Scenario-aware access control model

Dibin SHAN; Xuehui DU; Wenjuan WANG; Na WANG; Aodi LIU

doi:10.11959/j.issn.2096-109x.2024003

您当前的位置：

首页 >

文章列表页 >

Scenario-aware access control model

Papers | 更新时间：2024-06-03

- Scenario-aware access control model
- Chinese Journal of Network and Information Security Vol. 10, Issue 1, Pages: 58-78(2024)
- 作者机构：
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2024003
  CLC： TP309
- Online First：2024-02，
  
  Published：25 February 2024
- 稿件说明：
移动端阅览
Dibin SHAN, Xuehui DU, Wenjuan WANG, et al. Scenario-aware access control model[J]. Chinese Journal of Network and Information Security, 2024, 10(1): 58-78.
DOI：

Dibin SHAN, Xuehui DU, Wenjuan WANG, et al. Scenario-aware access control model[J]. Chinese Journal of Network and Information Security, 2024, 10(1): 58-78. DOI： 10.11959/j.issn.2096-109x.2024003.

摘要

动态访问控制模型是构建大数据动态访问控制系统的理论基础，而现有访问控制模型大多只能满足单一情景下的动态访问控制，无法适应大数据上下文环境变化、实体关系变更和客体状态变迁等多类型动态情景中的访问控制。针对上述问题，在现有访问控制模型的研究的基础上，对大数据动态因素进行分析，提出基于场景感知的访问控制（SAAC，scenario-aware access control）模型。将各类型动态因素转换为属性、关系等基本元素；并引入场景信息对各类组成元素进行统一建模；基于场景信息构建大数据动态访问控制模型，以实现对多类型动态因素、扩展动态因素的支持。设计 SAAC 模型的工作框架，并提出框架工作流程对应的基于场景感知的访问控制模型规则学习算法和 SAAC 规则执行算法，以实现访问控制规则自动学习和动态访问控制决策。通过引入非传递无干扰理论，分析并验证了对所提模型的安全性。为验证所提模型访问控制策略挖掘方法的有效性，将SAAC模型与ABAC-L、PBAC-X、DTRM和FB-CAAC等基线模型在4个数据集上进行了实验对比。实验结果表明，SAAC模型及其策略挖掘方法的ROC曲线的线下面积、单调性和陡峭度等指标的结果均优于基线模型，验证了所提模型能够支持多类型动态因素和动态因素扩展，其挖掘算法所得的访问控制规则的综合质量相对较高。

Abstract

Dynamic access control model is the theoretical basis for constructing a dynamic access control system for big data.However

most existing access control models can only fulfill dynamic access control in a single scenario and are unable to adapt to access control in multiple types of dynamic scenarios.These scenarios include changes in the contextual environment of big data

changes in entity relationships

and changes in the state of objects.To address these issues

an analysis was conducted based on the research of existing access control models and the dynamic factors of big data.Subsequently

scenario-aware access control (SAAC) model was proposed

which was based on dynamic factor conversion and scenario unified modeling.All types of dynamic factors were converted into basic elements such as attributes and relationships.Then

scene information was incorporated to model the various types of constituent elements in a unified manner.A big data dynamic access control model was constructed based on scene information to support multi-type dynamic factors and extended dynamic factors.The working framework of the SAAC model was designed

and the SAAC rule learning algorithm and SAAC rule execution algorithm were proposed corresponding to the workflow of the framework.This enabled the automatic learning of access control rules and dynamic access control decision-making.The security of the proposed model was analyzed and verified by introducing the non-transitive non-interference theory.To validate the effectiveness of the access control policy mining method of the proposed model

experimental comparisons were conducted between the SAAC model and baseline models such as ABAC-L

PBAC-X

DTRM

and FB-CAAC using four datasets.The experimental results demonstrate that the SAAC model and its strategy mining method outperforms the baseline models in terms of metrics such as area under the curve AUC

monotonicity

and steepness of the ROC curve.This verification confirms that the proposed model can support multiple types of dynamic factors and dynamic factor extensions

and that the combined effect of the access control rules obtained from its mining algorithm is relatively high.

关键词

Keywords

references

李昊 , 张敏 , 冯登国 , 等 . 大数据访问控制研究 [J ] . 计算机学报 , 2017 ,( 1 ): 72 - 91 .

LI H , ZHANG M , FENG D G , et al . Research on access control for big data [J ] . Journal of Computer Science , 2017 ,( 1 ): 72 - 91 .

SERVOS D , OSBORN S L . Current research and open problems in attribute-based access control [J ] . ACM Computing Surveys , 2017 , 49 ( 4 ): 1 - 45 .

CHEN X , GAO Y , TANG H , et al . Research progress on big data security technology [J ] . Scientia Sinica Informationis , 2020 , 50 ( 1 ): 25 - 66 .

高振升 , 曹利峰 , 杜学绘 . 基于区块链的访问控制技术研究进展 [J ] . 网络与信息安全学报 , 2021 , 7 ( 6 ): 68 - 87 .

GAO Z S , CAO L F , DU X H . Research progress of access control based on blockchain [J ] . Chinese Journal of Network and Information Security , 2021 , 7 ( 6 ): 68 - 87 .

KAYES A S M , KALARIA R , SARKER I H , et al . A survey of context-aware access control mechanisms for cloud and fog networks:taxonomy and open research issues [J ] . Sensors (Basel) , 2020 , 20 ( 9 ): 1 - 34 .

刘敖迪 , 杜学绘 , 王娜 , 等 . 基于深度学习的ABAC访问控制策略自动化生成技术 [J ] . 通信学报 , 2020 , 41 ( 12 ): 8 - 20 .

LIU A D , DU X H , WANG N , et al . Automatic Generation technology of ABAC access control policy based on deep learning [J ] . Journal on Communications , 2020 , 41 ( 12 ): 8 - 20 .

单棣斌 , 杜学绘 , 王文娟 , 等 . 基于 GNN 双源学习的访问控制关系预测方法 [J ] . 网络与信息安全学报 , 2022 , 8 ( 5 ): 40 - 55 .

SHAN D B , DU X H , WANG W J , et al . Access control relationship prediction method based on GNN dual source learning [J ] . Chinese Journal of Network and Information Security , 2022 , 8 ( 5 ): 40 - 55 .

PARK J , NGUYEN D , SANDHU R . A provenance-based access control model [C ] // Proceedings of 2012 Tenth Annual International Conference on Privacy,Security and Trust (PST) . 2012 : 137 - 144 .

AKAICHI I , KIRRANE S . Usage control specification,enforcement,and robustness:a survey [J ] . 2022,arXiv:2203.04800[04.23 2023] .

BERTINO E , BONATTI P A , FERRARI E . TRBAC:A temporal role-based access control model [C ] // Proceedings of TISSEC2001 . 2001 : 191 - 233 .

BERTINO E , CATANIA B , DAMIANI M L , et al . GEO-RBAC:a spatially aware RBAC [C ] // Proceedings of the 10th Symposium on Access Control Models and Technologies . 2005 : 29 - 37 .

CHANDRAN S M , JOSHI J B . LoT-RBAC:A location and time-based RBAC model [C ] // Proceedings of the International Conference on Web Information Systems Engineering . 2005 : 361 - 375 .

ASIM Y , MALIK A K . A survey on access control techniques for social networks [M ] . Information Diffusion Management and Knowledge Sharing . 2020 : 319 - 342 .

BUI T , STOLLER S D . A decision tree learning approach for mining relationship-based access control policies [C ] // Proceedings of the 25th ACM Symposium on Access Control Models and Technologies . 2020 : 167 - 178 .

BUI T , STOLLER S D , LE H . Efficient and extensible policy mining for relationship-based access control [C ] // Proceedings of the 24th ACM Symposium on Access Control Models and Technologies . 2019 : 161 - 172 .

KAYES A S M , RAHAYU W , DILLON T , et al . Context-aware access control with imprecise context characterization for cloudbased data resources [J ] . Futur Gener Comp Syst , 2019 , 93 : 237 - 255 .

KAYES A S M , HAN J , RAHAYU W , et al . A policy model and framework for context-aware access control to information resources [J ] . Comput J , 2019 , 62 ( 5 ): 670 - 705 .

BERTOLISSI C , HARTOG J D , ZANNONE N . Using provenance for secure data fusion in cooperative systems [C ] // Proceedings of the 24th ACM Symposium on Access Control Models and Technologies . 2019 : 185 - 194 .

YU Y , XIA T , WANG H , et al . Semantic-aware spatio-temporal app usage representation via graph convolutional network [J ] . Proc ACM Interact Mob Wearable Ubiquitous Technol , 2020 , 4 ( 3 ): 101 : 101 - 124 .

CHAKRABORTY S , SANDHU R . Formal analysis of ReBAC policy mining feasibility [C ] // Proceedings of CODASPY '21 . 2021 : 197 - 207 .

FAN X , ZHANG F , SONG J , et al . A fine-grained policy model for provenance-based access control and policy algebras [J ] . 2020,arXiv:2001.01945 , 2023 .

GROUP N B D P W , SUBGROUP D A T . NIST big data interoperability framework:volume 1,definitions [R ] . 2019 .

GROUP N B D P W , SUBGROUP D A T . NIST big data interoperability framework:volume 2,big data taxonomies [R ] . 2019 .

李学龙 , 龚海刚 . 大数据系统综述 [J ] . 中国科学:信息科学 , 2015 , 45 ( 1 ): 1 - 44 .

LI X L , GONG H G . A survey on big data systems [J ] . SCIENTIA SINICA Informationis , 2015 , 45 ( 1 ): 1 - 44 .

ARSHAD H , JOHANSEN C , OWE O . Semantic attribute-based access control:a review on current status and future perspectives [J ] . Journal of Systems Architecture , 2022 ,129:102625.

KAYES A S M , HAN J , COLMAN A . ICAF:a context-aware framework for access control [M ] . Information Security and Privacy . 2012 : 442 - 449 .

KAYES A S M , RAHAYU W , WATTERS P , et al . Achieving security scalability and flexibility using fog-based context-aware access control [J ] . Futur Gener Comp Syst , 2020 , 107 : 307 - 323 .

KAYES A S M , HAN J , COLMAN A . An ontological framework for situation-aware access control of software services [J ] . Information Systems , 2015 , 53 : 253 - 277 .

MCINTOSH T , WATTERS P , KAYES A S M , et al . Enforcing situation-aware access control to build malware-resilient file systems [J ] . Future Generation Computer Systems , 2021 , 115 : 568 - 582 .

CORRADI A , MONTANARI R , TIBALDI D . Context-based access control for ubiquitous service provisioning [C ] // Proceedings of the 28th Annual International Computer Software and Applications Conference (COMPSAC’04) . 2004 : 444 - 451 .

BUI T , STOLLER S D , LI J J . Greedy and evolutionary algorithms for mining relationship-based access control policies [J ] . Computers＆ Security , 2019 , 80 : 317 - 333 .

IYER P , MASOUMZADEH A . Active learning of relationship-based access control policies [C ] // Proceedings of the 25th ACM Symposium on Access Control Models and Technologies . 2020 : 155 - 166 .

KAYES A S M , HAN J , COLMAN A , et al . RelBOSS:a relationship-aware access control framework for software services [M ] // MEERSMAN R,PANETTO H,DILLON T,et al . On the Move to Meaningful Internet Systems : Otm 2014 Conferences . 2014 : 258 - 276 .

SUN L , PARK J , NGUYEN D , et al . A provenance-aware access control framework with typed provenance [J ] . IEEE Trans Dependable Secur Comput , 2016 , 13 ( 4 ): 411 - 423 .

NGUYEN D , PARK J , SANDHU R . A provenance-based access control model for dynamic separation of duties [C ] // Proceedings of 2013 Eleventh Annual Conference on Privacy,Security and Trust (PST) . 2013 : 247 - 256 .

CHAKRABORTY S , SANDHU R . On feasibility of attributeaware relationship-based access control policy mining [M ] // Berlin : Springer.Data and Applications Security and Privacy . 2021 : 393 - 405 .

HU V C , FERRAIOLO D , KUHN R , et al . Guide to attribute based access control (abac) definition and considerations:NIST special publication 800-162 [S ] . 2014 : 1 - 37 .

KAYES A S M , HAN J , COLMAN A , et al . A semantic policy framework for context-aware access control applications [C ] // Proceedings of 2013 12th IEEE International Conference on Trust,Security and Privacy in Computing and Communications . 2013 : 753 - 762 .

KAYES A S M , RAHAYU W , DILLON T . An ontology-based approach to dynamic contextual role for pervasive access control [C ] // Proceedings 2018 IEEE 32nd International Conference on Advanced Information Networking and Applications . 2018 : 601 - 608 .

MOREAU L , CLIFFORD B , FREIRE J , et al . The open provenance model core specification (v1.1) [J ] . Future Generation Computer Systems , 2011 , 27 ( 6 ): 743 - 756 .

MISSIER P , BELHAJJAME K , CHENEY J . The W3C PROV family of specifications for modelling provenance metadata [C ] // Proceedings of the 16th International Conference . 2013 : 773 - 776 .

BATRA G , ATLURI V , VAIDYA J , et al . Incremental maintenance of ABAC Policies [C ] // Proceedings of the Eleventh ACM Conference on Data and Application Security and Privacy , 2021 .

SHAN D , DU X , WANG W , et al . GNN-based method for predicting access control relationships for big data [C ] // 2022 2nd International Conference on Computer Science,Electronic Information Engineering and Intelligent Control Technology (CEI) . 2022 .

HAN J , PEI J , YIN Y , et al . Mining frequent patterns without candidate generation:a frequent-pattern tree approach [J ] . Data Mining and Knowledge Discovery , 2004 , 8 ( 1 ): 53 - 87 .

HUANG H , FU Y , HU J , et al . Research on distributed dynamic trusted access control based on security subsystem [J ] . IEEE Transactions on Information Forensics and Security , 2022 : 1 - 15 .

RUSHBY J . Noninterference,transitivity,and channel-control security policies [R ] . 2005 .

WANG X , JI H , SHI C , et al . Heterogeneous graph attention network [C ] // Proceedings of The World Wide Web Conference(WWW '19) . 2019 : 2022 - 2032 .

TU Z , LI R , LI Y , et al . Your apps give you away distinguishing mobile users by their app usage fingerprints [C ] // Proceedings of the ACM on Interactive,Mobile,Wearable and Ubiquitous Technologies . 2018 , 138 : 131 - 123 .

KARIMI L , ALDAIRI M . An automatic attribute based access control policy extraction from access logs [J ] . IEEE Trans Dependable Secur Comput , 2022 , 19 ( 4 ): 2304 - 2317 .

SANDERS M W , YUE C,ACM . Mining least privilege attribute based access control policies [C ] // Proceedings of 35th Annual Computer Security Applications Conference (ACSA) . 2019 : 404 - 416 .

Views

201

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Research progress of access control based on blockchain

Key-customizable encrypted deduplication with access control for cloud storage

Network security of the National Natural Science Foundation of China: today and prospects

Hardcoded vulnerability detection approach for IoT device firmware

Access control relationship prediction method based on GNN dual source learning

Related Author

Zhensheng GAO

Lifeng CAO

YU Nenghai

LI Weihai

XU Zikai

GU Bolun

Dong LI

Yanni HAO

Related Institution

Anhui Province Key Laboratory of Digital Security

School of Cyber Science and Technology, University of Science and Technology of China

School of Computer and Data Science, Fuzhou University

Beijing Beilong Yunhai Network Data Technology Co., Ltd.

Information Center of National Natural Science Commission

⁰