Proactive identification and prevention of unexpected future rule conflicts in attribute based access control

Daren Zha; Jiwu Jing; Peng Liu; Jingqiang Lin; Xiaoqi Jia

doi:10.1007/978-3-642-12189-0_41

Proactive identification and prevention of unexpected future rule conflicts in attribute based access control

Daren Zha, Jiwu Jing, Peng Liu, Jingqiang Lin, Xiaoqi Jia

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

Abstract

Attribute based access control (ABAC) provides an intuitive way for security administrators to express conditions (associated with status of objects) in access control policies; however, during the design and development of an ABAC system, new problems concerning the consistency and security of the ABAC system may emerge. In this paper, we report on two specific ABAC problems denoted as the "future rule conflicts" problem and the "object overlapping" problem, which we have recently identified in developing the ABAC system for a large research laboratory. We use real world examples to illustrate the negative impact of these two problems and present two novel algorithms for the identification and prevention of these problems. We give the correctness proof for both algorithm and apply these algorithms to the attribute based laboratory control (ABLC) system and the results are also reported.

Original language	English (US)
Title of host publication	Computational Science and Its Applications - ICCSA 2010 - International Conference, Proceedings
Publisher	Springer Verlag
Pages	468-481
Number of pages	14
Edition	PART 4
ISBN (Print)	3642121888, 9783642121883
DOIs	https://doi.org/10.1007/978-3-642-12189-0_41
State	Published - 2010
Event	2010 International Conference on Computational Science and Its Applications, ICCSA 2010 - Fukuoka, Japan Duration: Mar 23 2010 → Mar 26 2010

Publication series

Name	Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Number	PART 4
Volume	6019 LNCS
ISSN (Print)	0302-9743
ISSN (Electronic)	1611-3349

Other

Other	2010 International Conference on Computational Science and Its Applications, ICCSA 2010
Country/Territory	Japan
City	Fukuoka
Period	3/23/10 → 3/26/10

All Science Journal Classification (ASJC) codes

Theoretical Computer Science
General Computer Science

Access to Document

10.1007/978-3-642-12189-0_41

Cite this

Zha, D., Jing, J., Liu, P., Lin, J., & Jia, X. (2010). Proactive identification and prevention of unexpected future rule conflicts in attribute based access control. In Computational Science and Its Applications - ICCSA 2010 - International Conference, Proceedings (PART 4 ed., pp. 468-481). (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 6019 LNCS, No. PART 4). Springer Verlag. https://doi.org/10.1007/978-3-642-12189-0_41

Zha, Daren ; Jing, Jiwu ; Liu, Peng et al. / Proactive identification and prevention of unexpected future rule conflicts in attribute based access control. Computational Science and Its Applications - ICCSA 2010 - International Conference, Proceedings. PART 4. ed. Springer Verlag, 2010. pp. 468-481 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); PART 4).

@inproceedings{f72d3684434941089db6f48c67d4277d,

title = "Proactive identification and prevention of unexpected future rule conflicts in attribute based access control",

abstract = "Attribute based access control (ABAC) provides an intuitive way for security administrators to express conditions (associated with status of objects) in access control policies; however, during the design and development of an ABAC system, new problems concerning the consistency and security of the ABAC system may emerge. In this paper, we report on two specific ABAC problems denoted as the {"}future rule conflicts{"} problem and the {"}object overlapping{"} problem, which we have recently identified in developing the ABAC system for a large research laboratory. We use real world examples to illustrate the negative impact of these two problems and present two novel algorithms for the identification and prevention of these problems. We give the correctness proof for both algorithm and apply these algorithms to the attribute based laboratory control (ABLC) system and the results are also reported.",

author = "Daren Zha and Jiwu Jing and Peng Liu and Jingqiang Lin and Xiaoqi Jia",

note = "Funding Information: This work is supported by 863 Foundation No.2006AA01Z454, and NSF No.70890084/G021102.; 2010 International Conference on Computational Science and Its Applications, ICCSA 2010 ; Conference date: 23-03-2010 Through 26-03-2010",

year = "2010",

doi = "10.1007/978-3-642-12189-0_41",

language = "English (US)",

isbn = "3642121888",

series = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",

publisher = "Springer Verlag",

number = "PART 4",

pages = "468--481",

booktitle = "Computational Science and Its Applications - ICCSA 2010 - International Conference, Proceedings",

address = "Germany",

edition = "PART 4",

}

Zha, D, Jing, J, Liu, P, Lin, J & Jia, X 2010, Proactive identification and prevention of unexpected future rule conflicts in attribute based access control. in Computational Science and Its Applications - ICCSA 2010 - International Conference, Proceedings. PART 4 edn, Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), no. PART 4, vol. 6019 LNCS, Springer Verlag, pp. 468-481, 2010 International Conference on Computational Science and Its Applications, ICCSA 2010, Fukuoka, Japan, 3/23/10. https://doi.org/10.1007/978-3-642-12189-0_41

Proactive identification and prevention of unexpected future rule conflicts in attribute based access control. / Zha, Daren; Jing, Jiwu; Liu, Peng et al.
Computational Science and Its Applications - ICCSA 2010 - International Conference, Proceedings. PART 4. ed. Springer Verlag, 2010. p. 468-481 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 6019 LNCS, No. PART 4).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

TY - GEN

T1 - Proactive identification and prevention of unexpected future rule conflicts in attribute based access control

AU - Zha, Daren

AU - Jing, Jiwu

AU - Liu, Peng

AU - Lin, Jingqiang

AU - Jia, Xiaoqi

N1 - Funding Information: This work is supported by 863 Foundation No.2006AA01Z454, and NSF No.70890084/G021102.

PY - 2010

Y1 - 2010

N2 - Attribute based access control (ABAC) provides an intuitive way for security administrators to express conditions (associated with status of objects) in access control policies; however, during the design and development of an ABAC system, new problems concerning the consistency and security of the ABAC system may emerge. In this paper, we report on two specific ABAC problems denoted as the "future rule conflicts" problem and the "object overlapping" problem, which we have recently identified in developing the ABAC system for a large research laboratory. We use real world examples to illustrate the negative impact of these two problems and present two novel algorithms for the identification and prevention of these problems. We give the correctness proof for both algorithm and apply these algorithms to the attribute based laboratory control (ABLC) system and the results are also reported.

AB - Attribute based access control (ABAC) provides an intuitive way for security administrators to express conditions (associated with status of objects) in access control policies; however, during the design and development of an ABAC system, new problems concerning the consistency and security of the ABAC system may emerge. In this paper, we report on two specific ABAC problems denoted as the "future rule conflicts" problem and the "object overlapping" problem, which we have recently identified in developing the ABAC system for a large research laboratory. We use real world examples to illustrate the negative impact of these two problems and present two novel algorithms for the identification and prevention of these problems. We give the correctness proof for both algorithm and apply these algorithms to the attribute based laboratory control (ABLC) system and the results are also reported.

UR - http://www.scopus.com/inward/record.url?scp=77952313354&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=77952313354&partnerID=8YFLogxK

U2 - 10.1007/978-3-642-12189-0_41

DO - 10.1007/978-3-642-12189-0_41

M3 - Conference contribution

AN - SCOPUS:77952313354

SN - 3642121888

SN - 9783642121883

T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

SP - 468

EP - 481

BT - Computational Science and Its Applications - ICCSA 2010 - International Conference, Proceedings

PB - Springer Verlag

T2 - 2010 International Conference on Computational Science and Its Applications, ICCSA 2010

Y2 - 23 March 2010 through 26 March 2010

ER -

Zha D, Jing J, Liu P, Lin J, Jia X. Proactive identification and prevention of unexpected future rule conflicts in attribute based access control. In Computational Science and Its Applications - ICCSA 2010 - International Conference, Proceedings. PART 4 ed. Springer Verlag. 2010. p. 468-481. (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); PART 4). doi: 10.1007/978-3-642-12189-0_41

Proactive identification and prevention of unexpected future rule conflicts in attribute based access control

Abstract

Publication series

Other

All Science Journal Classification (ASJC) codes

Access to Document

Other files and links

Fingerprint

Cite this