control (ABAC)

ABAC a successor of RBAC

control based on the entities attributes

A set of attributes in ABAC

the same as a role in RBAC

The XACML standard

Hamed Arshad (UiO) SABAC March 2018 6 / 25

slide-18
SLIDE 18

Attribute-Based Access Control (ABAC)

ABAC a successor of RBAC

control based on the entities attributes

A set of attributes in ABAC

the same as a role in RBAC

The XACML standard

a policy language, which is sufficiently fine-grained and declarative

Hamed Arshad (UiO) SABAC March 2018 6 / 25

slide-19
SLIDE 19

Attribute-Based Access Control (ABAC)

ABAC a successor of RBAC

control based on the entities attributes

A set of attributes in ABAC

the same as a role in RBAC

The XACML standard

a policy language, which is sufficiently fine-grained and declarative as well as an architecture for ABAC

Hamed Arshad (UiO) SABAC March 2018 6 / 25

slide-20
SLIDE 20

Attribute-Based Access Control (ABAC)

Hamed Arshad (UiO) SABAC March 2018 7 / 25

slide-21
SLIDE 21

Attribute-Based Access Control (ABAC)

Hamed Arshad (UiO) SABAC March 2018 7 / 25

slide-22
SLIDE 22

Attribute-Based Access Control (ABAC)

Hamed Arshad (UiO) SABAC March 2018 7 / 25

slide-23
SLIDE 23

Attribute-Based Access Control (ABAC)

Hamed Arshad (UiO) SABAC March 2018 7 / 25

slide-24
SLIDE 24

Attribute-Based Access Control (ABAC)

Hamed Arshad (UiO) SABAC March 2018 7 / 25

slide-25
SLIDE 25

Attribute-Based Access Control (ABAC)

Hamed Arshad (UiO) SABAC March 2018 7 / 25

slide-26
SLIDE 26

Attribute-Based Access Control (ABAC)

Hamed Arshad (UiO) SABAC March 2018 8 / 25

slide-27
SLIDE 27

Attribute-Based Access Control (ABAC)

Hamed Arshad (UiO) SABAC March 2018 8 / 25

slide-28
SLIDE 28

Attribute-Based Access Control (ABAC)

ABAC is supposed to be a proper solution in open and distributed systems

Hamed Arshad (UiO) SABAC March 2018 9 / 25

slide-29
SLIDE 29

Attribute-Based Access Control (ABAC)

ABAC is supposed to be a proper solution in open and distributed systems Heterogeneous systems = mismatch between attributes

Hamed Arshad (UiO) SABAC March 2018 9 / 25

slide-30
SLIDE 30

Attribute-Based Access Control (ABAC)

ABAC is supposed to be a proper solution in open and distributed systems Heterogeneous systems = mismatch between attributes

Example

An e-healthcare system may represent adult patients with an attribute “Adult”

Hamed Arshad (UiO) SABAC March 2018 9 / 25

slide-31
SLIDE 31

Attribute-Based Access Control (ABAC)

ABAC is supposed to be a proper solution in open and distributed systems Heterogeneous systems = mismatch between attributes

Example

An e-healthcare system may represent adult patients with an attribute “Adult” Patients may try to prove using “hasDriverLicense” or “age”

Hamed Arshad (UiO) SABAC March 2018 9 / 25

slide-32
SLIDE 32

Attribute-Based Access Control (ABAC)

ABAC is supposed to be a proper solution in open and distributed systems Heterogeneous systems = mismatch between attributes

Example

An e-healthcare system may represent adult patients with an attribute “Adult” Patients may try to prove using “hasDriverLicense” or “age” Considering all the possible synonyms (semantically) of each attribute

Hamed Arshad (UiO) SABAC March 2018 9 / 25

slide-33
SLIDE 33

Attribute-Based Access Control (ABAC)

ABAC is supposed to be a proper solution in open and distributed systems Heterogeneous systems = mismatch between attributes

Example

An e-healthcare system may represent adult patients with an attribute “Adult” Patients may try to prove using “hasDriverLicense” or “age” Considering all the possible synonyms (semantically) of each attribute

defining several policies or one general policy

Hamed Arshad (UiO) SABAC March 2018 9 / 25

slide-34
SLIDE 34

Attribute-Based Access Control (ABAC)

ABAC is supposed to be a proper solution in open and distributed systems Heterogeneous systems = mismatch between attributes

Example

An e-healthcare system may represent adult patients with an attribute “Adult” Patients may try to prove using “hasDriverLicense” or “age” Considering all the possible synonyms (semantically) of each attribute

defining several policies or one general policy

A change in the policy

Hamed Arshad (UiO) SABAC March 2018 9 / 25

slide-35
SLIDE 35

Attribute-Based Access Control (ABAC)

ABAC is supposed to be a proper solution in open and distributed systems Heterogeneous systems = mismatch between attributes

Example

An e-healthcare system may represent adult patients with an attribute “Adult” Patients may try to prove using “hasDriverLicense” or “age” Considering all the possible synonyms (semantically) of each attribute

defining several policies or one general policy

A change in the policy

a large number of manual work

Hamed Arshad (UiO) SABAC March 2018 9 / 25

slide-36
SLIDE 36

Attribute-Based Access Control (ABAC)

ABAC is supposed to be a proper solution in open and distributed systems Heterogeneous systems = mismatch between attributes

Example

An e-healthcare system may represent adult patients with an attribute “Adult” Patients may try to prove using “hasDriverLicense” or “age” Considering all the possible synonyms (semantically) of each attribute

defining several policies or one general policy

A change in the policy

a large number of manual work

ABAC needs to be extended

Hamed Arshad (UiO) SABAC March 2018 9 / 25

slide-37
SLIDE 37

Table of Contents

1

Introduction

2

Attribute-Based Access Control (ABAC)

3

Semantic-Based Access Control (SBAC)

4

Semantic Attribute-Based Access Control (SABAC)

Hamed Arshad (UiO) SABAC March 2018 10 / 25

slide-38
SLIDE 38

Semantic-Based Access Control (SBAC)

Hamed Arshad (UiO) SABAC March 2018 11 / 25

slide-39
SLIDE 39

Table of Contents

1

Introduction

2

Attribute-Based Access Control (ABAC)

3

Semantic-Based Access Control (SBAC)

4

Semantic Attribute-Based Access Control (SABAC)

Hamed Arshad (UiO) SABAC March 2018 12 / 25

slide-40
SLIDE 40

Semantic Attribute-Based Access Control (SABAC)

Idea: ABAC + semantic technologies

Hamed Arshad (UiO) SABAC March 2018 13 / 25

slide-41
SLIDE 41

Semantic Attribute-Based Access Control (SABAC)

Idea: ABAC + semantic technologies

making decisions semantically as well as considering the semantic relationships for inferring implicit policies from explicit ones

Hamed Arshad (UiO) SABAC March 2018 13 / 25

slide-42
SLIDE 42

Semantic Attribute-Based Access Control (SABAC)

Idea: ABAC + semantic technologies

making decisions semantically as well as considering the semantic relationships for inferring implicit policies from explicit ones

Formally define entities and their attributes and relationships using an

  • ntology

Hamed Arshad (UiO) SABAC March 2018 13 / 25

slide-43
SLIDE 43

Semantic Attribute-Based Access Control (SABAC)

Idea: ABAC + semantic technologies

making decisions semantically as well as considering the semantic relationships for inferring implicit policies from explicit ones

Formally define entities and their attributes and relationships using an

  • ntology

Describing relations for specific conditions using rule markup languages

Hamed Arshad (UiO) SABAC March 2018 13 / 25

slide-44
SLIDE 44

Semantic Attribute-Based Access Control (SABAC)

Separation of ontology management from access management

Hamed Arshad (UiO) SABAC March 2018 14 / 25

slide-45
SLIDE 45

Semantic Attribute-Based Access Control (SABAC)

Separation of ontology management from access management Two parts:

An ontology management system

Hamed Arshad (UiO) SABAC March 2018 14 / 25

slide-46
SLIDE 46

Semantic Attribute-Based Access Control (SABAC)

Separation of ontology management from access management Two parts:

An ontology management system

provides the extended user and resource attributes

Hamed Arshad (UiO) SABAC March 2018 14 / 25

slide-47
SLIDE 47

Semantic Attribute-Based Access Control (SABAC)

Separation of ontology management from access management Two parts:

An ontology management system

provides the extended user and resource attributes

An access control system

Hamed Arshad (UiO) SABAC March 2018 14 / 25

slide-48
SLIDE 48

Semantic Attribute-Based Access Control (SABAC)

Separation of ontology management from access management Two parts:

An ontology management system

provides the extended user and resource attributes

An access control system

uses the extended attributes for access evaluation

Hamed Arshad (UiO) SABAC March 2018 14 / 25

slide-49
SLIDE 49

Semantic Attribute-Based Access Control (SABAC)

What has been done till now?

Hamed Arshad (UiO) SABAC March 2018 15 / 25

slide-50
SLIDE 50

Semantic Attribute-Based Access Control (SABAC)

What has been done till now?

Hamed Arshad (UiO) SABAC March 2018 15 / 25

slide-51
SLIDE 51

Semantic Attribute-Based Access Control (SABAC)

What has been done till now?

Hamed Arshad (UiO) SABAC March 2018 16 / 25

slide-52
SLIDE 52

Semantic Attribute-Based Access Control (SABAC)

What has been done till now?

Hamed Arshad (UiO) SABAC March 2018 17 / 25

slide-53
SLIDE 53

Semantic Attribute-Based Access Control (SABAC)

What has been done till now?

Hamed Arshad (UiO) SABAC March 2018 18 / 25

slide-54
SLIDE 54

Semantic Attribute-Based Access Control (SABAC)

What has been done till now?

Hamed Arshad (UiO) SABAC March 2018 19 / 25

slide-55
SLIDE 55

Semantic Attribute-Based Access Control (SABAC)

The existing approaches can be categorized as:

Hamed Arshad (UiO) SABAC March 2018 20 / 25

slide-56
SLIDE 56

Semantic Attribute-Based Access Control (SABAC)

The existing approaches can be categorized as: Hybrid models: ABAC + SBAC

Amini et al. “A combination of semantic and attribute based access control model for virtual organizations,” The ISC Int. J. of Inf. Sec., 2015.

Hamed Arshad (UiO) SABAC March 2018 20 / 25

slide-57
SLIDE 57

Semantic Attribute-Based Access Control (SABAC)

The existing approaches can be categorized as: Hybrid models: ABAC + SBAC

Amini et al. “A combination of semantic and attribute based access control model for virtual organizations,” The ISC Int. J. of Inf. Sec., 2015.

New policy languages

Calvillo et al. “Privilege management infrastructure for virtual organizations in healthcare grids,” IEEE Trans. on Inf. Tech. in Biomed., 2011. Lu and Sinnott, “Semantic privacy-preserving framework for electronic health record linkage,” Telematics and Informatics, 2017. Amini and Jalili, “Multi-level authorisation model and framework for distributed semantic-aware environments,” IET Inf. Sec., 2010. Hsu, “Extensible access control markup language integrated with semantic web technologies,” Inf. Sci., 2013.

Hamed Arshad (UiO) SABAC March 2018 20 / 25

slide-58
SLIDE 58

Semantic Attribute-Based Access Control (SABAC)

The existing approaches can be categorized as: Hybrid models: ABAC + SBAC

Amini et al. “A combination of semantic and attribute based access control model for virtual organizations,” The ISC Int. J. of Inf. Sec., 2015.

New policy languages

Calvillo et al. “Privilege management infrastructure for virtual organizations in healthcare grids,” IEEE Trans. on Inf. Tech. in Biomed., 2011. Lu and Sinnott, “Semantic privacy-preserving framework for electronic health record linkage,” Telematics and Informatics, 2017. Amini and Jalili, “Multi-level authorisation model and framework for distributed semantic-aware environments,” IET Inf. Sec., 2010. Hsu, “Extensible access control markup language integrated with semantic web technologies,” Inf. Sci., 2013.

Extending the XACML architecture

Priebe et al. “Supporting attribute-based access control with ontologies”. In ARES

  • 2006. IEEE.

Dersingh et al.“Utilizing semantic knowledge for access control in pervasive and ubiquitous systems,” Mob. Net. & App., 2010. Drozdowicz et al. “Semantically enriched data access policies in ehealth,” J. of

  • med. sys., 2016.

Damiani et al. “Extending policy languages to the semantic web,” in Int. Conf. on Web Eng., 2004. Hilia et al. “Semantic based authorization framework for multi-domain collaborative cloud environments,” Procedia Com. Sci., 2017.

Hamed Arshad (UiO) SABAC March 2018 20 / 25

slide-59
SLIDE 59

Semantic Attribute-Based Access Control (SABAC)

Hybrid models: ABAC + SBAC

Hamed Arshad (UiO) SABAC March 2018 21 / 25

slide-60
SLIDE 60

Semantic Attribute-Based Access Control (SABAC)

Hybrid models: ABAC + SBAC

A two-stage process:

Hamed Arshad (UiO) SABAC March 2018 21 / 25

slide-61
SLIDE 61

Semantic Attribute-Based Access Control (SABAC)

Hybrid models: ABAC + SBAC

A two-stage process: First stage: ABAC for access control inside organizations

Hamed Arshad (UiO) SABAC March 2018 21 / 25

slide-62
SLIDE 62

Semantic Attribute-Based Access Control (SABAC)

Hybrid models: ABAC + SBAC

A two-stage process: First stage: ABAC for access control inside organizations

XACML policies

Hamed Arshad (UiO) SABAC March 2018 21 / 25

slide-63
SLIDE 63

Semantic Attribute-Based Access Control (SABAC)

Hybrid models: ABAC + SBAC

A two-stage process: First stage: ABAC for access control inside organizations

XACML policies

Second stage: a global SBAC server

Hamed Arshad (UiO) SABAC March 2018 21 / 25

slide-64
SLIDE 64

Semantic Attribute-Based Access Control (SABAC)

Hybrid models: ABAC + SBAC

A two-stage process: First stage: ABAC for access control inside organizations

XACML policies

Second stage: a global SBAC server

OWL ontology for entities and SWRL rules for access policies

Hamed Arshad (UiO) SABAC March 2018 21 / 25

slide-65
SLIDE 65

Semantic Attribute-Based Access Control (SABAC)

Hybrid models: ABAC + SBAC

A two-stage process: First stage: ABAC for access control inside organizations

XACML policies

Second stage: a global SBAC server

OWL ontology for entities and SWRL rules for access policies The ontology has two basic concepts (Subject and Object) and two basic relations (Permission and Prohibition)

Hamed Arshad (UiO) SABAC March 2018 21 / 25

slide-66
SLIDE 66

Semantic Attribute-Based Access Control (SABAC)

Hybrid models: ABAC + SBAC

A two-stage process: First stage: ABAC for access control inside organizations

XACML policies

Second stage: a global SBAC server

OWL ontology for entities and SWRL rules for access policies The ontology has two basic concepts (Subject and Object) and two basic relations (Permission and Prohibition)

Hamed Arshad (UiO) SABAC March 2018 21 / 25

slide-67
SLIDE 67

Semantic Attribute-Based Access Control (SABAC)

Hamed Arshad (UiO) SABAC March 2018 22 / 25

slide-68
SLIDE 68

Semantic Attribute-Based Access Control (SABAC)

New policy languages

Hamed Arshad (UiO) SABAC March 2018 23 / 25

slide-69
SLIDE 69

Semantic Attribute-Based Access Control (SABAC)

New policy languages

MA(DL)2 logic for policy specification and inference

Hamed Arshad (UiO) SABAC March 2018 23 / 25

slide-70
SLIDE 70

Semantic Attribute-Based Access Control (SABAC)

New policy languages

MA(DL)2 logic for policy specification and inference

Hamed Arshad (UiO) SABAC March 2018 23 / 25

slide-71
SLIDE 71

Semantic Attribute-Based Access Control (SABAC)

Extending the XACML architecture

Hamed Arshad (UiO) SABAC March 2018 24 / 25

slide-72
SLIDE 72

Semantic Attribute-Based Access Control (SABAC)

Extending the XACML architecture

Adding a component to the architecture

Hamed Arshad (UiO) SABAC March 2018 24 / 25

slide-73
SLIDE 73

Semantic Attribute-Based Access Control (SABAC)

Extending the XACML architecture

Adding a component to the architecture

Hamed Arshad (UiO) SABAC March 2018 24 / 25

slide-74
SLIDE 74

Thank you!

Hamed Arshad (UiO) SABAC March 2018 25 / 25